Recycle Bin forensic

The recycle bin plays a significant role in forensic investigations on Windows filesystems, offering valuable insights into deleted files and user activities. Understanding the recycle bin's functionality and how to extract information from it is crucial for forensic analysts.

Location:

• Windows XP: C:\RECYCLER

• Windows Vista, 7, 8, 10: C:\$Recycle.bin

Interpretation:

• When a file is deleted from a Windows recycle bin-aware program, it is typically moved to the recycle bin first. The recycle bin stores deleted files temporarily before they are permanently removed.

• Within the recycle bin, two types of files are commonly found:

• $I files: These files contain metadata about the deleted files, including their original path, file name, size, and deletion timestamp.

• $R files: These files contain the actual content of the deleted files, allowing for potential recovery.

• 
  

Commands: Locate to C:\$Recycle.bin

1. View hidden files: Use the command DIR /ah to display hidden files, including those in the recycle bin.

2. Get user account information: Use wmic useraccount get name,sid to retrieve information about all user accounts and their corresponding SID (Security Identifier) IDs.

3. Navigate to a specific SID: Move to a particular SID value using the command cd SID, where SID represents the Security Identifier of the user whose recycle bin is being analyzed.

4. Explore recycle bin contents: Within the SID directory, examine the $R and $I files to access recovery data and metadata about deleted files.

5. Parsing $I files: Utilize parsing tools like $I Parse to extract and interpret metadata from

$I files, revealing details about deleted files.

As $R is recoverable files so no need for parsing but $I files need parsing tool use for that is $I Parse

Conclusion:

Understanding the structure and contents of the recycle bin, along with effective parsing techniques, enables forensic analysts to reconstruct file deletion events, recover deleted files, and gain insights into user activities and behavior on the Windows system. This knowledge is invaluable for conducting thorough forensic investigations and uncovering crucial evidence.