When investigating deleted files on a Windows system, analyzing the Recycle Bin metadata can provide crucial insights. In this guide, we’ll look at how to use Eric Zimmerman’s RBCmd.exe and another tool called $I_Parse.exe to extract and analyze deleted file information.
Understanding Recycle Bin Metadata
Windows keeps metadata for deleted files in different formats depending on the version of the operating system:
INFO2 files (used in Windows XP)
$I files (used in Windows Vista and later)
These metadata files store details such as:
Original file name
Path before deletion
Deletion timestamp
File size
Using RBCmd.exe for Analysis
RBCmd.exe is a command-line utility created by Eric Zimmerman that can parse Recycle Bin metadata from both XP and modern Windows systems.
Parsing a Single File
To analyze a specific $I file, run the following command:
RBCmd.exe -f "C:\$Recycle.Bin\S-1-5-21-1094574232-2158178848-303877012-1001\$IZZOXEO.pdf"
Parsing an Entire Directory
If you need to analyze all $I files in a folder, use the -d option:
RBCmd.exe -d "C:\$Recycle.Bin\S-1-5-21-1094574232-2158178848-303877012-1001" --csv C:\Users\Akash's\DownloadsThis will parse all $I files in the specified directory and save the results in a CSV file.
Output:
------------------------------------------------------------------------------------------------------------
Collecting Recycle Bin Artifacts with KAPE
KAPE (Kroll Artifact Parser and Extractor) is a powerful tool that can collect forensic artifacts, including Recycle Bin metadata files.
Steps to Collect Recycle Bin Artifacts Using KAPE:
Open KAPE.
Select the Target Module for Recycle Bin collection.
Specify the output folder where the extracted files should be saved.
Run KAPE
Once collected, you can use RBCmd.exe or $I_Parse.exe to analyze the extracted data.
Using $I_Parse.exe
Another useful tool for parsing Recycle Bin metadata is $I_Parse.exe. While its usage is similar to RBCmd, it provides an alternative way to extract and analyze metadata from deleted files.
Example
Tool is very simple to use mention directory where you collected artifact and destination and click parse.
Output:
Conclusion
Analyzing Recycle Bin metadata is a crucial step in digital forensics. Using RBCmd.exe and $I_Parse.exe, you can quickly extract valuable information about deleted files. Additionally, KAPE simplifies the collection of these artifacts, making your forensic workflow more efficient.
-----------------------------------------------Dean-------------------------------------------------
Comments