Hello everyone.
In this video you will learn how to analyze recycle bin.
Recycle bin.
Recycle bin is the folder where deleted files are temporarily stored on Windows systems.
This file is located in the recycle bin directory under the main drive.
In every version of the Windows Vista, this mechanism provides user with the ability to recover deleted
files.
The recycle bin folder is located at C dollar recycle bin.
If you can't see the recycle bin folder under the C directory, you can follow these steps.
Go to File Explorer View options and view.
Uncheck the option Hide Protected Operating System files and check the option.
Show hidden files, folders and drives.
Recycle bins.
Forensic value.
By default, deleted files on our computer are stored in the recycle bin directory, and after the deletion
process, two different types of files are created in this directory.
These are the files.
Start with dollar I and dollar for dollar i.
This prefix is used for the information file which contains metadata about a deleted file such as its
original file name size date modified and the location it was deleted from.
The dollar I file is associated with the deleted file and enables the recycle bin to display the original
file name and other information when viewing its contents.
The dollar I file is typically not recoverable as it only contains metadata and not the actual data
of the deleted file.
Dollar R.
This prefix is used for the recovery file which contains the actual data of the deleted file.
This file is renamed with a random alphanumeric name when it is moved to the recycle bin and it is original
file name is stored in the associated dollar file.
These files are valuable sources of information during forensic analysis because they contain data about
deleted files and the time of deletion.
What happens when you delete something from recycle bin?
When you delete a file from the recycle bin on a Windows computer, the record is deleted, but the
record stays for a while.
The operating system marks the space occupied by the file as available for use by other files, and
the file's entry in the data file is updated to reflect that it has been deleted.
The file is typically overwritten as new files are created and deleted, so it is generally assumable
that the dollar I file will be overwritten within a few days to a few weeks at most.
Inside the recycle bin folder below you can see some files inside C Recycle bin and your SSID.
When we type the command dir, we can see the files listed in that directory.
You can see that three of them starts with WRI and the three of them starts with RR.
The extensions and the names are the same except I and R.
It means that three file in here are not deleted from the recycle bin.
But when it comes to the pdf files in here, only the dollar record are listed so we can understand
that these pdf files are deleted from the recycle bin.
But since they are not overridden by the system, we can still see their dollar records.
Recycle bin analysis tools to parse the files located under the recycle bin directory and obtain meaningful
data.
We need the help of tools such as rufy2 to rec index and dollar I parse.
We will proceed using dollar parse and rufy2.
Two tools refer to the repeated tool, analyzes the windows recycle bin folder.
Rafferty can extract the files dollar record deletion time, the original path and the size of the deleted
files.
You can follow the instructions from the relevant GitHub page to download the Rafferty tool.
After downloading the tool you will be presented with two Excel files.
Refer to that Excel and Rafferty Vista dot Excel.
The difference between the two Excel files is that Rafferty X reads the info or info two files in the
recycled or recycler folder for the versions between Windows 95 and XP and also the version 2003, while
Rafferty Vista Dot X examines the recycle bin folder.
We can see the help page for the repeater tool with the comment below.
Refuted Vista dot x Dash H.
In this manual page there are help options and the application options dash o to write output to a file.
Dash x to write output in XML format.
Z specify deletion time.
We to learn the version.
You can run the refuted tool using this command, refuted vista dot x and see recycle bin and related
path which is the ID of your user.
You can view the output as a file using the OR option.
You need to specify the output extension as you see here.
Dollar I parse.
Another tool dollar I parse similar to refute allows us to analyze the recycle bin directory and parse
information about files.
The difference between two tools are dollar parse tool doesn't show information about the equivalent
dollar value related to the file.
The second difference is dollar pastel has graphical user interface.
When you run the application, this interface will welcome you.
You need to specify the full path to the recycle bin in this blank.
And here you need to specify the output directory.
After you fill blank directory, click on parse.
If you want to display parse information using Excel, you need to set the extension name as CSV.
After you open the file, you will see a table similar like this.
Now let's apply what we learned.
I have tools available in this folder and I will write CMD to open a command line.
I want to find the folder where my recycle bin located so I will go to c directory.
And see the dollar arm and tap.
Now let's type CD again, tab, tab and then under tab.
This is the ID of my user.
Enter.
Let's type there.
Okay.
I will copy this directory.
I will type CD.
Copy it.
Okay.
I will only show you the paths tool to not to extend this video any longer.
Double click.
Okay.
Directory of the dollar I files pasted here and the output file.
Let's copy the directory here and paste it over there.
And I will specify the extension to open it using Excel.
Okay, let's parse six files.
Parsed.
Okay.
I will close it.
Let's open it.
In order to see the output properly, click on the column A then go data.
Text to columns.
Deli meats.
Next.
Finish.
Now you can extend the columns manually.
All the details can be seen here.
This video is over.
See you on the next video.