Thread by @therealwlambert

🦖Day 67 of the @velocidex #velociraptor #ArtifactsOfAutumn series

Artifact: Windows[.]Forensics[.]RecycleBin

Author: @svch0st

Link: docs.velociraptor.app/artifact_refer…

This artifact parses the $I files found in the Windows Recycle Bin folder ($Recycle.Bin, as of Windows Vista) to obtain the time of deletion and the original path and file name.

This folder contains:
- $I files ("Recycled" file metadata)
- $R files (the original data)

The contents of the Recycle Bin directory are organized by SID ('C:\$Recycle.Bin\%SID%\').

It's important to note that this artifact uses the API to read available $I data. There may be additional unallocated but readable $I files referenced in the MFT that may be recoverable.

We can optionally upload recovered files using the 'AlsoUpload' parameter when creating a collection for this artifact.

This artifact provides the following information:

- Time when file was deleted
- Name
- Original file path
- File size
- Full path/$I path
- Recycle path/$R path
- Upload details

That's it for now! Stay tuned to learn about more artifacts! 🦖

Also, check out the links below for more information about the Recycle Bin in Windows!

forensicswiki.xyz/wiki/index.php…
magnetforensics.com/blog/artifact-…