Skip to content

This tool can be used to parse the windows 10 Recycle Bin artifacts

Notifications You must be signed in to change notification settings

SatyenderYadav/BinParser

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

3 Commits
 
 
 
 

Repository files navigation

BinParser

What are artifacts in $Recycle.Bin

In Windows Vista, the recycle Bin directory is named $Recycle.Bin and in this inside their SID directory the deleted files and their metadata is stored. There are two files in the windows Recycle Bin $I and $R.

$R file is the original file that is deleted and $I contains the metadata of the file. The filename in the recycle bin is such that $R then some random letters and the metadata of this file will start with $I as discussed and have the same random letters.

The $I file contains the original filename, path, file size, and when the file was deleted.

image

Structure of the $I

image

Image Credit DF-Stream

Usage

python3 main.py -f <$I file>

image

About

This tool can be used to parse the windows 10 Recycle Bin artifacts

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages