Recycle Bin

File Location:

• C:\$Recycle.Bin

Every user will have their own recycle bin.

Parse Data

RBCmd.exe -d F:\Tools\investigation\logs\ --csv F:\Tools\investigation\logs\logs1

Parses meta data file and outputs metadata.

Considerations

• Contains 2 different files. ($I $R, and 6 random characters after)

  • $I1RBNY7.png < Metadata file

  • $R1RBNY7.png < Actual deleted file

Anti-Forensics

• Delete files with SDelete.

• Permanant deletion will not place file into recycle bin, it will just update MFT, USNJrnl, $I30, $Bitmap, etc.

• File carving is recovering file from sequences when there is no metadata record that exists (MFT,etc).