Recycle Bin

Location & availability

$Recycle.Bin\<SID> on the relevant volume; paired $I and $R items on supported Windows versions

Permanent deletion, application cleanup and different delete paths may bypass the bin. Retention depends on settings and later use.

Fields to examine

• $I metadata: original path, original size and recorded deletion time.
• Corresponding $R data where retained.
• Volume and SID directory containing the pair.

What it can establish

• Support a recorded move-to-Recycle-Bin operation and original path.
• Allow examination of retained file bytes when the data pair survives.

What it cannot prove

• Prove intent to hide evidence.
• Claim that no deletion occurred because the bin is empty.

Use it in a screenshare

1. Preserve matching metadata/data pairs and their source volume.
2. Parse metadata with RBCmd and resolve the SID context. Confirm the timestamp format and pairing.
3. Hash retained data and correlate the file’s original path with USN or execution artifacts. Record missing pairs without attempting a live restore.

Worked example

A utility’s bin entry predates the disputed match. This supports deletion into the bin at that recorded time. It does not establish that the player ran the utility during the match, nor that all traces were removed.

Cross-check the finding

• USN Journal / $UsnJrnl →Support recorded file/directory changes and a sequence within retained journal coverage.
• $MFT →Support the presence and recorded metadata of a particular file record.
• Prefetch →Support execution of an associated executable within the retained history.

Sources

• RBCmd — Recycle Bin parser ↗