Tuesday, July 04, 2006

Naming structure of recycle bin files

Was doing some research on the structure of the Windows Recycle Bin, and found an interesting article over at Microsoft. It talks about the naming structure of the files in the Recyle Bin directories. In essence, the structure is as follows:



D<drive letter from original path><order #>.<original extension>


The <order #> field is a number signifying when the order the file was deleted since the recycle bin was last emptied.

For example, lets say I empty the recycle bin and then delete the following files (in the order shown):

c:\somefile.txt
e:\document.doc
d:\picture.jpg
f:\suspect_file.txt

Then, in the recycle bin directory for my user, I would find the following file names:

Dc1.txt
De2.doc
Dd3.jpg
Df4.txt

This is probably already well known, thought it would be interesting to share.





<< Home

This page is powered by Blogger. Isn't yours?

My blog has moved! Redirecting…

You should be automatically redirected. If not, visit http://www.forensicblog.org and update your bookmarks.