Recycle Bin issue help

Printable View

01.01.18, 13:23
Master Razor

Recycle Bin issue help

I'm using Windows 8.1, and when I am navigating to C:\$RECYCLE.BIN\S-X-XX...\ I see a lot of directories named $R[random characters] and $I[random chars]. For example $RAKJF5, $IPWED2, etc.

From what I've been able to find out, this is normal on Vista and newer. Source:
https://dereknewton.com/2010/06/recy...s-7-and-vista/
In Windows 7 and Vista, Microsoft did away with the INFO2 file and completely changed the way files were named and indexed within the Recycle Bin. Firstly, the new Recycle Bin is located in a hidden directory named \$Recycle.Bin\%SID%, where %SID% is the SID of the user that performed the deletion. Secondly, when files are moved into the Recycle Bin, the original file is renamed to $R followed by a set of random characters, but maintaining the original file extension. At the same time a new file beginning with $I followed by the same set of random characters given to the $R file and the same extension, is created; this file contains the the original filename/path, original file size, and the date and time that the file was moved to the Recycle Bin. You’ll also notice at all of the $I files are exactly 544 bytes long.

At work I am using Windows 7 and it does not behave the same. The files deleted, look exactly the same as the originals, and are not in $R or $I.
Why is that? Could someone with Windows 7 and/or Windows 8+ confirm this behaviour?

TL;DR
Anyone using Windows 7 and/or Windows 8 and newer can help me test if after moving a file to the recycle bin, the file is located as
C:\$RECYCLE.BIN\S-X-XX...\$IXXXXX
C:\$RECYCLE.BIN\S-X-XX...\$RXXXXX

Thanks
01.01.18, 18:25
anon

Uh, I use Windows 7 and this works exactly as described by the article. The thing is, if you open the directory through Windows/File Explorer, the "real" names will show up so that you can restore files no matter how you access the bin. But renaming desktop.ini or using a different file manager will show you the truth :wtinfoil:
01.01.18, 19:36
Master Razor

The article states that Windows 7 uses $R and $I. Why do you have the real names? This is not normal --this is where I am getting at.
Did you check C\$RECYCLE.BIN ?
02.01.18, 04:48
anon

Quote:

Originally Posted by Master Razor

The article states that Windows 7 uses $R and $I. Why do you have the real names?

I don't, I have random filenames as described in the article, but Windows Explorer shows you the real ones because the Recycle Bin is a special folder.
02.01.18, 21:16
anthony-joal

1 Attachment(s)

Using windows 10 i can see exactly what you described.

Attachment 18514

The file which is not blurred out is the .exe that i just put into the recycle bin.
The exe file was created : Nov 27 22:42
The exe file was deleted : Jan 2 21:07
It does matchs with the $I and $R files timestamp

There is also some more $I files that were not deleted when i have empty the bin. (maybe they stay there some more times for recovery purpose).
02.01.18, 21:32
Master Razor

Quote:

There is also some more $I files that were not deleted when i have empty the bin. (maybe they stay there some more times for recovery purpose).

This is exactly where I wanted to go with this. Why are those not deleted? I emptied my Recycle Bin. The Recycle bin on Destop shows empty but the one in C:\$RECYCLE.BIN istill contains some $R and $I.
02.01.18, 21:57
anthony-joal

I presume it's for recovery purpose.
My bet is that, if a file used to fill some disk area, when deleted the $I will remains unless the disk area is claimed by another file on the disk ($I files seems to be kind of a pointer from what i understood, so it does not cost to much to keep it just in case).

But that's just an assumption, it is how i would have made that if i had to implement a recycle bin.
IMO, it makes sense, there is no need to reset the bytes to 0x00 if the files gets deleted, better forget it was there, and let's pretend it has never existed, even if the bytes are still present.
03.01.18, 01:40
anon

Quote:

Originally Posted by Master Razor

This is exactly where I wanted to go with this. Why are those not deleted? I emptied my Recycle Bin. The Recycle bin on Destop shows empty but the one in C:\$RECYCLE.BIN istill contains some $R and $I.

You should have told us all of this in the first place!

The XY Problem

Anyway, I've had lingering files too and have no idea of the cause, but a manual cleanup takes care of it.