+ Reply to Thread
Results 1 to 8 of 8

Thread: Recycle Bin issue help

  1. #1

    Recycle Bin issue help

    I'm using Windows 8.1, and when I am navigating to C:\$RECYCLE.BIN\S-X-XX...\ I see a lot of directories named $R[random characters] and $I[random chars]. For example $RAKJF5, $IPWED2, etc.

    From what I've been able to find out, this is normal on Vista and newer. Source:
    https://dereknewton.com/2010/06/recy...s-7-and-vista/
    In Windows 7 and Vista, Microsoft did away with the INFO2 file and completely changed the way files were named and indexed within the Recycle Bin. Firstly, the new Recycle Bin is located in a hidden directory named \$Recycle.Bin\%SID%, where %SID% is the SID of the user that performed the deletion. Secondly, when files are moved into the Recycle Bin, the original file is renamed to $R followed by a set of random characters, but maintaining the original file extension. At the same time a new file beginning with $I followed by the same set of random characters given to the $R file and the same extension, is created; this file contains the the original filename/path, original file size, and the date and time that the file was moved to the Recycle Bin. You’ll also notice at all of the $I files are exactly 544 bytes long.


    At work I am using Windows 7 and it does not behave the same. The files deleted, look exactly the same as the originals, and are not in $R or $I.
    Why is that? Could someone with Windows 7 and/or Windows 8+ confirm this behaviour?


    TL;DR
    Anyone using Windows 7 and/or Windows 8 and newer can help me test if after moving a file to the recycle bin, the file is located as
    C:\$RECYCLE.BIN\S-X-XX...\$IXXXXX
    C:\$RECYCLE.BIN\S-X-XX...\$RXXXXX



    Thanks
    Reply With QuoteReply With Quote
    Thanks

  2. #2
    Moderator anon's Avatar
    Join Date
    01.02.08
    Posts
    39,370
    Activity Longevity
    11/20 19/20
    Today Posts
    1/5 ssss39370
    Uh, I use Windows 7 and this works exactly as described by the article. The thing is, if you open the directory through Windows/File Explorer, the "real" names will show up so that you can restore files no matter how you access the bin. But renaming desktop.ini or using a different file manager will show you the truth
    "I just remembered something that happened a long time ago."
    Reply With QuoteReply With Quote
    Thanks

  3. #3
    The article states that Windows 7 uses $R and $I. Why do you have the real names? This is not normal --this is where I am getting at.
    Did you check C\$RECYCLE.BIN ?
    Last edited by Master Razor; 01.01.18 at 20:37.
    Reply With QuoteReply With Quote
    Thanks

  4. #4
    Moderator anon's Avatar
    Join Date
    01.02.08
    Posts
    39,370
    Activity Longevity
    11/20 19/20
    Today Posts
    1/5 ssss39370
    Quote Originally Posted by Master Razor View Post
    The article states that Windows 7 uses $R and $I. Why do you have the real names?
    I don't, I have random filenames as described in the article, but Windows Explorer shows you the real ones because the Recycle Bin is a special folder.
    "I just remembered something that happened a long time ago."
    Reply With QuoteReply With Quote
    Thanks

  5. Who Said Thanks:

    anthony-joal (03.01.18) , Master Razor (02.01.18)

  6. #5
    Guest Coder anthony-joal's Avatar
    Join Date
    22.03.17
    Location
    France
    P2P Client
    qBittorrent
    Posts
    188
    Activity Longevity
    0/20 9/20
    Today Posts
    0/5 ssssss188
    Using windows 10 i can see exactly what you described.

    Click image for larger version. 

Name:	recyclebin.png 
Views:	26 
Size:	84.5 KB 
ID:	18514

    The file which is not blurred out is the .exe that i just put into the recycle bin.
    The exe file was created : Nov 27 22:42
    The exe file was deleted : Jan 2 21:07
    It does matchs with the $I and $R files timestamp

    There is also some more $I files that were not deleted when i have empty the bin. (maybe they stay there some more times for recovery purpose).
    Last edited by anthony-joal; 02.01.18 at 22:17.
    This is my signature. There are many others like it, but this one is mine.
    Reply With QuoteReply With Quote
    Thanks

  7. Who Said Thanks:

    Master Razor (02.01.18)

  8. #6
    There is also some more $I files that were not deleted when i have empty the bin. (maybe they stay there some more times for recovery purpose).
    This is exactly where I wanted to go with this. Why are those not deleted? I emptied my Recycle Bin. The Recycle bin on Destop shows empty but the one in C:\$RECYCLE.BIN istill contains some $R and $I.
    Reply With QuoteReply With Quote
    Thanks

  9. Who Said Thanks:

    anthony-joal (02.01.18)

  10. #7
    Guest Coder anthony-joal's Avatar
    Join Date
    22.03.17
    Location
    France
    P2P Client
    qBittorrent
    Posts
    188
    Activity Longevity
    0/20 9/20
    Today Posts
    0/5 ssssss188
    I presume it's for recovery purpose.
    My bet is that, if a file used to fill some disk area, when deleted the $I will remains unless the disk area is claimed by another file on the disk ($I files seems to be kind of a pointer from what i understood, so it does not cost to much to keep it just in case).

    But that's just an assumption, it is how i would have made that if i had to implement a recycle bin.
    IMO, it makes sense, there is no need to reset the bytes to 0x00 if the files gets deleted, better forget it was there, and let's pretend it has never existed, even if the bytes are still present.
    Last edited by anthony-joal; 03.01.18 at 00:00.
    This is my signature. There are many others like it, but this one is mine.
    Reply With QuoteReply With Quote
    Thanks

  11. Who Said Thanks:

    Master Razor (03.01.18)

  12. #8
    Moderator anon's Avatar
    Join Date
    01.02.08
    Posts
    39,370
    Activity Longevity
    11/20 19/20
    Today Posts
    1/5 ssss39370
    Quote Originally Posted by Master Razor View Post
    This is exactly where I wanted to go with this. Why are those not deleted? I emptied my Recycle Bin. The Recycle bin on Destop shows empty but the one in C:\$RECYCLE.BIN istill contains some $R and $I.
    You should have told us all of this in the first place!

    The XY Problem

    Anyway, I've had lingering files too and have no idea of the cause, but a manual cleanup takes care of it.
    "I just remembered something that happened a long time ago."
    Reply With QuoteReply With Quote
    Thanks

+ Reply to Thread

Tags for this Thread

Posting Permissions

  • You may post new threads
  • You may post replies
  • You may not post attachments
  • You may not edit your posts
  •