I'm using Windows 8.1, and when I am navigating to C:\$RECYCLE.BIN\S-X-XX...\ I see a lot of directories named $R[random characters] and $I[random chars]. For example $RAKJF5, $IPWED2, etc.
From what I've been able to find out, this is normal on Vista and newer. Source:
https://dereknewton.com/2010/06/recy...s-7-and-vista/
In Windows 7 and Vista, Microsoft did away with the INFO2 file and completely changed the way files were named and indexed within the Recycle Bin. Firstly, the new Recycle Bin is located in a hidden directory named \$Recycle.Bin\%SID%, where %SID% is the SID of the user that performed the deletion. Secondly, when files are moved into the Recycle Bin, the original file is renamed to $R followed by a set of random characters, but maintaining the original file extension. At the same time a new file beginning with $I followed by the same set of random characters given to the $R file and the same extension, is created; this file contains the the original filename/path, original file size, and the date and time that the file was moved to the Recycle Bin. You’ll also notice at all of the $I files are exactly 544 bytes long.
At work I am using Windows 7 and it does not behave the same. The files deleted, look exactly the same as the originals, and are not in $R or $I.
Why is that? Could someone with Windows 7 and/or Windows 8+ confirm this behaviour?
TL;DR
Anyone using Windows 7 and/or Windows 8 and newer can help me test if after moving a file to the recycle bin, the file is located as
C:\$RECYCLE.BIN\S-X-XX...\$IXXXXX
C:\$RECYCLE.BIN\S-X-XX...\$RXXXXX
Thanks
Bookmarks