01Location
- C:\$Recycle.Bin\<SID>\$I*
- C:\$Recycle.Bin\<SID>\$R*
- C:\Recycler\<SID>\INFO2 (Windows 2000, XP, 2003)
02Questions it answers
- Which files did a user move to the Recycle Bin?
- What were their original names and locations?
- When were they deleted, and what was their original size?
- Is the content still available in the corresponding $R file?
03Format and versions
| Format | $I: 8-byte format version (1 = Windows Vista, 2 = Windows 10), 8-byte original size, deletion FILETIME, then a UTF-16LE original path (version 2 inserts a 4-byte character count first). INFO2: 20-byte header and 800-byte entries (280 bytes on Windows Me) with ASCII and UTF-16LE names, index, drive number and deletion FILETIME. |
|---|---|
| Applies to | Recycler/INFO2: Windows Me, 2000, XP and 2003. $Recycle.Bin: Windows Vista and later; $I format version 2 from Windows 10. |
04Key fields
| Field | What it tells you |
|---|---|
| Format version ($I) | 1 or 2; determines whether a filename length precedes the path. |
| Original file size | Size of the deleted item. |
| Deletion date and time | When the item was moved to the Recycle Bin. |
| Original filename | Full original path in UTF-16LE. |
| <SID> folder | Security identifier of the profile that owns the folder. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| $I deletion date and time | FILETIME (UTC) | Deletion (move) time; the file's own times remain in the file system metadata of the $R file. |
| INFO2 deletion date and time | FILETIME (UTC) | Per-entry deletion time in the legacy format. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Enumerate $Recycle.Bin (or Recycler) on every volume and every SID sub-folder.
- Parse each $I file, checking the format version, and pair it with its $R file.
- Resolve the SID to a user account and hash recovered $R content.
- Correlate with $UsnJrnl, $MFT and LNK files for the item's history before deletion.
07Interpretation pitfalls
- Parsers must handle both $I versions; version 2 adds a length field before the path.
- Unused bytes of INFO2 filename fields can contain remnant data; do not treat it as part of the name.
- The record shows which profile's bin held the item; it does not by itself identify the process that performed the deletion.
09Sources
- Windows Recycle.Bin file formats libyal / dtformats (J. Metz) · checked 2026-10-14
- Windows Recycler file formats (INFO2) libyal / dtformats (J. Metz) · checked 2026-10-14
- RBCmd README Eric Zimmerman (GitHub) · checked 2026-10-14
- Windows artifact definitions (windows.yaml) ForensicArtifacts / artifacts · checked 2026-10-14