:: Training

:: Mailing List
News and updates:

Subscribe here

:: Contact

Contact Us

Email: info@filesig.co.uk

Post: Filesig Software,
PO Box 678,
YO26 0FU

How to extract Vista and Windows 7 Recycle Bin Records

Microsoft Vista and Windows 7 employ a different method of keeping track of individual files that have been recycled than previous Window OS releases, for each file moved to the recycle bin by the operating system a record is created (as individual file)*. These records are typically identified as being 544 bytes in size, the first character of the file record will be '$' and the file extension of the record will be the same the deleted file.

Recycle Bin Records

Above example showing recycle bin records, each 544 bytes in size.

Vista Recycle Bin Reader, part of Simple Carver Suite is a forensic software utility designed to extract information relating to deleted files within the Recycle Bin from the Vista Operating System. It is capable of interpreting the recycle bin records from the Vista OS and show what has been deleted (original filename and path) and when (date/time information).

Vista Recycle Bin Usage:

1. Copy out recycle bin record files to a new folder for processing.
2. Start the Vista Recycle Bin Reader program.
3. Click 'Select Folder' and choose folder containing the records.
4. After processing the records will be decoded and displayed in a grid.
5. Results can be saved as CSV and imported into Excel.

Click HERE for Vista Recycle Bin Reader

* for deleted folders a folder is created.