Windows Recycle Bin

Browse Deleted Files
Click Image to Enlarge

Recycle Bin Basics
The Windows recycle bin was introduced with Windows 95. The purpose was to provide a safety net for users who might accidentally delete files that were not intended for deletion. There is an icon for the Recycle Bin on the windows desktop. The icon shows a full recycle bin when it contains files, and an empty recycle bin when no files are present. Files will remain in the recycle bin until the maximum recycle bin size has been reached or as long as the user does not empty the recycle bin. When the recycle bin's maximum size has been reached the oldest contents will be deleted to make room for the most recently deleted. There is a performance drawback to having the recycle bin filled to its limit. When this happens, it increases the time it takes to delete a file, because the older files must be removed while the new ones are being moved to the recycle bin. Through Windows XP, the default size allocated for use by the recycle bin was 10% of the drive. This can be changed anywhere from 0 to 100% of the drive space, but will not be allowed to exceed 3.99GB of space even if the indicated % of the drive is larger than 3.99GB. This 3.99GB limit does not apply in Windows Vista. The recycle bin size settings can be edited by clicking on the recycle bin with the right mouse button and selecting "properties" from the context menu. By default when a file is deleted normally, it is moved to the recycle bin. This includes pressing the keyboard delete key, selecting delete from any standard XP menu, or dragging the file into the recycle bin. This rule only applies to files deleted from local a local hard drive. A file deleted from a network drive or removable media such as a camera memory card, will not be copied into the recycle bin. It will just be deleted. The recycle bin can be bypassed as well for files on a local hard drive by holding down the shift key and pressing the delete key on the keyboard.



How Does the Recycle Bin Work?
When a file is sent to the recycle bin, there is some processing that is performed in the background which is transparent to the user. Windows renames all files that are placed in the recycle bin. A file sent to the recycle bin will be renamed using the following naming scheme: "Dc6.jpg". The "c" in the file name represents the drive letter from which the file was deleted. The 6 means that this was the 7th file that was deleted (if it had been the first file deleted it would be "Dc0.jpg"). The file extension is kept from the original file name. In this case it shows that it was a jpg format image file. Windows keeps track of the original file name and path in a hidden file named info or info2. It uses this information in order to display the files in a more understandable fashion when a user opens the recycle bin as well as to be able to restore the file to its original name and location if a user selects to do so. For this reason, when a user browses the recycle bin, he will still see the original file name instead of the new name. When a file is permanently removed by manually deleting it from the recycle bin or by emptying the recycle bin, the original file name is lost. The file that was deleted remains on the hard disk but with a name such as "Dc6.jpg".

Browse Deleted Files
Click Image to Enlarge

The hidden file that Windows uses to translate the Dc6.jpg style file names to the normal names you see, are not visible by normal browsing methods. The file can be accessed through the following method (windows XP):

Navigate to the following directory using the command prompt "C:\RECYCLER".
Type "dir /ah". You should see a hidden directory with a name like:
S-1-5-21-2025429265-838170752-839522115-1003
Open this directory.
Now type "dir /ah" to see if you have an INFO or INFO2 file. To be able to copy the file, type "attrib -h INFO2". Now type "copy INFO2 c:\". This will copy the file to your root directory. It can be viewed using notepad. To the left is an image of a sample INFO2 file (Some white space has been removed to make it easier to view).




Recovering Files Deleted From the Recycle Bin.
A file that has been deleted by emptying the recycle bin or by manually deleting if from the recycle bin can be recovered using Pandora Recovery. The difficulty lies in the fact that when a file is removed from the recycle bin, its record is also erased from the INFO(2) file. The original path and file name have been lost. This is where the Search feature comes in handy. If you know some information about the file you are trying to recover you can narrow down your search results. You can enter the file extension for the type of file you are looking for. For example, if you are searching for a photo, type *.jpg in the file name section. You can also check the box for date. You can select to enter the last date the file was edited or the date it was created. If it was the only file you edited yesterday and you select only yesterday's date, you should only see that file in the results. There is also a section for file size. If you know the size of the file, you can make your search even more accurate. If are searching for a text of image file and you end up with a list of files with the "Dc6.jpg" type file name, the preview feature can come in handy in locating the file in question.