Windows – Open files inside Windows Recycle Bin

data-recoveryfilesfilesystemswindows

I've done lots of research on trying to recover files from another user's recycle bin (Windows 10). They can just log in themselves, but I wanted to work on their ticket while they're out of office.

So far, I have figured out their user SID and retrieved their Recycle Bin directory from C:\$Recycle.Bin. The files are no longer hidden system files and look normal, but the file names are all jumbled and corrupt when I try to open them in Microsoft Word (Word docs) or any other types.

Does anyone know how I would "decrypt" these? Is it even worth the time compared to waiting for them to come back and log in?

Thanks!

Best Answer

In C:\$RECYCLE.BIN\S-1-5-21-xxxxxxxxx-xxxxxxxxx-xxxxxxxxxx-xxxx\ the files aren't copies of the deleted files. Instead, they are files containing enough information for restoring the file.

Deleted file

In this example a file C:\Users\Public\Documents\test.txt containing short plain text is deleted. Now, in $RECYCLE.BIN\<SID> we have a file $IWRIFSD.txt containing:

HxD of $IWRIFSD.txt

The filename is a hash based on the metadata and the contents of this file are:

  • binary presentation of the file size and permissions
  • pointer to the file data on the hard drive
  • the original path to the file stored in wide byte chars (thus, the 00 spaces).

Therefore, you probably need either to log in as the user or use some 3rd party recovery tool.


Deleted folder

With deleted folders the recovery isn't that tricky. With similar test file inside a folder, test\test.txt:

C:\$RECYCLE.BIN\S-1-5-21-xxxxxxxxx-xxxxxxxxx-xxxxxxxxxx-xxxx\$RVW70HC>type test.txt
Content to be manually recovered.

Only the folder name gets "jumbled" i.e. replaced with the hash of the metadata, but the names and contents of files seems to be intact.