0

I've done lots of research on trying to recover files from another user's recycle bin (Windows 10). They can just log in themselves, but I wanted to work on their ticket while they're out of office.

So far, I have figured out their user SID and retrieved their Recycle Bin directory from C:\$Recycle.Bin. The files are no longer hidden system files and look normal, but the file names are all jumbled and corrupt when I try to open them in Microsoft Word (Word docs) or any other types.

Does anyone know how I would "decrypt" these? Is it even worth the time compared to waiting for them to come back and log in?

Thanks!

  • IMO, the best course of action is to simply wait for the user to return and work on this issue with them. I don't see any value in trying to do this on your own (but I do see the potential for losing/borking the files in question). – joeqwerty May 15 '17 at 22:23
0

In C:\$RECYCLE.BIN\S-1-5-21-xxxxxxxxx-xxxxxxxxx-xxxxxxxxxx-xxxx\ the files aren't copies of the deleted files. Instead, they are files containing enough information for restoring the file.

Deleted file

In this example a file C:\Users\Public\Documents\test.txt containing short plain text is deleted. Now, in $RECYCLE.BIN\<SID> we have a file $IWRIFSD.txt containing:

HxD of $IWRIFSD.txt

The filename is a hash based on the metadata and the contents of this file are:

  • binary presentation of the file size and permissions
  • pointer to the file data on the hard drive
  • the original path to the file stored in wide byte chars (thus, the 00 spaces).

Therefore, you probably need either to log in as the user or use some 3rd party recovery tool.


Deleted folder

With deleted folders the recovery isn't that tricky. With similar test file inside a folder, test\test.txt:

C:\$RECYCLE.BIN\S-1-5-21-xxxxxxxxx-xxxxxxxxx-xxxxxxxxxx-xxxx\$RVW70HC>type test.txt
Content to be manually recovered.

Only the folder name gets "jumbled" i.e. replaced with the hash of the metadata, but the names and contents of files seems to be intact.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.