Monday, October 29, 2018

Daily Blog #522: Forensic Lunch Test Kitchen 10/29/18

Hello Reader,
        Tonight on the test kitchen we followed up on a viewer request from Neck aka @AaronSWeiss  on twitter to do some $Recycle.Bin testing on Windows 10 and Windows 7. I validated some facts I've tested before, but not necessarily on Windows 10 as well learned new things.

Here is what we learned:

  • On a fixed disk NTFS drive the $Recycle.Bin will be created as soon as a user copy a files on a drive
  • The $Recycle.Bin will contain the sid of the user interacting with the drive
  • If the NTFS drive is plugged into another system with a $Recycle.Bin already present the next system will create a directory under the $Recycle.Bin directory with that user's SID
  • That the $R files in the recycle bin are really just renamed operations changing the original file name and parent directory on the disk
  • That every fixed disk has its own recycle bin, even though Windows presents a unified view
  • That on FAT formatted fixed disks that $Recycle.Bin's do not contain a SID directory
  • That on FAT formatted fixed disks moved between systems that both systems will share the same $Recycle.Bin directory
Here is the video: