Hi Per,
When you delete a file, the complete path and file name is stored in a
hidden file called Info2 in the Recycler folder.
for example, Dc12466.txt
D means Deleted.
c means the dile was deleted from the C: drive.
12466 means it was the 12466th deleted file.
txt means it was a text file, probably testing_2.txt
I wonder why the high number, 12466? INFO2 messed up?
If I paste this into the Run command (Start | Run ) and click OK
C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003\info2
the Open With applet comes up.
Select Notepad and click OK or just double click on Notepad from the list.
INFO2 opens.
Or you can do this in a command prompt...
start C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003\info2
the Open With applet comes up.
Select Notepad and click OK or just double click on Notepad from the list.
INFO2 opens.
This what's in my INFO2...
C:\Documents and Settings\Wesley P. Vogel\Desktop\278startmenupin.reg
C : \ D o c u m e n t s a n d S e t t i n g s \ W e s l e y P . V o
g e l \ D e s k t o p \ 2 7 8 s t a r t m e n u p i n . r e g
C:\Documents and Settings\Wesley P. Vogel\Desktop\startmenupin.reg
C : \ D o c u m e n t s a n d S e t t i n g s \ W e s l e y P . V o
g e l \ D e s k t o p \ s t a r t m e n u p i n . r e g
C:\Documents and Settings\Wesley P. Vogel\Desktop\pinlistenable.reg
C : \ D o c u m e n t s a n d S e t t i n g s \ W e s l e y P . V o
g e l \ D e s k t o p \ p i n l i s t e n a b l e . r e g
C:\Documents and Settings\Wesley P. Vogel\Desktop\New Text Document.txt
C : \ D o c u m e n t s a n d S e t t i n g s \ W e s l e y P . V o
g e l \ D e s k t o p \ N e w T e x t D o c u m e n t . t x t
------------
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\>cd C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003
C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003>dir
Volume in drive C is Local Disk
Volume Serial Number is 901E-9F82
Directory of C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003
22-Nov-06 10:46 AM 1,454 Dc1.reg
22-Nov-06 10:43 AM 1,454 Dc2.reg
22-Nov-06 10:45 AM 161 Dc3.reg
22-Nov-06 11:42 AM 0 Dc4.txt
4 File(s) 3,069 bytes
0 Dir(s) 2,128,506,880 bytes free
C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003>
--------------
You can see how Dc1.reg, Dc2.reg, Dc3.reg and Dc4.txt relate to
278startmenupin.reg, startmenupin.reg, pinlistenable.reg and New Text
Document.txt.
> Also, I'd like to be able to restore the files put in the trashcan
> (even if I put them there from the command line).
Would probably be some sort of a Shell function or call. I have no idea
which one and am not going to go look. Most of that stuff is over my head.
> But when I look in the trashcan using the standard GUI I cannot see the
> file in there. The trashcan looks as if is empty.
[[No files may appear in the Recycle Bin if the files in the Recycled folder
are damaged.]]
Run chkdsk. Reboot. Look at the Recycle Bin again.
INFO2 can become corrupted and if it cannot be fixed it needs to be deleted.
Cannot Delete Any Files in Windows
http://support.microsoft.com/kb/246726
How the Recycle Bin Stores Files
http://support.microsoft.com/kb/136517
> Is there perhaps some other exe-file that is run when a user presses
> the "delete" button in a regular folder view? and/or generates the info
> in INFO2?
My silly wild a** guess would be explorer.exe and shell32.dll.
I just found this one, looks interesting haven't read it yet.
Forensic Analysis of Microsoft Windows Recycle Bin Records
http://www.e-fense.com/helix/Docs/Re...nstruction.pdf
or view as html
http://72.14.253.104/search?q=cache:...s&ct=clnk&cd=2
--
Hope this helps. Let us know.
Wes
MS-MVP Windows Shell/User
In news:(E-Mail Removed),
per9000 <(E-Mail Removed)> hunted and pecked:
> Hi Wesley,
>
> yes, indeed this seems to move files to the trashcan-folder. From the
> command line I can now see the file (I emptied the trashcan so it was
> empty before I put hello_world.log in there)
>
> ...
> Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05
>
> 2006-02-13 14:13 2 180 hello_world.log
> 1 File(s) 2 180 bytes
> ...
>
> But when I look in the trashcan using the standard GUI I cannot see the
> file in there. The trashcan looks as if is empty.
>
> Also, I'd like to be able to restore the files put in the trashcan
> (even if I put them there from the command line). Typically a file has
> an original location, a date it was removed etc.
>
> Just to illustrate: I created a file "testing_2.txt" and put it in
> trash from the regular gui.
>
> Now if I look in the folder from DOS it looks like this:
>
> Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05
>
> 2006-11-22 09:08 0 Dc12466.txt
> 2006-02-13 14:13 2 180 hello_world.log
>
> Or using Cygwin "ls -lh"
> total 9.0K
> -rwx------+ 1 per None 0 Nov 22 09:08 Dc12466.txt
> -rwx------+ 1 per None 820 Nov 22 09:08 INFO2
> -rwx------+ 1 per None 65 Nov 1 11:42 desktop.ini
> -rwx------+ 1 per None 2.2K Feb 13 2006 hello_world.log
>
> The file INFO2 seems to contain the info I need to integrate
>
>> type INFO2
> ♣ u☺ ▒0 ♥ æö♀☺C:\Documents and
> Settings\per\Desktop\testing_2.txt
>
> ♫╟☺ C : \ D o c u m e n t s a n d S e t t i n g s \ p e r
> \ D e s k t o p \ t e s t i n g _ 2 . t x t
>
> My ultimate goal would be a bat-file (f.x. foobar.bat) in my bin-folder
> looking something like this:
> move /Y %* C:\RECYCLER\S-1-5-21-*NUMBERS*05
> That integrates with the regular trashcan. Being able to restore later
> is my goal.
>
> Is there perhaps some other exe-file that is run when a user presses
> the "delete" button in a regular folder view? and/or generates the info
> in INFO2?
>
> Thanks,
> Per
>
>
> Wesley Vogel wrote:
>> Move
>> Moves one or more files from one directory to the specified directory.
>>
>> Type in a command prompt: Move /?
>>
>> More Move HELP.
>> Paste the following line into Start | Run and click OK...
>>
>> hh ntcmds.chm::/move.htm
>>
>> Each hard disk or partition contains a hidden folder named Recycler. The
>> Recycler folder is used only on NTFS partitions. On FAT32 the RECYCLED
>> folder is used. The Recycler folder contains a Recycle Bin for each user
>> that logs on to the computer, sorted by their security identifier (SID).
>>
>> My hard drive is formatted NTFS.
>>
>> This is MY SID #
>> S-1-5-21-1708537768-15xx36667-1202660629-1003
>>
>> This is MY Recycle Bin
>> C:\RECYCLER\S-1-5-21-1708537768-15xx36667-1202660629-1003
>>
>> Your Recycle Bin would be similar, but you need to know your SID #.
>>
>> This registry key lists all of the SIDs.
>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
>> NT\CurrentVersion\ProfileList
>>
>> To tell which user has which SID, click on each SID, look at
>> ProfileImagePath, the Data has the user name at the end of the path.
>> I.e. %SystemDrive%\Documents and Settings\Wesley P. Vogel
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news:(E-Mail Removed),
>> per9000 <(E-Mail Removed)> hunted and pecked:
>>> Hi all,
>>>
>>> I work a lot in windows from the command line. I'd like to be able to,
>>> instead of only deleting a file (f.x. "del *.tmp") be able to move it
>>> to the trashcan.
>>>
>>> I could just move to C:\MyTrashCan, but I'd like it to be able to
>>> browse, and preferably replace files later with the standard trash can
>>> view.
>>>
>>> Thanks,
>>> Per