Cyber Dumpster-Diving: $Recycle.Bin Forensics for Windows 7 and Windows Vista

Analysis of deleted files often provides useful information for the forensic computer examiner. Knowing where to find the deleted files, and how to interpret the metadata associated with the file’s deletion, make up the cornerstone of a successful forensic computer examination. Much like an office trash-can, the Microsoft Windows Recycle Bin is a temporary holding container for files that have been recently discarded (deleted) by the user. Microsoft first introduced the Recycle Bin with its Windows 95 Operating System (released in 1995). This original Recycle Bin implementation was modified for the implementations of the Windows XP Operating System (released in 2001), the Windows Vista Operating System (released in 2007) and the Windows 7 Operating System (released in 2009). Although the Windows XP Recycle Bin is well understood by the forensic examiner community, the Recycle Bins found in Windows Vista and Windows 7 are generally, significantly less understood. In this paper, The author compares and contrasts the similarities and differences of the Recycle Bin of the Windows Vista and Windows 7 Operating Systems, and the Recycle Bin of the Windows XP Operating System. In this investigation, the author pointsout the details of each implementation that are of interest for the forensic computer examiner.