# Recycle Bin Information

## Overview

**Evidence:** Recycle Bin Information\
**Description:** Collect information about items in recycle bin\
**Category:** System\
**Platform:** windows\
**Short Name:** rbi\
**Is Parsed:** Yes\
**Sent to Investigation Hub:** Yes\
**Collect File(s):** No

## Background

When files are deleted through Windows Explorer, they are moved to the Recycle Bin. Windows creates two files for each deleted item:

* $I file: Contains metadata (original path, deletion time, file size)
* $R file: Contains the actual file content

The $I metadata files can reveal what files were deleted, when, by whom, and their original locations.

## Data Collected

This collector gathers structured data about recycle bin information.

### Recycle Bin Information Data

| Field          | Description                        | Example                               |
| -------------- | ---------------------------------- | ------------------------------------- |
| `FileName`     | Original file name                 | document.docx                         |
| `OriginalPath` | Original file path before deletion | C:\Users\user\Documents\document.docx |
| `SID`          | User SID who deleted the file      | S-1-5-21-...                          |
| `Username`     | Username who deleted the file      | DOMAIN\user                           |
| `Type`         | Whether File or Folder             | File                                  |
| `Attributes`   | File attributes                    | 32                                    |
| `DeletionTime` | When file was deleted              | 2023-10-15T14:30:00                   |
| `OriginalSize` | Original file size before deletion | 1048576                               |

## Collection Method

This collector:

* Searches for `$Recycle.Bin\*` folders on all drives
* Enumerates $I\* files (metadata files)
* Parses $I file format (Version 1 or Version 2)
* Extracts deletion metadata
* References corresponding $R files (recovered content)
* Resolves user SIDs to usernames

## Forensic Value

Recycle Bin analysis is fundamental for recovering deleted evidence and establishing deletion timelines. Investigators use this data to recover deleted files, establish file deletion timelines, identify who deleted files, prove file existence before deletion, track data destruction attempts, and correlate deletions with user activity.