Course 36 - Windows Forensics and Tools | Episode 10: Decoding Metadata and File Internals

In this lesson, you’ll learn about: Windows Recycle Bin forensics and deleted file recovery1. Why the Recycle Bin Matters in ForensicsDeleting a file in Windows does not immediately erase itInstead, Windows:Moves it to a hidden system structureRenames itKeeps both metadata and data intact🔹 Key IdeaThe Recycle Bin is often a hidden evidence repository2. Core Forensic InsightDeleted files usually remain:On disk (physically intact)With modified references only👉 Result:Investigators can often recover:FilesPathsDeletion timestamps3. Legacy Windows Recycle Bin (Windows XP and earlier)🔹 Structure UsedINFO2 fileStored inside:Recycler folder🔹 What it containsOriginal file pathFile sizeDeletion order👉 Key Insight:Acts as an index of deleted files4. Modern Windows Recycle Bin (Vista → Windows 10)🔹 Structure Used$Recycle.Bin🔹 File Pair SystemEach deleted file creates two entries:$R fileContains actual file data$I fileContains metadata:Original namePathDeletion timestamp👉 Key Insight:Data and metadata are split for tracking integrity5. Windows 10 Forensic Markers🔹 Version Identification$I file headers contain version indicators:01 → older Windows versions02 → Windows 10 era🔹 Why it mattersHelps investigators determine:Operating system versionTimeline of deletion activity6. Hex-Level Analysis🔹 Tools usedHex editorsForensic analysis tools🔹 What investigators extractFile pathsDeletion timestampsFile size metadataOriginal filenames👉 Key Insight:Even “deleted” files can be reconstructed byte-by-byte7. Forensic Workflow🔹 Step-by-step processAccess $Recycle.BinMatch $R and $I filesDecode metadataReconstruct original file structureExtract evidence8. Investigative Value🔹 What can be recoveredDeleted documentsMalware payloadsSensitive user filesEvidence of file wiping attempts👉 Key Insight:Attackers often forget the Recycle Bin still holds tracesKey TakeawaysRecycle Bin does not permanently delete data immediatelyLegacy systems use INFO2 index filesModern systems use $R and $I file pairsMetadata and file content are separatedHex analysis allows full reconstruction of deleted activityBig PictureRecycle Bin forensics helps investigators:👉 Move from “deleted file” → “recoverable digital evidence”Mental ModelDelete action → Recycle Bin redirect → hidden storage → forensic recoveryYou can listen and download our episodes for free on more than 10 different platforms:https://linktr.ee/cybercode_academy