Windows Recycle Bin $I Parser

Recycle Bin parser — FAQ

What is the $Recycle.Bin folder in Windows?

$Recycle.Bin is the hidden, protected folder at the root of every NTFS volume where Windows (Vista and later) stores deleted files. Inside it, each user has a subfolder named after their SID, containing paired $I metadata files and $R content files.

What is a $I file?

A $I file is the index/metadata record Windows writes when a file is sent to the Recycle Bin. It stores the original full path, the original size in bytes, and the deletion timestamp (a Windows FILETIME). The matching $R file holds the actual content.

Does this tool upload my Recycle Bin files anywhere?

No. Parsing runs entirely in your browser via a Rust parser compiled to WebAssembly. The bytes never leave your machine and there is no upload endpoint — you can disconnect from the network and it still works.

Which Windows versions are supported?

Both $I formats are auto-detected: v1 (Windows Vista, 7, 8, 8.1 — a fixed 544-byte layout) and v2 (Windows 10 and 11 — a variable, length-prefixed layout).

Can I recover the deleted file itself from a $I file?

No. The $I file only contains metadata. The deleted content lives in the paired $R file (same name with $R instead of $I). This tool reconstructs the metadata so you know what the $R file was, when it was deleted, and from where.

Why does the deleted timestamp show UTC?

Windows stores the deletion time as a FILETIME in UTC. The table renders it in your locale while the CSV export keeps a strict ISO-8601 UTC value so timelines stay unambiguous across timezones.