https://www.recyclebinparser.com/en/docs Articles on Windows Recycle Bin internals, $I/$R file formats, and digital forensics. en Thu, 28 May 2026 13:22:48 GMT https://www.recyclebinparser.com/en/docs/convert-windows-filetime-timestamp https://www.recyclebinparser.com/en/docs/convert-windows-filetime-timestamp What the 64-bit FILETIME in a Recycle Bin $I file means, how to convert it to a UTC date by hand, and why timezone handling matters for forensic timelines. Florian Amette Tue, 19 May 2026 00:00:00 GMT https://www.recyclebinparser.com/en/docs/i-file-vs-r-file https://www.recyclebinparser.com/en/docs/i-file-vs-r-file How the paired $I metadata file and $R content file work together inside the Windows $Recycle.Bin, and why forensics relies on both. Florian Amette Tue, 19 May 2026 00:00:00 GMT https://www.recyclebinparser.com/en/docs/is-recycle-bin-folder-safe-to-delete https://www.recyclebinparser.com/en/docs/is-recycle-bin-folder-safe-to-delete Why the hidden $Recycle.Bin folder appears on every drive (including USB sticks), whether it is malware, and what actually happens if you delete it. Florian Amette Tue, 19 May 2026 00:00:00 GMT https://www.recyclebinparser.com/en/docs/recover-deleted-files-from-recycle-bin https://www.recyclebinparser.com/en/docs/recover-deleted-files-from-recycle-bin Restore files from the Windows Recycle Bin, and understand what is still recoverable on disk after you empty it — using the $I metadata as your map. Florian Amette Tue, 19 May 2026 00:00:00 GMT https://www.recyclebinparser.com/en/docs/understanding-the-recycle-bin https://www.recyclebinparser.com/en/docs/understanding-the-recycle-bin A practitioner's tour of the Windows $Recycle.Bin folder, the $I and $R files inside it, and why it matters for digital forensics and file recovery. Florian Amette Mon, 18 May 2026 00:00:00 GMT https://www.recyclebinparser.com/en/docs/how-to-parse-recycle-bin-i-files https://www.recyclebinparser.com/en/docs/how-to-parse-recycle-bin-i-files Three ways to read Windows $I Recycle Bin metadata — a browser parser with zero install, Eric Zimmerman's RBCmd, and a quick manual hex walkthrough. Florian Amette Sun, 17 May 2026 00:00:00 GMT https://www.recyclebinparser.com/en/docs/the-i-file-format https://www.recyclebinparser.com/en/docs/the-i-file-format Byte-level layout of the Windows Recycle Bin $I index file across Windows Vista through Windows 11 — header, file size, FILETIME, and the original path. Florian Amette Sun, 17 May 2026 00:00:00 GMT https://www.recyclebinparser.com/en/docs/where-is-the-recycle-bin https://www.recyclebinparser.com/en/docs/where-is-the-recycle-bin The exact filesystem path of the Windows Recycle Bin, why it is hidden, and how to acquire $I/$R files from a live machine or forensic image. Florian Amette Sun, 17 May 2026 00:00:00 GMT https://www.recyclebinparser.com/en/docs/recycle-bin-forensics-investigation https://www.recyclebinparser.com/en/docs/recycle-bin-forensics-investigation What the Windows Recycle Bin proves in a DFIR case — intentional deletion, anti-forensic behaviour, suspect timelines — with a worked example. Florian Amette Sat, 16 May 2026 00:00:00 GMT https://www.recyclebinparser.com/en/docs/recycle-bin-sid-folders-explained https://www.recyclebinparser.com/en/docs/recycle-bin-sid-folders-explained Why $Recycle.Bin contains folders with long S-1-5-21 names, how to map a SID to a Windows user, and what that means for deletion attribution. Florian Amette Sat, 16 May 2026 00:00:00 GMT