Where is the Recycle Bin located on disk in Windows?
The exact filesystem path of the Windows Recycle Bin, why it is hidden, and how to acquire $I/$R files from a live machine or forensic image.
3 min read
The desktop Recycle Bin is a shell namespace, not a real folder. On disk the artefacts live at the root of each NTFS volume, hidden behind two attributes that keep most users (and a depressing number of triage scripts) from noticing them.
The actual paths
C:\$Recycle.Bin\
D:\$Recycle.Bin\
E:\$Recycle.Bin\
One per fixed volume. Fixed FAT32 and exFAT volumes get a
$Recycle.Bin too, but without NTFS permissions there is no per-user
ACL separation, so tying an entry to a user is weaker. Removable media
(USB flash drives, SD cards) is the real gap: Windows bypasses the
Recycle Bin there by default and deletes go straight to free space.
That is one of the easier anti-forensic moves on Windows: copy your
exfil to a USB stick, delete, hand back the stick.
Pre-Vista systems used a different layout entirely: C:\RECYCLER\ on
NTFS, C:\RECYCLED\ on FAT. Inside, the INFO2 index recorded the
same kind of metadata the $I does today, but as a single flat file
rather than per-entry files. If you are working a Windows XP / 2000
case (still happens for legacy SCADA hosts), do not look for $I.
Why you cannot see it
$Recycle.Bin has both the Hidden and System attributes. Windows
Explorer hides Hidden by default and refuses to show System unless you
also disable "Hide protected operating system files". From a command
prompt:
dir /a C:\$Recycle.Bin
…lists it regardless of attribute settings. PowerShell:
Get-ChildItem -Force C:\$Recycle.Bin
Inside, you find one subfolder per user, named after their SID. See Recycle Bin SID subfolders for how to read the SID format.
Acquiring the files
For investigation you want every $Recycle.Bin on every volume,
including external disks that were attached during the relevant window.
- Forensic image (E01, raw, AFF4). The cleanest path. Mount read-only and copy the tree out.
- KAPE. The
RecycleBintarget pulls every$I/$Rpair across volumes, including handle-locked ones. - Velociraptor. Collect
Windows.Triage.Targets(or the olderWindows.KapeFiles.Targets) with theRecycleBintarget to pull the same$I/$Rpairs over a fleet of hosts. AvoidWindows.Forensics.RecycleBinfor this: it parses$Ion the endpoint and never uploads the$Ifiles themselves (withAlsoUploadit only uploads$Rcontent renamed after the original file), so nothing is left to pair. - Volume Shadow Copy. Useful for a single live host where you do not want to image the whole disk. A snapshot exposes the bin even when files are locked.
A common mistake: pulling $I files but not the matching $R. Even if
you only intend to read $I metadata, having the $R partner lets you
verify deleted content against the recorded size and lets you recover
the file if needed.
Further reading
Frequently asked questions
What is the full path of the Recycle Bin?
C:\$Recycle.Bin on NTFS volumes (and the same $Recycle.Bin folder at the root of every other drive, e.g. D:\$Recycle.Bin). Older XP systems used C:\RECYCLER or C:\RECYCLED instead.
Why can't I see the $Recycle.Bin folder?
It is both Hidden and System. Enable 'Show hidden files' and uncheck 'Hide protected operating system files' in Folder Options, or use the command line, to see it.
Is there a Recycle Bin on external and USB drives?
External hard drives and SSDs, which Windows treats as fixed disks, get their own $Recycle.Bin at their root. Removable media such as USB flash drives and SD cards bypass the Recycle Bin by default, so files deleted there are removed immediately.
Can I copy Recycle Bin files while Windows is running?
User-owned $I/$R files can usually be copied, but for a sound forensic acquisition use a write-blocker, a forensic image, or a Volume Shadow Copy to preserve metadata and avoid locked-handle issues.