Files in the recycle bin can't be recovered after the bin has been emptied

Status
Not open for further replies.

AngelAzrael

Estimable
Sep 23, 2015
4
0
4,510
I am currently testing the possibilities of files found in the recycle bin being recovered after it has been emptied and the files deleted using the shift + delete keys. As far as I know, emptying the recycle bin is similar, if not the same, with shift + delete. Knowing this, I was expecting that after emptying the recycle bin and deleting files using shift + delete keys, I would be able to recover the files. But after using some data recovery tools such as photorec, testdisk, and recuva, I was only able to recover the files deleted using the shift + delete keys and not found in the recycle bin. I even checked the $MFT file to see if there are still entries related to the files found in the recycle bin but did not find any. Why is this so? I am really puzzled right now since I thought that the files that were temporarily stored in the recycle bin could still be recovered as compared to those that were deleted using shift + delete keys. I am doing these tests in Windows XP Professional in VMWare
 
When you empty the Recycle Bin, Windows actually deletes the INFO2 file for the current logged on user as well as the file(s) or folder(s) it references. If for some reason you want to revert this you can try to recover the INFO2 file by conducting a search for its file header[4].

http://www.virusresearch.org/permanently-delete-files-recycle-bin/
 

AngelAzrael

Estimable
Sep 23, 2015
4
0
4,510


I see. If the user uses the shift + delete keys to delete files, does Windows also generate the INFO2 file? If not, how does all data recovery/carving tools find the deleted files when the user used the shift + delete keys to delete them? Is it the $MFT file or something else?

 
Actually, I think I was wrong. I think possibly beginning with Vista or Windows 7, Microsoft stopped using the info2 file and created individual files for each deleted item. I don't think there is any longer a difference between shift delete and clearing the item from the recycle bin.

Deleting a file from the Recycle Bin (or deleting it directly using Shift+Delete) removes the filename entry from its folder. The part of the disk previously occupied by the file is still not modified or overwritten and still contains all the file data, but that data is no longer linked to a filename. That spot of the disk is recorded as "free", however, so future writes to the disk can reuse that space, and if you keep using the disk the space will almost certainly be overwritten eventually.
 

AngelAzrael

Estimable
Sep 23, 2015
4
0
4,510

So in that case, when I do the same tests in windows 7, I should now be able to recover deleted files when using shift + delete keys and when clearing the recycle bin?
 

AngelAzrael

Estimable
Sep 23, 2015
4
0
4,510


I understand. Thank you very much for your help.
 
Status
Not open for further replies.