±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36231
New Yesterday: 0 Visitors: 146

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Recycle Bin issue

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

subujoseph
Senior Member
 

Recycle Bin issue

Post Posted: Dec 13, 16 00:37

Dear All,

I have come across a stumbling block regarding Recycle Bin.

I have a computer with 2 disks, one OS disk (Disk 1) and two Data disks (Disk 2 and Disk 3). The OS has been reinstalled recently on the the OS disk. The contents of the 2 data disks were not changed when reinstalling the OS. New OS is Windows 10 Pro.

There was some deleted data (questionable data) in the Recycle Bin on Disk 2. This data was under a security ID say for eg: S-1-5-21-12345676....

Since the OS has been reinstalled, none of the new user accounts has the above security ID.

Now the question is, will the new OS's Recycle Bin show the contents of the Recycle Bin from Disk 2?


Merry Christmas to you all in advance.  
 
  

Bunnysniper
Senior Member
 

Re: Recycle Bin issue

Post Posted: Dec 13, 16 01:27

- subujoseph

Now the question is, will the new OS's Recycle Bin show the contents of the Recycle Bin from Disk 2?


Yes, if it was an "inplace upgrade".
No, if it was a clean install.
But in the second case u might have some luck with a classic forensic file recovery.

Wish u to have a nice X-Mas party, too

Robin  
 
  

joakims
Senior Member
 

Re: Recycle Bin issue

Post Posted: Dec 13, 16 03:00

What version was the previous OS?
_________________
Joakim Schicht

github.com/jschicht 
 
  

jhup
Senior Member
 

Re: Recycle Bin issue

Post Posted: Dec 15, 16 17:56

You write "2 disks", but list 3 disks.

The $Recycle.Bin is an OS artifact, and resides on each partition.
You should find the $RECYCLE.BIN (note the case difference) on the remaining non-OS volumes.
A regular update to Windows 10 normally does not touch them.

The new OS should not "show the contents of the Recycle Bin from Disk 2", presuming you are referring just Windows Explorer or similar.

This is because the Windows Explorer will only show, as you suspect, the matching SID recycle bin folder contents.

Theoretically one can export a user account from the local machine, and import it back after upgrade, retaining the SID. If that user logged back in, they would see the contents of the aforementioned recycle bin contents.  
 
  

Chris_Ed
Senior Member
 

Re: Recycle Bin issue

Post Posted: Dec 16, 16 16:08

That's actualy a good question - is a SID retained after an OS upgrade? I can't find conclusive proof via a quick Google.  
 

Page 1 of 1