±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 3 Overall: 35980
New Yesterday: 5 Visitors: 369

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Recycle Bin identifier and Owner ID SID's

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts


Recycle Bin identifier and Owner ID SID's

Post Posted: Feb 02, 17 05:21

I'm looking for peer validation on this to ensure I'm correct in my thinking.

I have a case where incriminating evidence (7 videos and a folder) were found on an external HDD in one of 7 Recylcer/Recylce.Bin folders. The Recycle.Bin Folder and Path identify the SID related to the account, so I am confident that the Recycle.Bin I matched up to a specific User's SID deleted the incriminating files.

Where I am getting caught up is in a Different SID for the individual files that is different from any of the known computers in the case under the "Owner ID". My understanding is that the Owner ID is the SID for the user who created the file. However, the files would have had to have been on the computer with the SID in the Recycle.bin path in order to have been deleted from that user profile. Is that a correct conclusion?

If this isn't clear, let me know and I'll try to clarify more. Thanks in advance all. Appreciate the help.


Page 1 of 1