Have a read-only external USB stick with a copy of an imaged recycle bin.
Â
The goal is to pass off USB stick to an attorney for review of recycle bin $R files.
Â
WIN10 forensic laptop (A) recycle bin is empty, no software running.
Â
When plugged into the forensic laptop, I can navigate via File Explorer to the recycle bin folders and files.
Â
I can open the $R files and SID of users for 2 user accounts.
Â
I properly eject USB stick and connect to another laptop (B) before passing it off to the attorney.
Â
Laptop (B) is my day-to-day use laptop.
Â
The recycle bin on laptop (B) is empty.
Â
Laptop (B) is a WIN10 machine.
Â
When I plug USB stick into the laptop (B) and navigate to recycle bin files, no SIDs, instead recycle bin icons.
Â
When I click on the recycle bin icons, no content.
Again access to the recycle bin contents for review purposes is the end goal
Any ideas on how to resolve this?
UPDATE:Â Appears that McAfee/or a setting on laptop was interfering as I could access the on a personal machine.