I would just like verification, or correction - but I believe I'm correct in saying this.
OS Vista
There are several users, several recycle bins. Two of those Bins are of interest to me.
The data in those two bins point to a particular user profile (from looking at the $files), of which that user profile no longer exists.
Those two recycle bins have individual numeric ID's of course, being 1006 and 1007.
My conclusion would be, a user profile has been created, used, deleted data, then deleted the user profile 1006. Next, a new user profile has been created, using a duplicate user profile name as 1006, used the profile, deleted data (creating 1007 bin). That user profile has again then been deleted.
Any other possibilities of why Bin 1006 and 1007 would point to data from the same user profile (that is now deleted)?
Regards,
Every user has a seperate Recycle Bin based on their SID in NTFS + WinXP onwards - and you are not able to view the contents of other user's bins through normal means. The only way to get two seperate Recyclers to point to the same profile is if you manually incremented your SID - although I'm not sure that's even possible.
Note that multiple Recycle Bins are only created in NTFS though - with FAT32 partitions you only get the one.
As a side note of interest if you send a file to your recycle bin (WITHOUT emptying it afterwards) and then delete your user account, the file remains "live" in the Recycler associated with the deleted account. Given that you can't examine the contents of other user's Recycle Bins, this means the files will essentially stay there forever (so long as you don't format the partition, of course).
Given that you can't examine the contents of other user's Recycle Bins, this means the files will essentially stay there forever (so long as you don't format the partition, of course).
To be picky roll
…if using Vista/Server 2008/7 AND NOT the /quick switch.
i.e. if you actually wipe the disk, *any* format in NT/2K/XP/2003 and a /q one under Vista/2008/7 will leave the data on the hard disk in a form that should be possible to recover.
jaclaz