strange recycle bin phenomena

Possibility…

Since VISTA uses the /$Recycle.bin folder I am pretty certain that it is an "invisible" folder.
Therefore it may not be visible to the user when they look into the recycle bin from the desktop.

FOrensic software like FTK would be able to see it though

I will have to find me a VIsta computer and research and test this..

Vista uses a similar folder structure for the Recycle Bin as seen on XP/2003 systems, but instead of the INFO2 file, uses index ($Ixxxx) and resource ($Rxxxx) files.

However, the folder is still a "special" folder on Windows systems. As such, I would recommend that you take a moment to look at the folder in FTK Imager, and see if the files are marked with red Xs…

Just an idea, but maybe you could try seeing what Rifiuti2 "sees"
http//code.google.com/p/rifiuti2/

jaclaz

Windows Vista and later no longer uses the INFO2 file.
Instead it uses the /$Recycle.bin older

And not-so-casually I pointed you to Rifiuti 2 , i.e.the updated version compatible UNLIKE Rifiuti 1 with the new Vista Recycle Bin .
jaclaz

You could also consider parsing $UsnJrnl/$LogFile, to get some more insight into what happened on the filesystem over time. Analysis of $MFT only tells you some information at 1 point in time.

But then again, you did not say what filesystem this is, and I just assumed NTFS since I heard Vista..

Thanks joakims.. BTW, yes, it is NTFS

Microsoft have a KB article that might be this particular issue as it reads like the symptoms are those as described by your user (i.e. bin emptied, but no content shown in Windows"

"Files Are Not Deleted From Recycler Folder

When you empty the Recycle Bin in Windows, the files may not be deleted from your hard disk.

NOTE You cannot view these files using Windows Explorer, My Computer, or the Recycle Bin."

Full article http//support.microsoft.com/kb/229041

Alternatively as I mentioned before it could be old historic SID's that have been orphaned.

I've seen cases where there are numerous SID's hanging off the Recycle Bin but only one of two actual user accounts. It seems that users go their own unorthodox methods of removing accounts by simply deleting the user profile directory from their \Users\ (or where ever) path rather than using the Windows add\remove account procedure which then leaves behind lots of orphaned artifacts.

I've seen cases where there are numerous SID's hanging off the Recycle Bin but only one of two actual user accounts. It seems that users go their own unorthodox methods of removing accounts by simply deleting the user profile directory from their \Users\ (or where ever) path rather than using the Windows add\remove account procedure which then leaves behind lots of orphaned artifacts.

After a little more investigation I believe that this is whats happening.
THe /$recycle.bin reveals that a user /test/ had deleted these items. There is no user Test plainly visible in the users accounts. So, I believe someone created the user Test then downloaded the files and deleted the user Test.
Therefore, when you look at the recycle bin as the main user the bin appears empty.

I am looking now at the registry to see if I can find any evidence of the deleted user Test.

LArry

Hello,

You may find interesting information here (http//www.irongeek.com/i.php?page=security/windows-forensics-registry-and-file-system-spots#Event logs)

For example, if you wanted to determine which wired or wireless network the computer was connected to during the usage of the now deleted "Test" user account, you could export the Windows Event Logs (stored in C\Windows\System32\config or C\Windows\System32\winevt\Logs depending on OS) for analysis from the forensic image files using FTK Imager to a folder on an analysis hard drive.

I use Event Log Explorer (http//www.eventlogxp.com/) to ingest exported Event log files (*.EVT files), which then allows one to search by SID.

There are tens of different event logs on a given PC, and I do not recall the specific log name or log names, but there is definitely at least one event log that shows

1) the network name connected to
2) the Windows SID that was logged in during the time the network was connected to
3) date/time network was connected to

This information could reveal if the "Test" user was connected to a Starbucks wifi or the home wifi network when torrenting the contraband.

I only practice in civil litigation, so I am not sure if the above information would be helpful to your situation.

I did have a case that involved a person creating and subsequently deleting a user account in order to delete volume shadow copies.

I recall that TZWorks' tools allowed me to carve the MFT and reveal relevant information.

Also, OSForensics (Passmark.com) extracted the deleted account, number of logins, etc., so you might want to get a demo copy of OSForensics to see what it can reveal. OSForensics works great with FTK Imager - mounted forensic images. Just make sure to mount the forensic image files in FTK Imager as read and write, not read only.

*** Thank you for the work you perform protecting our community. It is greatly appreciated.

Larry

Thanks unallocatedclusters.

I actually went there this AM and grabbed all the WinEvnt logs and I will analyze them tonight.

Thanks for the IronGeek URL and the tool tips.

Very helpful,
Thanks, Larry

…

I am looking now at the registry to see if I can find any evidence of the deleted user Test.

LArry

By default the RID sequence does not change, and previous RIDs will not be reused.

In some of the replies, it was suggested that you might be seeing deleted Recycle.Bin records. Even tough, it is possible to see them, it is very unlikely that they will stick around since they are regular file entries in MFT. $I….. is a resident file with original logical file size, deletion date/time, and original file location/name. The $R….. is the original file MFT record with an added $40 ($VOLUME_VERSION) attribute.

So, when the file is removed from the Recycle.Bin, the MFT record is restored for the $R……. and the $I record made available again. If the file is deleted from the Recycle.Bin, then both records will be made available for overwrite. Thus, if you are fast enough, then you might see them, but it is very unlikely to have them if the system was used after the clearing of the recycle bin. That just reinforces the value of pulling the plug when collecting evidence.

I'm glad you found the deleted Test account, so you are on your way to find the answers. I still think, that Internet artifact and timeline analysis will help you find out who was "messing" with the system. If they are not technical at all, then they will search info on the Internet to find answers. Timeline of other non-related activity on the system will give a good idea who was using the system at the time when the account was created and removed for a more precise identification of an individual. If that works, you might see a search to find an answer to a homework question or a chat session with a girlfriend. You might even find artifacts in the "cloud" like DropBox that will also help identify and single out a person.

Good luck.