I can copy data to C\$Recycle.Bin by hand (say, from a command shell) - and it won't appear in the Recycle Bin via Windows Explorer because it's in the top level of the folder, with no desktop.ini (Windows Explorer displays the content in the SID folder for the currently logged in user)
But of course the data shows up when viewed with FTK.
Some Malware will hide data in the Recycle Bin this way.
Was this data in the top level folder of the Recycle bin?
Yes, it was.
Here is the path + the SID. One thing that I noticed right away is that the RID is not the same RID as the user account (1001)
THere were hundreds of files in the C\$Recycle.bin and there were many RIDs used from 1002, 1007 to 1161 but only one user account.
\C\$Recycle.Bin\S-1-5-21-2228628257-2297675940-1808716662-1002
I also discovered that there is a hidden user that was created named Test.
The user Test was created as a Domain user rather than a Local User and had a Primary Group Number of 0 as opposed to 513 like the regular user accounts.
C\$Recycle.Bin\S-1-5-21-2228628257-2297675940-1808716662-
1007\test\Downloads
On the second path there is the "test" showing up but I am not at the forensic computer right now to see if the \test\ is a user name, or a folder. Any ideas on that?.
Larry