Win 9x INFO file format

I haven't checked it but is this any good?

http//freefr.dl.sourceforge.net/project/odessa/ODESSA/White%20Papers/Recycler_Bin_Record_Reconstruction.pdf

H

It's decent enough, I have read it before when researching Win XP style INFO2 records. But I am aiming for Win 9x style

It's decent enough, I have read it before when researching Win XP style INFO2 records. But I am aiming for Win 9x style

See if this info is enough
http//books.google.com/books?id=DQdWRitMcyAC&printsec=frontcover&hl=it#v=onepage&q&f=false
go to page 147.
http//books.google.com/books?id=xNjsDprqtUYC&printsec=frontcover&hl=it#v=onepage&q&f=false
go to pages 254/255

some (scarce) info can be gathered from this perl thingy here
http//www.t8o.org/~mca1001/cgi/viewcvs/*checkout*/bin/W9x_unrecycle.pl

There is some (equally scarce) info in the "magic" file for "file()"
https://gist.github.com/gists/983632/download

# Windows Recycle Bin record file (named INFO2)
# By Abel Cheung (abelcheung AT gmail dot com)
# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
# Since Vista uses another structure, INFO2 structure probably won't change
# anymore. Detailed analysis in
# http//www.cybersecurityinstitute.biz/downloads/INFO2.pdf
0 lelong 0x00000004
>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below)

0 lelong 0x00000005
>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP)

but still it is mostly related to the newer version, but we now know of the existence of a "version 4" and of a "version 5"

There is a paper by Geoff H.Fellows
The joys of complexity and the deleted file
that may provide some mopre info, but I couldn't find a non-pay version to check
http//www.sciencedirect.com/science/article/pii/S1742287605000289

But doesn't RIFIUTI parse that file?

jaclaz

Thanks jaclaz. I don't have a chance to look at these now, but I will when i get home. Thanks.

Rifiuti does parse them, as far as I've heard, but I haven't had a chance to use that to reverse engineer the INFO2 records yet. Time is ever short for me nowdays. Plus, I didn't want to waste time reinventing the wheel.

Yea, those links didn't help much. Sorry.

Rifiuti does parse Win98 and later Info2 records (Not Win 95 INFO records), but not always correctly. In my test, had the date or time wrong on 3 of the 5 records.

I don't see any filetime timestamps, not surprisingly, but I can't even find any dos timestamps either.

So far, I'll I've picked out were the path and deleted name. Go for the low hanging fruit first, I always say!