Recent

Author Topic: Real file names in windows recycle.bin  (Read 872 times)

jcmontherock

  • Jr. Member
  • **
  • Posts: 63
Real file names in windows recycle.bin
« on: March 02, 2021, 02:49:18 pm »
How do we get the real file path in recycle.bin directory ?
« Last Edit: March 02, 2021, 04:00:46 pm by jcmontherock »

Zvoni

  • Hero Member
  • *****
  • Posts: 534
Re: Real file names in windows recycle.bin
« Reply #1 on: March 02, 2021, 04:30:37 pm »
Read the Registry
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\FileAssociations
the Key UserSid
It should return something like "S-1-5-21-123456789-987654321-1708537768-3320" --> That's the currently logged in UserSid (THIS IS AN EXAMPLE, JUST A BOGUS VALUE!)

Open Explorer, and enter in the Addressbar:
"c:\$recycle.bin\S-1-5-21-123456789-987654321-1708537768-332"

And voila: The usual Filenames to read

I hope you know how to build a path from "Directories"

EDIT: btw: What are you trying to do?
« Last Edit: March 02, 2021, 04:32:16 pm by Zvoni »
One System to rule them all, One IDE to find them,
One Code to bring them all, and to the Framework bind them,
in the Land of Redmond, where the Windows lie
---------------------------------------------------------------------
People call me crazy, because i'm jumping out of perfectly fine aircraft

jcmontherock

  • Jr. Member
  • **
  • Posts: 63
Re: Real file names in windows recycle.bin
« Reply #2 on: March 02, 2021, 05:37:42 pm »
Thanks, but no I do not know to find the path where the file was at deletion time. For ex I got with cmd.exe:

D:\$RECYCLE.BIN\S-1-5-21-712798450-2329344178-3284495858-1001>dir *.exe
11.07.2019  22:15               130 $I1QF612.exe

Remy Lebeau

  • Hero Member
  • *****
  • Posts: 903
    • Lebeau Software
Re: Real file names in windows recycle.bin
« Reply #3 on: March 02, 2021, 06:04:47 pm »
Read the Registry
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\FileAssociations
the Key UserSid
It should return something like "S-1-5-21-123456789-987654321-1708537768-3320" --> That's the currently logged in UserSid (THIS IS AN EXAMPLE, JUST A BOGUS VALUE!)

On my system, there is no FileAssociations key underneath the CurrentVersion key, so that solution will not work.

In any case, there are better ways to get the SID, I would not go to the Registry for that.  For instance, you could use GetUserName() and LookupAccountName() instead.

But there is an even easier way to get the path to the user's Recycle Bin: use either SHGetFolderPath(CSIDL_BITBUCKET) or SHGetKnownFolderPath(FOLDERID_RecycleBinFolder) instead.

Open Explorer, and enter in the Addressbar:
"c:\$recycle.bin\S-1-5-21-123456789-987654321-1708537768-332"

And voila: The usual Filenames to read

The Recycle Bin is a virtual folder.  Its content is stored in a database within the Bin, and Windows Explorer uses a Shell Extension to display the contents of that database.  The actual information is not on the file system.  You have to use Shell APIs to access the Recycle Bin and extract information from it.
« Last Edit: March 02, 2021, 06:08:27 pm by Remy Lebeau »
Remy Lebeau
Lebeau Software - Owner, Developer
Internet Direct (Indy) - Admin, Developer (Support forum)

ASerge

  • Hero Member
  • *****
  • Posts: 1772
Re: Real file names in windows recycle.bin
« Reply #4 on: March 02, 2021, 07:21:04 pm »
Thanks, but no I do not know to find the path where the file was at deletion time.
Use shell api:
Code: Pascal  [Select][+][-]
  1. uses ShlWApi, Windows, ShlObj, ActiveX;
  2.  
  3. procedure TForm1.Button1Click(Sender: TObject);
  4. var
  5.   Desktop: IShellFolder;
  6.   RecycleBin: IShellFolder;
  7.   Enum: IEnumIDList;
  8.   FolderIdList: PItemIDList;
  9.   ItemIdList: PItemIDList;
  10.   FileRet: TSTRRET;
  11.   FileName: PWideChar;
  12. begin
  13.   Memo1.Clear;
  14.   if not SHGetDesktopFolder(Desktop) = S_OK then
  15.     Exit;
  16.   if SHGetSpecialFolderLocation(0, CSIDL_BITBUCKET, FolderIdList) = S_OK then
  17.   try
  18.     if Desktop.BindToObject(FolderIdList, nil, IID_IShellFolder, RecycleBin) <> S_OK then
  19.       Exit;
  20.     if RecycleBin.EnumObjects(0, SHCONTF_NONFOLDERS, Enum) <> S_OK then
  21.       Exit;
  22.     while Enum.Next(1, ItemIdList, ULONG(nil^)) = S_OK do
  23.     begin
  24.       if RecycleBin.GetDisplayNameOf(ItemIdList, SHGDN_FOREDITING, FileRet) = S_OK then
  25.       begin
  26.         if StrRetToStrW(@FileRet, nil, @FileName) = S_OK then
  27.         try
  28.           Memo1.Append(UTF8Encode(UnicodeString(FileName)));
  29.         finally
  30.           CoTaskMemFree(FileName);
  31.         end;
  32.       end;
  33.       CoTaskMemFree(ItemIdList);
  34.     end;
  35.   finally
  36.     CoTaskMemFree(FolderIdList);
  37.   end;
  38. end;

jcmontherock

  • Jr. Member
  • **
  • Posts: 63
Re: Real file names in windows recycle.bin
« Reply #5 on: March 03, 2021, 10:05:14 am »
Thanks a lot, both of you. @ASerge you give me what I was looking for and it works...  :O)
Unfortunately I do not understand the procedure. Do you know where I could find some documentation about the subject ?

jcmontherock

  • Jr. Member
  • **
  • Posts: 63
Re: Real file names in windows recycle.bin
« Reply #6 on: March 03, 2021, 10:54:02 am »
One more question: do you know how to retrieve the deletion date ?

ASerge

  • Hero Member
  • *****
  • Posts: 1772
Re: Real file names in windows recycle.bin
« Reply #7 on: March 03, 2021, 05:14:43 pm »
Unfortunately I do not understand the procedure. Do you know where I could find some documentation about the subject ?
Google ... Put any function in the search and you will be taken to https://docs.microsoft.com

ASerge

  • Hero Member
  • *****
  • Posts: 1772
Re: Real file names in windows recycle.bin
« Reply #8 on: March 03, 2021, 05:38:37 pm »
One more question: do you know how to retrieve the deletion date ?
Yes. Slightly modified example (marked with //):
Code: Pascal  [Select][+][-]
  1. uses ShlWApi, Windows, ShlObj, ActiveX;
  2.  
  3. procedure TForm1.Button1Click(Sender: TObject);
  4. const
  5.   GUID_DISPLACED: TGUID = '{9B174B33-40FF-11D2-A27E-00C04FC30871}'; //
  6.   DISPLACED_DATE = 3; //
  7. var
  8.   Desktop: IShellFolder;
  9.   RecycleBin: IShellFolder;
  10.   RecycleBinEx: IShellFolder2; //
  11.   Enum: IEnumIDList;
  12.   FolderIdList: PItemIDList;
  13.   ItemIdList: PItemIDList;
  14.   FileRet: TSTRRET;
  15.   FileName: PWideChar;
  16.   RemovalTimeColumn: SHColumnID;
  17.   VDate: OleVariant; //
  18. begin
  19.   Memo1.Clear;
  20.   RemovalTimeColumn.fmtid := GUID_DISPLACED; //
  21.   RemovalTimeColumn.pid := DISPLACED_DATE; //
  22.   if not SHGetDesktopFolder(Desktop) = S_OK then
  23.     Exit;
  24.   if SHGetSpecialFolderLocation(0, CSIDL_BITBUCKET, FolderIdList) = S_OK then
  25.   try
  26.     if Desktop.BindToObject(FolderIdList, nil, IID_IShellFolder, RecycleBin) <> S_OK then
  27.       Exit;
  28.     if RecycleBin.EnumObjects(0, SHCONTF_NONFOLDERS, Enum) <> S_OK then
  29.       Exit;
  30.     RecycleBinEx := RecycleBin as IShellFolder2; //
  31.     while Enum.Next(1, ItemIdList, ULONG(nil^)) = S_OK do
  32.     try
  33.       if RecycleBin.GetDisplayNameOf(ItemIdList, SHGDN_FOREDITING, FileRet) = S_OK then
  34.       begin
  35.         if StrRetToStrW(@FileRet, nil, @FileName) = S_OK then
  36.         try
  37.           Memo1.Append(UTF8Encode(UnicodeString(FileName)));
  38.         finally
  39.           CoTaskMemFree(FileName);
  40.         end;
  41.       end;
  42.       if RecycleBinEx.GetDetailsEx(ItemIdList, @RemovalTimeColumn, @VDate) = S_OK then //
  43.         Memo1.Append(Format('Removal time: %s', [VDate])); //
  44.     finally
  45.       CoTaskMemFree(ItemIdList);
  46.     end;
  47.   finally
  48.     CoTaskMemFree(FolderIdList);
  49.   end;
  50. end;

jcmontherock

  • Jr. Member
  • **
  • Posts: 63
Re: Real file names in windows recycle.bin
« Reply #9 on: March 04, 2021, 11:11:27 am »
Wonderful: thanks a lot... :O)

 

TinyPortal © 2005-2018