Latest
Windows 32/64 bit binary and source code
Announce
Latest: Rifiuti2 0.8.1 released
Rifiuti2 analyse recycle bin files from Windows. Analysis of
Windows recycle bin is usually carried out during Windows computer
forensics. Rifiuti2 can extract file deletion time, original
path and size of deleted files. For more ancient versions of Windows,
it can also check whether deleted items were not in recycle bin anymore
(that is, either restored or permanently purged).
It is a rewrite of rifiuti, originally written by FoundStone folks
for identical purpose. Later rifiuti2 was extended to
cover more functionalities, such as:
- Handles oldest (Win95) to newest (Win 10 and Server 2019) recycle bin format
- Windows 95 – 2003 uses a single index file named
INFOorINFO2 - Vista or above uses one index file for each deleted item
- Windows 95 – 2003 uses a single index file named
- 64-bit file size support
- Supports all localized versions of Windows — both Unicode-based ones and legacy ones (using ANSI code page)
- Supports output in XML format as well as original tab-delimited text
- Obscure features such as recycle bin on network share
(
\\server\share)
Latest features and bug fixes are listed inside NEWS file; you’re also welcome to check out blog news for more insight during development and documentation stages.
Usage
Rifiuti2 is designed to be portable, and runs on command line environment.
Two programs rifiuti and rifiuti-vista are chosen depending on relevant
Windows recycle bin format.
Please consult manpage (Unix) or README.html (bundled with Windows binaries) for complete options and detailed usage description. There are some usage samples on Github page as well.
Screenshots
