Windows 32 bit, 64 bit, or source code

Download
Latest

Recycle Bin full icon

Rifiuti2 analyse recycle bin files from Windows. Analysis of Windows recycle bin is usually carried out during Windows computer forensics. Rifiuti2 can extract file deletion time, original path and size of deleted files. For more ancient versions of Windows, it can also check whether deleted items were not in recycle bin anymore (that is, either restored or permanently purged).

It is a rewrite of rifiuti, which is originally written by FoundStone folks for identical purpose. Then it was extended to cover more functionalities, such as:

  • Handles oldest (Win95) to newest (Win 10 and Server 2019) recycle bin format
    • Windows 95 – 2003 uses a single index file named INFO or INFO2
    • Vista or above uses one index file for each deleted item
  • 64-bit file size support
  • Supports all localized versions of Windows — both Unicode-based ones and legacy ones (using ANSI code page)
  • Supports output in XML format as well as original tab-delimited text
  • Obscure features such as recycle bin on network share (\\server\share_name)

Latest features and bug fixes are listed inside NEWS file; you’re also welcome to check out blog news for more insight (and some grumbles ☺).

Usage

Rifiuti2 is designed to be portable, and runs on command line environment. Two programs rifiuti and rifiuti-vista are chosen depending on relevant Windows recycle bin format.

Please consult manpage (Unix) or README.html (bundled with Windows binaries) for complete options and detailed usage description. There are some usage samples on Github page as well.

Screenshots

Tab delimited output sample

XML output with recycle bin on network share

Deleted items containing multilingual path names