Windows Recycle Bin Analysis Tool


Windows 32/64 bit binary and source code

News &

Latest: Guessing Windows version from artifacts

Recycle Bin full icon

Rifiuti2 analyse recycle bin files from Windows. Analysis of Windows recycle bin is usually carried out during Windows computer forensics. Rifiuti2 can extract file deletion time, original path and size of deleted files. For more ancient versions of Windows, it can also check whether deleted items were not in recycle bin anymore (that is, either restored or permanently purged).

It is a rewrite of rifiuti, originally written by FoundStone folks for identical purpose. Later rifiuti2 was extended to cover more functionalities, such as:

  • Handles oldest (Win95) to newest (Win 10 and Server 2019) recycle bin format
    • Windows 95 – 2003 uses a single index file named INFO or INFO2
    • Vista or above uses one index file for each deleted item
  • 64-bit file size support
  • Supports all localized versions of Windows — both Unicode-based ones and legacy ones (using ANSI code page)
  • Supports output in XML format as well as original tab-delimited text
  • Obscure features such as recycle bin on network share (\\server\share)

Latest features and bug fixes are listed inside NEWS file; you’re also welcome to check out blog news for more insight during development and documentation stages.


Rifiuti2 is designed to be portable, and runs on command line environment. Two programs rifiuti and rifiuti-vista are chosen depending on relevant Windows recycle bin format.

Please consult manpage (Unix) or README.html (bundled with Windows binaries) for complete options and detailed usage description. There are some usage samples on Github page as well.