-
Notifications
You must be signed in to change notification settings - Fork 34
Caveats
There are some extra limitations or obscure bugs that should be explicitly mentioned:
Microsoft has brought its console to first class experience since
Windows 10; but before that, it was notoriously difficult to
work with, as it primarily uses ANSI/OEM code pages. Trashed
file entries from one localized Windows may not be able to
display in another localized Windows for analysis.
rifiuti2 tries its best to deal with such problem:
- Use Windows Console API to display non-ASCII data
- Use escaped sequence (
<\XX>or<\uXXXX>) for uncomprehensible character - Missing fonts require user's action though
But it's not confident enough to say that things would work smoothly for systems before Windows 10. Dumping result into file and open with UTF-8 capable text editor is an option.
It is always better to use UTC time whenever possible, because
calculation of local time might not be correct, especially
for non-US users. Documentation of tzset() function
on Windows has this statement:
The C run-time library assumes the United States' rules for implementing the calculation of daylight saving time (DST).
Since the difference between standard time and DST is hardcoded to be one hour (which is incorrect for a few selected regions), the file deletion time might not be correct for these regions when DST is in effect.
INFO2 records may only store cluster size. In those cases it is
impossible to get the actual trashed file size. As a rule of thumb,
if all sizes of entries are multiples of 512,
it can be assumed cluster sizes are used.
In contrast, recycle bin format since Vista is believed to solely use exact file sizes.
NOTE: This is only observed once on certain brand of laptop running Vista, AND deletion of very specific binary. No other hardware / Vista version / deleted file combo was found to have the same problem.
After deleting certain very special file on Vista, the index file produced in recycle bin can be corrupt. All correctly created index file should have 544 bytes, but corrupt file is one byte short, with the corruption going to file size field. In this case, file size field will display question marks instead.