Skip to content

Usage and Examples

Jump to bottom Edit New page
Abel Cheung edited this page Jan 4, 2024 · 8 revisions

Usage

The pre-Vista and post-Vista recycle bin formats are so different that 2 separate programs are used to read in each case:

Program Recycle bin from OS
rifiuti-vista Vista or Server 2008 — newest desktop or server
rifiuti Windows 95 — XP or Server 2003

For normal usage, most people would want to use rifiuti-vista (or rifiuti-vista.exe on Windows). Note that both utilities are console programs, so Windows users should run them under Command Prompt or PowerShell, though they can show GUI help dialog as a hint.

Both utilities return success upon completion, and non-zero exit status when difficulties are encountered.

Live system probation

With --live option (rifiuti-vista only), it can scan user's current Windows system, and dump output for all recycle bins available. It is supported under Windows Subsystem for Linux as well, performing probation on the Windows host instead. When using this option, recycle bin path is not shown, and Windows version is directly retrieved from registry.

Output format

By default, both programs dump tab-delimited field text (TSV), which can be viewed on screen or imported into spreadsheet program:

> rifiuti-vista dir-win10
Recycle bin path: 'dir-win10'
Version: 2
OS Guess: Windows 10 or above
Time zone: UTC [+0000]

Index   Deleted Time    Gone?   Size    Path
$IKEGS1G        2015-04-04 17:19:52 FALSE   0       C:\Users\user\123
$IQ7LAXT.png    2015-04-04 17:20:01 TRUE    6455    C:\Users\user\Pictures\web-canvas.png
$I7R52EG.txt    2015-04-04 17:24:09 TRUE    14      C:\Temp\dummy.txt
$IHO61YT        2015-04-07 23:32:07 TRUE    12884901888     C:\Temp\largefile
$IROMPZ0.exe    2015-04-19 10:49:59 FALSE   1761792 C:\Some\secret.exe

Preamble

Usually the heading contains following info:

  • The path argument supplied in command line
  • Version of recycle bin extracted from index file data
  • Educated guess of Windows version that generates recycle bin, based on recycle bin format and the version data above
  • For Windows 95 and NT4, there is extra info showing how many recycle bin records have ever existed in history

Index field

Index field has different meaning for pre-Vista and post-Vista versions:

  • INFO2 file uses a number to indicate chronological order of items
  • For Vista or above, this is the index file name inside recycle bin folder, which matches the original file extension but prepended by some random alphanumeric characters

Time field

Deleted time is in UTC time by default, and differ slightly under different output mode:

Mode Time format (3PM at 2014 X'mas)
Text (default) spreadsheet 2014-12-25 15:00:00
XML (-f xml) ISO 8601 2014-12-25T15:00:00Z

Gone field

If a trashed file has been permanently deleted, or has been restored onto filesystem, then it is considered "gone".

  • From Windows 98 onwards, this info is kept in INFO2 entries
  • Since Vista, only restored file retains the index entry. Permanently deleted trash file won't show up in output.

Other fields

File size and file path are self-explanatory.

XML output mode

rifiuti2 also supports output in XML format, dumping data equivalent to TSV output (except Windows version guess). It is always in UTF-8 encoding.

Corresponding DTD schema is available under test folder of source archive or git repository.

<?xml version="1.0" encoding="UTF-8"?>
<recyclebin format="file" version="0" ever_existed="16">
  <filename><![CDATA[INFO-95-ja-1]]></filename>
  <record index="1" time="2015-05-11T05:59:49Z" gone="false" size="32768">
    <path><![CDATA[D:\WINDOWS\ﾃﾞｽｸﾄｯﾌﾟ\The Microsoft Network のｾｯﾄｱｯﾌﾟ.lnk]]></path>
  </record>
  ......

JSON output mode

Since 0.8.1 it can also dump JSON format of equivalent data, with -f json option. Like XML output, JSON is always in UTF-8 encoding.

{
  "format": "file",
  "version": 0,
  "ever_existed": 16,
  "path": "test/samples/INFO-95-ja-1",
  "records": [
    {"index": 1, "time": "2015-05-11T05:59:49Z", "gone": false, "size": 32768, "path": "D:\\WINDOWS\\ﾃﾞｽｸﾄｯﾌﾟ\\The Microsoft Network のｾｯﾄｱｯﾌﾟ.lnk"},
    {"index": 2, "time": "2015-05-11T06:00:25Z", "gone": false, "size": 950272, "path": "D:\\WINDOWS\\ﾃﾞｽｸﾄｯﾌﾟ\\新規ﾋﾞｯﾄﾏｯﾌﾟ ｲﾒｰｼﾞ.bmp"},
    ......

Command options

  • -o FILE, --output=FILE

Write output to FILE.

  • -z, --localtime

Present deletion time as local system time. UTC time is shown if option is not provided, which is the time value recorded in index files. Using the X'mas example above, the time for Berlin (without daylight saving time) would be 2014-12-25T16:00:00+0100.

  • --live (Since 0.8.0, Only available in rifiuti-vista )

Perform a live probation on current Windows system. See corresponding feature description above for detail.

  • -l CODEPAGE, --legacy-filename=CODEPAGE (Only available in rifiuti )

Show legacy filename if available (like D:\Progra~1\), and specify the Code Page used in the Windows system producing this INFO2 file. Any encodings supported by iconv can be used, but for maximum accuracy of file name results, it is better to stick with Microsoft code pages. For example:

Code page Localisation
CP850 or CP1252 west Europe
CP932 Japan
CP1255 Hebrew

NOTE: This option is mandatory if INFO2 file is created by Windows 95, 98 or ME, since recycle bin records don't have any unicode file name. This option does not exist in rifiuti-vista, which only uses unicode.

Output Format Options

  • -t STRING, --delimiter=STRING

Fields are separated using TAB by default under text output, but can be customized with this option. Other than normal ASCII characters (comma is a pretty common choice), several escape sequences are also recognized:

Character Meaning
\r carriage return
\n line feed
\t tab
\e escape
  • -n, --no-heading

Only show entries; no metadata or field headers are printed.

  • -f xml, --format xml (Since 0.8.1)

Output in XML format instead of tab-delimited values. With XML mode, all plain text options (-n, -t) are disallowed, and result is always in UTF-8 encoding. DTD file is available under test folder for XML validation.

  • -f json, --format json (Since 0.8.1)

Ditto, but in JSON format. JSON schema file is available under test folder for data validation.

Miscellaneous options

  • -v, --version

Print version information

  • -h, --help

Show common help options

--help-all

Show all help options

Deprecated options

  • -x, --xml (Deprecated since 0.8.1)

Alias of -f xml (XML output format)

  • -8, --always-utf8 (Deprecated and become dummy since 0.7.0; removed since 0.8.1)

Force output content to use UTF-8 text encoding

Examples

rifiuti-vista.exe -f xml -z -o .\result.xml C:\case\S-1-2-3\

Scan for index files under C:\case\S-1-2-3\, adjust all deletion time for local time zone, and write XML output to result.xml

rifiuti-vista -n /case/S-1-2-3/

Show tab-delimited result on screen without header and metadata

rifiuti-vista -t '\n' /case/S-1-2-3/$IF96NJ3.rtf

Only analyse a single index file and print each field in its own line

rifiuti -t ',' -o result.csv INFO2

Write comma-delimited result to result.csv

rifiuti -l CP1255 -f json INFO2

Assuming INFO2 from Hebrew version of Windows, display entries using 8.3 file names, and output in JSON format

rifiuti-vista --live

Probe current Windows system and dump output for all recycle bins

Add a custom footer
Add a custom sidebar
Clone this wiki locally