As a continuation of the "Introduction to Windows Forensics" series, this video introduces Recycle Bin Forensics. From Windows 95 to Windows 10, the history of the Recycle Bin is covered. We’ll discuss the INFO2 metadata files found on older operating systems, as well as the $I and $R files found on modern operating systems. We’ll take a look at exactly what happens when a file is placed in the Recycle Bin, and we’ll look at a tool that will help us extract metadata from $I files.
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
Introduction to Windows Forensics:
https://www.youtube.com/watch?v=VYROU-ZwZX8
Fun with Recycle Bin $I Files & Windows 10:
https://df-stream.com/2016/04/fun-with-recycle-bin-i-files-windows-10/
$I Parse:
https://df-stream.com/recycle-bin-i-parser/
Once Upon a Time in Recycle Bin:
http://4n6xplorer.com/forensics/once-upon-a-time-in-recycle-bin/
#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics
