| /trunk/FORMAT.md |
|---|
| 36,16 → 36,20 |
| // Win NT4: 02 00 00 00 (Win96/Cairo?) |
| // Win95 (with IE4), 98: 04 00 00 00 |
| // Win Me, 2000, XP: 05 00 00 00 (NT4+IE4, NT5?) |
| totalEntries: DWORD; // Only Win95 (without IE4) and Win NT4, other OS versions might use the registry instead |
| nextPossibleID: DWORD; // Only Win95 (without IE4) and Win NT4, other OS versions might use the registry instead |
| totalEntries: DWORD; // Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons |
| nextPossibleID: DWORD; // Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons |
| recordLength: DWORD; // 0x181 = ANSI records |
| // 0x320 = Unicode records |
| totalSize: DWORD; // sum of all "originalSize" values; |
| // Only Win95 (without IE4) and Win NT4, other OS versions might use the registry instead |
| // Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons |
| end; |
| ### ANSI record (Win95, Win98, WinMe) |
| When a file is deleted, the first byte of `sourceAnsi` will be filled with a zero byte, |
| making the zero-terminated string empty. This way, the record is marked as deleted |
| and the INFO/INFO2 file does not need to be reorganized. |
| type |
| // Windows 95: INFO file with TRbInfoRecordA; Folder deletion NOT possible |
| // Windows 95 +IE4: INFO2 file with TRbInfoRecordA; Folder deletion possible |
| 53,7 → 57,7 |
| TRbInfoRecordA = packed record |
| sourceAnsi: array[0..MAX_PATH-1] of AnsiChar; // 260 characters (including NUL terminator) |
| recordNumber: DWORD; |
| sourceDrive: DWORD; // 0=A, 1=B, 2=C, ... |
| sourceDrive: DWORD; // 0=A, 1=B, 2=C, ..., Z=25, @=26 (@ is the "Network home drive" of the Win95 time) |
| deletionTime: FILETIME; |
| originalSize: DWORD; // Size occupied on disk. Not the actual file size. |
| // INFO2, for folders: The whole folder size with contents |
| 61,6 → 65,10 |
| ### Unicode record (WinNT4, Win2000, WinXP) |
| When a file is deleted, the first byte of `sourceAnsi` will be filled with a zero byte, |
| making the zero-terminated string empty. This way, the record is marked as deleted |
| and the INFO/INFO2 file does not need to be reorganized. |
| type |
| // Windows NT4: INFO file with TRbInfoRecordW; Folder deletion possible |
| // Windows 2000+: INFO2 file with TRbInfoRecordW; Folder deletion possible |
| 68,7 → 76,7 |
| TRbInfoRecordW = packed record |
| sourceAnsi: array[0..MAX_PATH-1] of AnsiChar; // 260 characters (including NUL terminator) |
| recordNumber: DWORD; |
| sourceDrive: DWORD; // 0=A, 1=B, 2=C, ... |
| sourceDrive: DWORD; // 0=A, 1=B, 2=C, ..., Z=25, @=26 (@ is the "Network home drive" of the Win95 time) |
| deletionTime: FILETIME; |
| originalSize: DWORD; |
| sourceUnicode: array[0..MAX_PATH-1] of WideChar; // 260 characters (including NUL terminator) |
| 101,5 → 109,5 |
| deletionTime: FILETIME; |
| (* sourceUnicode: BSTR; *) |
| sourceCountChars: DWORD; // including NUL |
| //sourceUnicode: array[0..sourceCountChars+1] of WideChar; |
| //sourceUnicode: array[0..sourceCountChars-1] of WideChar; |
| end; |
| /trunk/Recycle Bin Unit v2/Changelog.txt |
|---|
| 1,6 → 1,9 |
| === Changelog RecBinUnit v2 === |
| 2022-07-03 |
| + Added support for "Network home drives" recycle bin (from Win95 days) |
| 2022-07-02 |
| + Improved recognition of Vista+ index files which are not named with file name $I... |
| + Fixed issues in FORMAT.md |
| /trunk/Recycle Bin Unit v2/RecBinUnit2.pas |
|---|
| 5,7 → 5,7 |
| // E-MAIL: info@daniel-marschall.de // |
| // Web: www.daniel-marschall.de & www.viathinksoft.de // |
| //////////////////////////////////////////////////////////////////////////////////// |
| // Revision: 02 JUL 2022 // |
| // Revision: 03 JUL 2022 // |
| // This unit is freeware, but please link to my website if you are using it! // |
| //////////////////////////////////////////////////////////////////////////////////// |
| // Successfully tested with: // |
| 55,7 → 55,7 |
| Windows, SysUtils, Classes, ContNrs, ShellAPI, Registry, Messages, Math; |
| const |
| RECBINUNIT_VERSION = '2022-07-02'; |
| RECBINUNIT_VERSION = '2022-07-03'; |
| RECYCLER_CLSID: TGUID = '{645FF040-5081-101B-9F08-00AA002F954E}'; |
| NULL_GUID: TGUID = '{00000000-0000-0000-0000-000000000000}'; |
| 837,7 → 837,8 |
| vistaId := ''; // manual file that was not named $I..., so we cannot get $R... ID and therefore no physical file! |
| try |
| testVistaItem := TRbVistaItem.Create(fs, AFile, vistaId); |
| if Copy(testVistaItem.Source,2,2) <> ':\' then |
| if (Copy(testVistaItem.Source,2,2) <> ':\') and |
| (Copy(testVistaItem.Source,2,2) <> '\\') then |
| FreeAndNil(testVistaItem); |
| except |
| testVistaItem := nil; |
| 868,10 → 869,11 |
| // Try to read the Unicode record and check if it is valid |
| // In case it is no Unicode record, then the Unicode part will be the |
| // ANSI source name of the next record. In this case, we won't get |
| // a ':' at the Unicode string. |
| // a ':\' or '\\' at the Unicode string. |
| bakPosition := fs.Position; |
| wTest := TRbInfoWItem.Create(fs, AFile); |
| if Copy(wTest.SourceUnicode, 2, 2) = ':\' then |
| if (Copy(wTest.SourceUnicode, 2, 2) = ':\') or |
| (Copy(wTest.SourceUnicode, 2, 2) = '\\') then |
| begin |
| // Yes, it is a valid Unicode record. |
| list.Add(wTest); |
| 1403,6 → 1405,9 |
| begin |
| stream.ReadBuffer(r, SizeOf(r)); |
| if r.sourceDrive = 26 then |
| FSourceDrive := '@' // @ is the "Network home drive" of the Win95 time |
| else |
| FSourceDrive := Chr(Ord('A') + r.sourceDrive); |
| // Win95 with IE4 and Win2000+: |
| 1491,7 → 1496,12 |
| FSourceAnsi := r.sourceAnsi; |
| FSourceUnicode := r.sourceUnicode; |
| FID := IntToStr(r.recordNumber); |
| if r.sourceDrive = 26 then |
| FSourceDrive := '@' // @ is the "Network home drive" of the Win95 time |
| else |
| FSourceDrive := Chr(Ord('A') + r.sourceDrive); |
| FDeletionTime := FileTimeToDateTime(r.deletionTime); |
| FOriginalSize := r.originalSize; |
| /trunk/Recycle Bin Unit v2/RecBinUnitLowLvl.pas |
|---|
| 1,7 → 1,5 |
| unit RecBinUnitLowLvl; |
| // TODO: Gain more information about drive '@' / Homedrive / Netdrive? |
| interface |
| uses |
| 15,12 → 13,12 |
| // Win NT4: 02 00 00 00 (Win96/Cairo?) |
| // Win95 (with IE4), 98: 04 00 00 00 |
| // Win Me, 2000, XP: 05 00 00 00 (NT4+IE4, NT5?) |
| totalEntries: DWORD; // Only Win95 (without IE4) and Win NT4, other OS versions might use the registry instead |
| nextPossibleID: DWORD; // Only Win95 (without IE4) and Win NT4, other OS versions might use the registry instead |
| totalEntries: DWORD; // Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons |
| nextPossibleID: DWORD; // Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons |
| recordLength: DWORD; // 0x181 = ANSI records |
| // 0x320 = Unicode records |
| totalSize: DWORD; // sum of all "originalSize" values; |
| // Only Win95 (without IE4) and Win NT4, other OS versions might use the registry instead |
| // Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons |
| end; |
| type |
| 30,7 → 28,7 |
| TRbInfoRecordA = packed record |
| sourceAnsi: array[0..MAX_PATH-1] of AnsiChar; // 260 characters (including NUL terminator) |
| recordNumber: DWORD; |
| sourceDrive: DWORD; // 0=A, 1=B, 2=C, ... |
| sourceDrive: DWORD; // 0=A, 1=B, 2=C, ..., Z=25, @=26 (@ is the "Network home drive" of the Win95 time) |
| deletionTime: FILETIME; |
| originalSize: DWORD; // Size occupied on disk. Not the actual file size. |
| // INFO2, for folders: The whole folder size with contents |
| 43,7 → 41,7 |
| TRbInfoRecordW = packed record |
| sourceAnsi: array[0..MAX_PATH-1] of AnsiChar; // 260 characters (including NUL terminator) |
| recordNumber: DWORD; |
| sourceDrive: DWORD; // 0=A, 1=B, 2=C, ... |
| sourceDrive: DWORD; // 0=A, 1=B, 2=C, ..., Z=25, @=26 (@ is the "Network home drive" of the Win95 times) |
| deletionTime: FILETIME; |
| originalSize: DWORD; |
| sourceUnicode: array[0..MAX_PATH-1] of WideChar; // 260 characters (including NUL terminator) |
| 68,15 → 66,16 |
| deletionTime: FILETIME; |
| (* sourceUnicode: BSTR; *) |
| sourceCountChars: DWORD; // including NUL |
| //sourceUnicode: array[0..sourceCountChars+1] of WideChar; |
| //sourceUnicode: array[0..sourceCountChars-1] of WideChar; |
| end; |
| type |
| // Windows 95 + Windows NT 4 |
| // Windows 95 (tested with 4.00.950 and Win95b) + Windows NT 4 |
| // HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\BitBucket: PurgeInfo (Binary) |
| // TODO: also explain this in FORMAT.md ? |
| PRbWin95PurgeInfo = ^TRbWin95PurgeInfo; |
| TRbWin95PurgeInfo = packed record |
| cbSize: DWORD; |
| cbSize: DWORD; // 0x48 = 72 |
| bGlobalSettings: BOOL; |
| percentDrive: array['A'..'Z'] of WORD; // 0x00..0x64 = 0%..100% |
| percentHomedrive: WORD; |
| 86,11 → 85,11 |
| // Bit 1: Drive B |
| // ... |
| // Bit 25: Drive Z |
| // Bit 26: Homedrive |
| // Bit 26: "Network home drive" |
| // Bit 27: Global |
| // Bit 28..31 (MSB) probably unused |
| unknown1: DWORD; // For example 04 0D 02 00 |
| end; // or C4 0C 02 00 |
| // Bit 28..31 (MSB) unused |
| dummy: DWORD; // "dummy to force a new size" ?! (TODO: was there a Windows version that had a smaller size (0x44), i.e. a different version of this record?) |
| end; |
| implementation |
| /trunk/Research/PurgeInfo Analysis.txt |
|---|
| 35,7 → 35,7 |
| 0x01 = Global settings for all drives |
| Pa..Pz Percentage of the drive A..Z |
| PH Percentage of "homedrive" (drive '@', I am not sure what that means) |
| PH Percentage of "homedrive" (drive '@', "Network home drive" of the Win95 times) |
| PG Percentage of all drives (Global setting) |
| 0x00 = 0% |
| 0x64 = 100% |