Subversion Repositories recyclebinunit

Rev

Rev 103 | Rev 105 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed

Rev 103 Rev 104
Line 1... Line 1...
1 
 
 1 
 
2 
# Windows Recycle Bin internal format
 2 
# Windows Recycle Bin internal format
3 
 
 3 
 
4 
## Locations
 4 
## Locations of the index files
5 
 
 5 
 
6 
### FAT drives:
 6 
### FAT drives:
7 
 
 7 
 
8 
- Windows 95 native:	`C:\RECYCLED\INFO` (with ANSI records, folder deletion is NOT possible, format `00 00 00 00`)
 8 
- Windows 95 native:	`C:\RECYCLED\INFO` (with ANSI records, folder deletion is NOT possible, format `00 00 00 00`)
9 
- Windows 95+IE4, 98SE:	`C:\RECYCLED\INFO2` (with ANSI records, folder deletion is possible, format `04 00 00 00`)
 9 
- Windows 95+IE4, 98SE:	`C:\RECYCLED\INFO2` (with ANSI records, folder deletion is possible, format `04 00 00 00`)
10 
- Windows Me:		`C:\RECYCLED\INFO2` (with ANSI records, folder deletion is possible, format `05 00 00 00`)
 10 
- Windows Me:		`C:\RECYCLED\INFO2` (with ANSI records, folder deletion is possible, format `05 00 00 00`)
11 
- Windows Vista+:	`C:\$RECYCLE.BIN\$I...`
 11 
- Windows Vista+:	`C:\$RECYCLE.BIN\$I...`
12 
- Windows 95 (Beta 58s)	`<WinDir>\DESKTOP\RECYCLE.BIN` (a normal folder with the deleted files. No index, no renamed files). In beta build 122, the recycle bin was removed and re-added in beta build 180 with the INFO-format we know from the RTM release.
 12 
- Windows 95 (Beta 58s)	`C:\CHICAGO\DESKTOP\RECYCLE.BIN` (a normal folder with the deleted files. There are no index files and deleted files won't get renamed). In beta build 122, the recycle bin was removed and re-added in beta build 180 with the INFO-format we know from the RTM release.
13 
 
 13 
 
14 
### NTFS drives:
 14 
### NTFS drives:
15 
 
 15 
 
16 
- Windows NT4:		`C:\RECYCLER\<UserSID>\INFO` (with Unicode records, folder deletion is possible, format `02 00 00 00`)
 16 
- Windows NT4:		`C:\RECYCLER\<UserSID>\INFO` (with Unicode records, folder deletion is possible, format `02 00 00 00`)
17 
- Windows 2000, XP:	`C:\RECYCLER\<UserSID>\INFO2` (with Unicode records, folder deletion is possible, format `05 00 00 00`)
 17 
- Windows 2000, XP:	`C:\RECYCLER\<UserSID>\INFO2` (with Unicode records, folder deletion is possible, format `05 00 00 00`)
Line 37... Line 37...
37 
| 000C         | 4          | DWORD | Item record length<br>0x118 = ANSI records<br>0x320 = Unicode records |
37 
| 000C         | 4          | DWORD | Item record length<br>0x118 = ANSI records<br>0x320 = Unicode records |
38 
| 0010         | 4          | DWORD | Total size (sum of all original sizes of the files). Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons. |
38 
| 0010         | 4          | DWORD | Total size (sum of all original sizes of the files). Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons. |
39 
 
 39 
 
40 
### ANSI record (Win95, Win98, WinMe)
 40 
### ANSI record (Win95, Win98, WinMe)
41 
 
 41 
 
42 
When a file is deleted, the first byte of the original filename will be set to a zero byte,
 - 
 
43 
making the zero-terminated string empty. This way, the record is marked as deleted
 - 
 
44 
and the INFO/INFO2 file does not need to be reorganized.
 - 
 
45 
 
 - 
 
46 
Windows 95:      INFO file with ANSI record; Folder deletion NOT possible
 42 
Windows 95:      INFO file with ANSI record; Folder deletion NOT possible
- 
 
 43 
 
47 
Windows 95 +IE4: INFO2 file with ANSI record; Folder deletion possible
 44 
Windows 95 +IE4: INFO2 file with ANSI record; Folder deletion possible
48 
 
 45 
 
49 
| offset (hex) | size (dec) |  type           | description |
 46 
| offset (hex) | size (dec) |  type           | description |
50 
|--------------|------------|-----------------|-------------|
 47 
|--------------|------------|-----------------|-------------|
51 
| 0000         | 260        | char[MAX_PATH]  | Original file name and path in ANSI characters. 260 characters (including NUL terminator). Empty string if file was deleted. |
48 
| 0000         | 260        | char[MAX_PATH]  | Original file name and path in ANSI characters. 260 characters (including NUL terminator). Empty string if file was deleted. |
52 
| 0104         | 4          | DWORD           | Record number |
49 
| 0104         | 4          | DWORD           | Record number |
53 
| 0108         | 4          | DWORD           | Source drive number<br>0=A, 1=B, 2=C, ..., 25=Z<br>26=@ (this is the "Network home drive" of the Win95 days) |
50 
| 0108         | 4          | DWORD           | Source drive number<br>0=A, 1=B, 2=C, ..., 25=Z<br>26=@ (this is the "Network home drive" of the Win95 days) |
54 
| 010C         | 8          | FILETIME        | Deletion time |
51 
| 010C         | 8          | FILETIME        | Deletion time |
55 
| 0114         | 4          | DWORD           | Size occupied on disk. Not the actual file size.<br>INFO2, for folders: The whole folder size with contents |
52 
| 0114         | 4          | DWORD           | Original file size, rounded to the next cluster (see note below).<br>INFO2, for folders: The whole folder size with contents |
56 
 
 53 
 
57 
### Unicode record (WinNT4, Win2000, WinXP)
 54 
### Unicode record (WinNT4, Win2000, WinXP)
58 
 
 55 
 
59 
When a file is deleted, the first byte of the original filename will be set to a zero byte,
 - 
 
60 
making the zero-terminated string empty. This way, the record is marked as deleted
 - 
 
61 
and the INFO/INFO2 file does not need to be reorganized.
 - 
 
62 
 
 - 
 
63 
Windows NT4:   INFO file with Unicode record; Folder deletion possible
 56 
Windows NT4:   INFO file with Unicode record; Folder deletion possible
- 
 
 57 
 
64 
Windows 2000+: INFO2 file with Unicode record; Folder deletion possible
 58 
Windows 2000+: INFO2 file with Unicode record; Folder deletion possible
65 
 
 59 
 
66 
| offset (hex) | size (dec) |  type           | description |
 60 
| offset (hex) | size (dec) |  type           | description |
67 
|--------------|------------|-----------------|-------------|
 61 
|--------------|------------|-----------------|-------------|
68 
| 0000         | 260        | char[MAX_PATH]  | Original file name and path in ANSI characters. 260 characters (including NUL terminator). Empty string if file was deleted. |
62 
| 0000         | 260        | char[MAX_PATH]  | Original file name and path in ANSI characters. 260 characters (including NUL terminator). Empty string if file was deleted. |
69 
| 0104         | 4          | DWORD           | Record number |
63 
| 0104         | 4          | DWORD           | Record number |
70 
| 0108         | 4          | DWORD           | Source drive number<br>0=A, 1=B, 2=C, ..., 25=Z<br>26=@ (this is the "Network home drive" of the Win95 days) |
64 
| 0108         | 4          | DWORD           | Source drive number<br>0=A, 1=B, 2=C, ..., 25=Z<br>26=@ (this is the "Network home drive" of the Win95 days) |
71 
| 010C         | 8          | FILETIME        | Deletion time |
65 
| 010C         | 8          | FILETIME        | Deletion time |
72 
| 0114         | 4          | DWORD           | Original size |
 66 
| 0114         | 4          | DWORD           | Original file size, rounded to the next cluster (see note below) |
73 
| 0118         | 520        | wchar[MAX_PATH] | Original file name and path in Unicode characters. 260 characters (including NUL terminator) |
67 
| 0118         | 520        | wchar[MAX_PATH] | Original file name and path in Unicode characters. 260 characters (including NUL terminator) |
74 
 
 68 
 
- 
 
 69 
### Sizes
- 
 
 70 
 
- 
 
 71 
The original size is inteded to be rounded to the next cluster, so this should be the size on the disk, not the size of the actual file.
- 
 
 72 
 
- 
 
 73 
However, my test system (Win98, INFO2 record) showed a weird behavior:
- 
 
 74 
Explorer shows "size used" as 4 KiB (e.g. 4096 bytes used, which is my file system cluster size),
- 
 
 75 
but when the file was moved to the recycle bin, the INFO2 record stores 32 KiB.
- 
 
 76 
The GUI displays the file as 1 KB (it must get that number from the data file, not from the index file).
- 
 
 77 
 
- 
 
 78 
### Deleted files
- 
 
 79 
 
- 
 
 80 
For Windows 95/NT4 with IE4 integration, and all OS versions above:
- 
 
 81 
When a file is removed from the recycle bin (i.e. deleted or recovered),
- 
 
 82 
the first byte of the original filename will be set to a zero byte,
- 
 
 83 
making the zero-terminated string empty. This way, the record is marked as deleted
- 
 
 84 
and the INFO/INFO2 file does not need to be reorganized like it was the case for Win95/NT4 without IE4.
- 
 
 85 
 
- 
 
 86 
When the recycle bin is emptied (NOT if all files were manually deleted or recovered),
- 
 
 87 
then the INFO und INFO2 files are removed.
- 
 
 88 
 
75 
## $I... files of Windows Vista and above
 89 
## $I... files of Windows Vista and above
76 
 
 90 
 
77 
Beginning with Windows Vista, each deleted file gets its own information record. The information record ("index file") has the name `$Ixxxxxx.ext` while the data file is renamed to `$Rxxxxxx.ext` (`xxxxxx` replaced with a random `[0-9A-Z]` string and `ext` replaced with the file name extension).
 91 
Beginning with Windows Vista, each deleted file gets its own information record. The information record ("index file") has the name `$Ixxxxxx.ext` while the data file is renamed to `$Rxxxxxx.ext` (`xxxxxx` replaced with a random `[0-9A-Z]` string and `ext` replaced with the file name extension).
78 
 
 92 
 
79 
### Version 1 (Introduced in Windows Vista)
 93 
### Version 1 (Introduced in Windows Vista)