WebSVN – recyclebinunit – Diff – /trunk/FORMAT.md


 
# Windows Recycle Bin internal format
 
## Locations of the index files
 
### FAT drives:
 
- Windows 95 native:	`C:\RECYCLED\INFO` (with ANSI records, folder deletion is NOT possible, format `00 00 00 00`)
- Windows 95+IE4, 98SE:	`C:\RECYCLED\INFO2` (with ANSI records, folder deletion is possible, format `04 00 00 00`)
- Windows Me:		`C:\RECYCLED\INFO2` (with ANSI records, folder deletion is possible, format `05 00 00 00`)
- Windows Vista+:	`C:\$RECYCLE.BIN\$I...`
- Windows 95 (Beta 58s)	`C:\CHICAGO\DESKTOP\RECYCLE.BIN` (a normal folder with the deleted files. There are no index files and deleted files won't get renamed). In beta build 122, the recycle bin was removed and re-added in beta build 180 with the INFO-format we know from the RTM release.
 
### NTFS drives:
 
- Windows NT4:		`C:\RECYCLER\<UserSID>\INFO` (with Unicode records, folder deletion is possible, format `02 00 00 00`)
- Windows 2000, XP:	`C:\RECYCLER\<UserSID>\INFO2` (with Unicode records, folder deletion is possible, format `05 00 00 00`)
- Windows Vista+:	`C:\$RECYCLE.BIN\<UserSID>\$I...`
 
## INFO and INFO2 files
 
INFO is written by Win95 without IE4 (with ANSI records), and WinNT4 (with Unicode records).
 
INFO2 is written by Win95 with Internet Explorer 4 shell extensions, Win98, WinMe (with ANSI records), Win2000, and WinXP (with Unicode records).
 
Since some Windows version combinations mix up ANSI records and Unicode records (e.g. Win95+IE4 and Win2000), these Windows versions break the recycle bin information file of each other.
 
INFO and INFO2 is the index file containing all information about the deleted files. The data files are renamed to `Dxyyy.ext` (`x` replaced with the drive letter, `yyy` being a dynamic length integer, `ext` being replaced with the file name extension).
 
### Header
 
| offset (hex) | size (dec) |  type | description |
|--------------|------------|-------|-------------|
| 0000         | 4          | DWORD | Version of the info file<br>`00 00 00 00` = Win95 (without IE4)<br>`02 00 00 00` = Win NT4 (Win96/Cairo?)<br>`04 00 00 00` = Win95 (with IE4), Win98<br>`05 00 00 00` = Win Me, 2000, WinXP (NT4+IE4, NT5?) | 
| 0004         | 4          | DWORD | Total entries. Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons. | 
| 0008         | 4          | DWORD | Next possible ID. Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons. | 
| 000C         | 4          | DWORD | Item record length<br>0x118 = ANSI records<br>0x320 = Unicode records | 
| 0010         | 4          | DWORD | Total size (sum of all original sizes of the files). Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons. | 
 
### ANSI record (Win95, Win98, WinMe)
 
Windows 95:      INFO file with ANSI record; Folder deletion NOT possible
 
Windows 95 +IE4: INFO2 file with ANSI record; Folder deletion possible
 
| offset (hex) | size (dec) |  type           | description |
|--------------|------------|-----------------|-------------|
| 0000         | 260        | char[MAX_PATH]  | Original file name and path in ANSI characters. 260 characters (including NUL terminator). Empty string if file was deleted. | 
| 0104         | 4          | DWORD           | Record number | 
| 0108         | 4          | DWORD           | Source drive number<br>0=A, 1=B, 2=C, ..., 25=Z<br>26=@ (this is the "Network home drive" of the Win95 days) | 
| 010C         | 8          | FILETIME        | Deletion time | 
| 0114         | 4          | DWORD           | Original file size, rounded to the next cluster (see note below).<br>INFO2, for folders: The whole folder size with contents | 
 
### Unicode record (WinNT4, Win2000, WinXP)
 
Windows NT4:   INFO file with Unicode record; Folder deletion possible
 
Windows 2000+: INFO2 file with Unicode record; Folder deletion possible
 
| offset (hex) | size (dec) |  type           | description |
|--------------|------------|-----------------|-------------|
| 0000         | 260        | char[MAX_PATH]  | Original file name and path in ANSI characters. 260 characters (including NUL terminator). Empty string if file was deleted. | 
| 0104         | 4          | DWORD           | Record number | 
| 0108         | 4          | DWORD           | Source drive number<br>0=A, 1=B, 2=C, ..., 25=Z<br>26=@ (this is the "Network home drive" of the Win95 days) | 
| 010C         | 8          | FILETIME        | Deletion time | 
| 0114         | 4          | DWORD           | Original file size, rounded to the next cluster (see note below) |
| 0118         | 520        | wchar[MAX_PATH] | Original file name and path in Unicode characters. 260 characters (including NUL terminator) | 
 
### Sizes
 
The original size is inteded to be rounded to the next cluster, so this should be the size on the disk, not the size of the actual file.
 
However, my test system (Win98, INFO2 record) showed a weird behavior:
Explorer shows "size used" as 4 KiB (e.g. 4096 bytes used, which is my file system cluster size),
but when the file was moved to the recycle bin, the INFO2 record stores 32 KiB.
The GUI displays the file as 1 KB (it must get that number from the data file, not from the index file).
 
WinNT4 does it correctly, setting the size to 0x200 (512 Byte), which is the file system cluster size.
 
### Deleted files
 
For Windows 95 with IE4 integration, and all OS versions above:
When a file is removed from the recycle bin (i.e. deleted or recovered),
the first byte of the original filename will be set to a zero byte,
making the zero-terminated string empty. This way, the record is marked as deleted
and the INFO/INFO2 file does not need to be reorganized like it was the case for WinNT4 and Win95 without IE4.
 
When the recycle bin is emptied (NOT if all files were manually deleted or recovered),
then the INFO und INFO2 files are removed.
 
## $I... files of Windows Vista and above
 
Beginning with Windows Vista, each deleted file gets its own information record. The information record ("index file") has the name `$Ixxxxxx.ext` while the data file is renamed to `$Rxxxxxx.ext` (`xxxxxx` replaced with a random `[0-9A-Z]` string and `ext` replaced with the file name extension).
 
### Version 1 (Introduced in Windows Vista)
 
| offset (hex) | size (dec) |  type           | description |
|--------------|------------|-----------------|-------------|
| 0000         | 8          | int64           | Version, always `01 00 00 00 00 00 00 00` |
| 0008         | 8          | uint64          | Original size | 
| 0010         | 8          | FILETIME        | Deletion time | 
| 0018         | 520        | wchar[MAX_PATH] | Original file name and path in Unicode characters. 260 characters (including NUL terminator) | 
 
### Version 2 (Introduced somewhere in a Windows 10 release)
 
| offset (hex) | size (dec) |  type           | description |
|--------------|------------|-----------------|-------------|
| 0000         | 8          | int64           | Version, always `02 00 00 00 00 00 00 00` |
| 0008         | 8          | uint64          | Original size | 
| 0010         | 8          | FILETIME        | Deletion time | 
| 0018         | 4          | DWORD           | Original file name and path: Count of Unicode characters, including NUL terminator | 
| 001C         | 2*n        | wchar[]         | Original file name and path: Zero terminated Unicode string |

Subversion Repositories recyclebinunit

recyclebinunit/trunk/FORMAT.md – Rev 104 → 105

Rev 104		Rev 105
1		1
2	# Windows Recycle Bin internal format	2	# Windows Recycle Bin internal format
3		3
4	## Locations of the index files	4	## Locations of the index files
5		5
6	### FAT drives:	6	### FAT drives:
7		7
8	- Windows 95 native: `C:\RECYCLED\INFO` (with ANSI records, folder deletion is NOT possible, format `00 00 00 00`)	8	- Windows 95 native: `C:\RECYCLED\INFO` (with ANSI records, folder deletion is NOT possible, format `00 00 00 00`)
9	- Windows 95+IE4, 98SE: `C:\RECYCLED\INFO2` (with ANSI records, folder deletion is possible, format `04 00 00 00`)	9	- Windows 95+IE4, 98SE: `C:\RECYCLED\INFO2` (with ANSI records, folder deletion is possible, format `04 00 00 00`)
10	- Windows Me: `C:\RECYCLED\INFO2` (with ANSI records, folder deletion is possible, format `05 00 00 00`)	10	- Windows Me: `C:\RECYCLED\INFO2` (with ANSI records, folder deletion is possible, format `05 00 00 00`)
11	- Windows Vista+: `C:\$RECYCLE.BIN\$I...`	11	- Windows Vista+: `C:\$RECYCLE.BIN\$I...`
12	- Windows 95 (Beta 58s) `C:\CHICAGO\DESKTOP\RECYCLE.BIN` (a normal folder with the deleted files. There are no index files and deleted files won't get renamed). In beta build 122, the recycle bin was removed and re-added in beta build 180 with the INFO-format we know from the RTM release.	12	- Windows 95 (Beta 58s) `C:\CHICAGO\DESKTOP\RECYCLE.BIN` (a normal folder with the deleted files. There are no index files and deleted files won't get renamed). In beta build 122, the recycle bin was removed and re-added in beta build 180 with the INFO-format we know from the RTM release.
13		13
14	### NTFS drives:	14	### NTFS drives:
15		15
16	- Windows NT4: `C:\RECYCLER\<UserSID>\INFO` (with Unicode records, folder deletion is possible, format `02 00 00 00`)	16	- Windows NT4: `C:\RECYCLER\<UserSID>\INFO` (with Unicode records, folder deletion is possible, format `02 00 00 00`)
17	- Windows 2000, XP: `C:\RECYCLER\<UserSID>\INFO2` (with Unicode records, folder deletion is possible, format `05 00 00 00`)	17	- Windows 2000, XP: `C:\RECYCLER\<UserSID>\INFO2` (with Unicode records, folder deletion is possible, format `05 00 00 00`)
18	- Windows Vista+: `C:\$RECYCLE.BIN\<UserSID>\$I...`	18	- Windows Vista+: `C:\$RECYCLE.BIN\<UserSID>\$I...`
19		19
20	## INFO and INFO2 files	20	## INFO and INFO2 files
21		21
22	INFO is written by Win95 without IE4 (with ANSI records), and WinNT4 (with Unicode records).	22	INFO is written by Win95 without IE4 (with ANSI records), and WinNT4 (with Unicode records).
23		23
24	INFO2 is written by Win95 with Internet Explorer 4 shell extensions, Win98, WinMe (with ANSI records), Win2000, and WinXP (with Unicode records).	24	INFO2 is written by Win95 with Internet Explorer 4 shell extensions, Win98, WinMe (with ANSI records), Win2000, and WinXP (with Unicode records).
25		25
26	Since some Windows version combinations mix up ANSI records and Unicode records (e.g. Win95+IE4 and Win2000), these Windows versions break the recycle bin information file of each other.	26	Since some Windows version combinations mix up ANSI records and Unicode records (e.g. Win95+IE4 and Win2000), these Windows versions break the recycle bin information file of each other.
27		27
28	INFO and INFO2 is the index file containing all information about the deleted files. The data files are renamed to `Dxyyy.ext` (`x` replaced with the drive letter, `yyy` being a dynamic length integer, `ext` being replaced with the file name extension).	28	INFO and INFO2 is the index file containing all information about the deleted files. The data files are renamed to `Dxyyy.ext` (`x` replaced with the drive letter, `yyy` being a dynamic length integer, `ext` being replaced with the file name extension).
29		29
30	### Header	30	### Header
31		31
32	\| offset (hex) \| size (dec) \| type \| description \|	32	\| offset (hex) \| size (dec) \| type \| description \|
33	\|--------------\|------------\|-------\|-------------\|	33	\|--------------\|------------\|-------\|-------------\|
34	\| 0000 \| 4 \| DWORD \| Version of the info file<br>`00 00 00 00` = Win95 (without IE4)<br>`02 00 00 00` = Win NT4 (Win96/Cairo?)<br>`04 00 00 00` = Win95 (with IE4), Win98<br>`05 00 00 00` = Win Me, 2000, WinXP (NT4+IE4, NT5?) \|	34	\| 0000 \| 4 \| DWORD \| Version of the info file<br>`00 00 00 00` = Win95 (without IE4)<br>`02 00 00 00` = Win NT4 (Win96/Cairo?)<br>`04 00 00 00` = Win95 (with IE4), Win98<br>`05 00 00 00` = Win Me, 2000, WinXP (NT4+IE4, NT5?) \|
35	\| 0004 \| 4 \| DWORD \| Total entries. Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons. \|	35	\| 0004 \| 4 \| DWORD \| Total entries. Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons. \|
36	\| 0008 \| 4 \| DWORD \| Next possible ID. Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons. \|	36	\| 0008 \| 4 \| DWORD \| Next possible ID. Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons. \|
37	\| 000C \| 4 \| DWORD \| Item record length<br>0x118 = ANSI records<br>0x320 = Unicode records \|	37	\| 000C \| 4 \| DWORD \| Item record length<br>0x118 = ANSI records<br>0x320 = Unicode records \|
38	\| 0010 \| 4 \| DWORD \| Total size (sum of all original sizes of the files). Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons. \|	38	\| 0010 \| 4 \| DWORD \| Total size (sum of all original sizes of the files). Only Win95 (without IE4) and Win NT4, other OS versions will use the registry instead and might write information on WM_ENDSESSION for compatibility reasons. \|
39		39
40	### ANSI record (Win95, Win98, WinMe)	40	### ANSI record (Win95, Win98, WinMe)
41		41
42	Windows 95: INFO file with ANSI record; Folder deletion NOT possible	42	Windows 95: INFO file with ANSI record; Folder deletion NOT possible
43		43
44	Windows 95 +IE4: INFO2 file with ANSI record; Folder deletion possible	44	Windows 95 +IE4: INFO2 file with ANSI record; Folder deletion possible
45		45
46	\| offset (hex) \| size (dec) \| type \| description \|	46	\| offset (hex) \| size (dec) \| type \| description \|
47	\|--------------\|------------\|-----------------\|-------------\|	47	\|--------------\|------------\|-----------------\|-------------\|
48	\| 0000 \| 260 \| char[MAX_PATH] \| Original file name and path in ANSI characters. 260 characters (including NUL terminator). Empty string if file was deleted. \|	48	\| 0000 \| 260 \| char[MAX_PATH] \| Original file name and path in ANSI characters. 260 characters (including NUL terminator). Empty string if file was deleted. \|
49	\| 0104 \| 4 \| DWORD \| Record number \|	49	\| 0104 \| 4 \| DWORD \| Record number \|
50	\| 0108 \| 4 \| DWORD \| Source drive number<br>0=A, 1=B, 2=C, ..., 25=Z<br>26=@ (this is the "Network home drive" of the Win95 days) \|	50	\| 0108 \| 4 \| DWORD \| Source drive number<br>0=A, 1=B, 2=C, ..., 25=Z<br>26=@ (this is the "Network home drive" of the Win95 days) \|
51	\| 010C \| 8 \| FILETIME \| Deletion time \|	51	\| 010C \| 8 \| FILETIME \| Deletion time \|
52	\| 0114 \| 4 \| DWORD \| Original file size, rounded to the next cluster (see note below).<br>INFO2, for folders: The whole folder size with contents \|	52	\| 0114 \| 4 \| DWORD \| Original file size, rounded to the next cluster (see note below).<br>INFO2, for folders: The whole folder size with contents \|
53		53
54	### Unicode record (WinNT4, Win2000, WinXP)	54	### Unicode record (WinNT4, Win2000, WinXP)
55		55
56	Windows NT4: INFO file with Unicode record; Folder deletion possible	56	Windows NT4: INFO file with Unicode record; Folder deletion possible
57		57
58	Windows 2000+: INFO2 file with Unicode record; Folder deletion possible	58	Windows 2000+: INFO2 file with Unicode record; Folder deletion possible
59		59
60	\| offset (hex) \| size (dec) \| type \| description \|	60	\| offset (hex) \| size (dec) \| type \| description \|
61	\|--------------\|------------\|-----------------\|-------------\|	61	\|--------------\|------------\|-----------------\|-------------\|
62	\| 0000 \| 260 \| char[MAX_PATH] \| Original file name and path in ANSI characters. 260 characters (including NUL terminator). Empty string if file was deleted. \|	62	\| 0000 \| 260 \| char[MAX_PATH] \| Original file name and path in ANSI characters. 260 characters (including NUL terminator). Empty string if file was deleted. \|
63	\| 0104 \| 4 \| DWORD \| Record number \|	63	\| 0104 \| 4 \| DWORD \| Record number \|
64	\| 0108 \| 4 \| DWORD \| Source drive number<br>0=A, 1=B, 2=C, ..., 25=Z<br>26=@ (this is the "Network home drive" of the Win95 days) \|	64	\| 0108 \| 4 \| DWORD \| Source drive number<br>0=A, 1=B, 2=C, ..., 25=Z<br>26=@ (this is the "Network home drive" of the Win95 days) \|
65	\| 010C \| 8 \| FILETIME \| Deletion time \|	65	\| 010C \| 8 \| FILETIME \| Deletion time \|
66	\| 0114 \| 4 \| DWORD \| Original file size, rounded to the next cluster (see note below) \|	66	\| 0114 \| 4 \| DWORD \| Original file size, rounded to the next cluster (see note below) \|
67	\| 0118 \| 520 \| wchar[MAX_PATH] \| Original file name and path in Unicode characters. 260 characters (including NUL terminator) \|	67	\| 0118 \| 520 \| wchar[MAX_PATH] \| Original file name and path in Unicode characters. 260 characters (including NUL terminator) \|
68		68
69	### Sizes	69	### Sizes
70		70
71	The original size is inteded to be rounded to the next cluster, so this should be the size on the disk, not the size of the actual file.	71	The original size is inteded to be rounded to the next cluster, so this should be the size on the disk, not the size of the actual file.
72		72
73	However, my test system (Win98, INFO2 record) showed a weird behavior:	73	However, my test system (Win98, INFO2 record) showed a weird behavior:
74	Explorer shows "size used" as 4 KiB (e.g. 4096 bytes used, which is my file system cluster size),	74	Explorer shows "size used" as 4 KiB (e.g. 4096 bytes used, which is my file system cluster size),
75	but when the file was moved to the recycle bin, the INFO2 record stores 32 KiB.	75	but when the file was moved to the recycle bin, the INFO2 record stores 32 KiB.
76	The GUI displays the file as 1 KB (it must get that number from the data file, not from the index file).	76	The GUI displays the file as 1 KB (it must get that number from the data file, not from the index file).
77		77
-		78	WinNT4 does it correctly, setting the size to 0x200 (512 Byte), which is the file system cluster size.
-		79
78	### Deleted files	80	### Deleted files
79		81
80	For Windows 95/NT4 with IE4 integration, and all OS versions above:	82	For Windows 95 with IE4 integration, and all OS versions above:
81	When a file is removed from the recycle bin (i.e. deleted or recovered),	83	When a file is removed from the recycle bin (i.e. deleted or recovered),
82	the first byte of the original filename will be set to a zero byte,	84	the first byte of the original filename will be set to a zero byte,
83	making the zero-terminated string empty. This way, the record is marked as deleted	85	making the zero-terminated string empty. This way, the record is marked as deleted
84	and the INFO/INFO2 file does not need to be reorganized like it was the case for Win95/NT4 without IE4.	86	and the INFO/INFO2 file does not need to be reorganized like it was the case for WinNT4 and Win95 without IE4.
85		87
86	When the recycle bin is emptied (NOT if all files were manually deleted or recovered),	88	When the recycle bin is emptied (NOT if all files were manually deleted or recovered),
87	then the INFO und INFO2 files are removed.	89	then the INFO und INFO2 files are removed.
88		90
89	## $I... files of Windows Vista and above	91	## $I... files of Windows Vista and above
90		92
91	Beginning with Windows Vista, each deleted file gets its own information record. The information record ("index file") has the name `$Ixxxxxx.ext` while the data file is renamed to `$Rxxxxxx.ext` (`xxxxxx` replaced with a random `[0-9A-Z]` string and `ext` replaced with the file name extension).	93	Beginning with Windows Vista, each deleted file gets its own information record. The information record ("index file") has the name `$Ixxxxxx.ext` while the data file is renamed to `$Rxxxxxx.ext` (`xxxxxx` replaced with a random `[0-9A-Z]` string and `ext` replaced with the file name extension).
92		94
93	### Version 1 (Introduced in Windows Vista)	95	### Version 1 (Introduced in Windows Vista)
94		96
95	\| offset (hex) \| size (dec) \| type \| description \|	97	\| offset (hex) \| size (dec) \| type \| description \|
96	\|--------------\|------------\|-----------------\|-------------\|	98	\|--------------\|------------\|-----------------\|-------------\|
97	\| 0000 \| 8 \| int64 \| Version, always `01 00 00 00 00 00 00 00` \|	99	\| 0000 \| 8 \| int64 \| Version, always `01 00 00 00 00 00 00 00` \|
98	\| 0008 \| 8 \| uint64 \| Original size \|	100	\| 0008 \| 8 \| uint64 \| Original size \|
99	\| 0010 \| 8 \| FILETIME \| Deletion time \|	101	\| 0010 \| 8 \| FILETIME \| Deletion time \|
100	\| 0018 \| 520 \| wchar[MAX_PATH] \| Original file name and path in Unicode characters. 260 characters (including NUL terminator) \|	102	\| 0018 \| 520 \| wchar[MAX_PATH] \| Original file name and path in Unicode characters. 260 characters (including NUL terminator) \|
101		103
102	### Version 2 (Introduced somewhere in a Windows 10 release)	104	### Version 2 (Introduced somewhere in a Windows 10 release)
103		105
104	\| offset (hex) \| size (dec) \| type \| description \|	106	\| offset (hex) \| size (dec) \| type \| description \|
105	\|--------------\|------------\|-----------------\|-------------\|	107	\|--------------\|------------\|-----------------\|-------------\|
106	\| 0000 \| 8 \| int64 \| Version, always `02 00 00 00 00 00 00 00` \|	108	\| 0000 \| 8 \| int64 \| Version, always `02 00 00 00 00 00 00 00` \|
107	\| 0008 \| 8 \| uint64 \| Original size \|	109	\| 0008 \| 8 \| uint64 \| Original size \|
108	\| 0010 \| 8 \| FILETIME \| Deletion time \|	110	\| 0010 \| 8 \| FILETIME \| Deletion time \|
109	\| 0018 \| 4 \| DWORD \| Original file name and path: Count of Unicode characters, including NUL terminator \|	111	\| 0018 \| 4 \| DWORD \| Original file name and path: Count of Unicode characters, including NUL terminator \|
110	\| 001C \| 2*n \| wchar[] \| Original file name and path: Zero terminated Unicode string \|	112	\| 001C \| 2*n \| wchar[] \| Original file name and path: Zero terminated Unicode string \|