Windows Recycle Bin ($I files)
| Format | Windows Recycle Bin ($I files) |
|---|---|
| Short name | $I |
| Category | filesystem |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
For each file moved to the Recycle Bin (Windows Vista and later), $Recycle.Bin\<SID>\ holds a $R file with the content and a $I file with the original path, size and deletion time. Version 2 (Windows 10 and later) stores the path length; version 1 a fixed 520-byte path. The header is just a version number, not a signature.
Signatures
None recorded
Known extensions
None recorded
References
- Windows Recycle.Bin file formats (libyal/dtformats) https://github.com/libyal/dtformats/blob/main/documentation/Windows%20Recycle.Bin%20file%20formats.asciidoc
- Forensic Analysis of the Microsoft Windows Vista Recycle Bin (Mitchell Machor, Forensic Focus, 2008) https://www.forensicfocus.com/articles/forensic-analysis-of-the-microsoft-windows-vista-recycle-bin/
Cite this entry
Crush Format Reference, “Windows Recycle Bin ($I files)”. https://kalink0.github.io/crush-forensics/formats/i/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction