What is the path to the Recycle Bin in Windows 10?

[jmt356]

What is the path to the Recycle Bin in Windows 10?

I have a ShadowProtect backup of my hard drive and I want to access the files that were in my Recycle Bin as of yesterday, but I cannot find where on the mounted disk the deleted items in the Recycle Bin are located.

[Argus]

$Recycle.bin is in the root of the drive.

[jmt356]

When I enter $Recycle.bin into File Explorer and press enter, a new tab in Google Chrome opens and states "This site can’t be reached."

[JoeP]

In File Explorer go to the View tab, click Options, then click the View tab . Make sure that "Hide protected operating system files" is not checked.

[Argus]

When I enter $Recycle.bin into File Explorer and press enter, a new tab in Google Chrome opens and states "This site can’t be reached."

Firstly, the recycle bin is one of those "special directories" (attributes HSDI, or something; hidden, system & not indexed), so in normal cases (live system, not a mounted drive, and default settings) there is no access via a (standard) file explorer.

It should be mentioned that there is a recycle bin for each HDD partition, so anything deleted, if indeed "going to the bin", ends up in the one in the same partition as the file being deleted. The Recycle bin we usually find, for example on the Desktop, includes all recycle bins on the system.

In a normal live system one would use the Recycle bin (on the Desktop), but without changing settings, it is also possible to access the recycle bin via a command prompt and copy the file(s). They will keep the extension (for example XLSX), but names will be replaced with $R and some numbers. There will also be some metadata saved for each file, including (I think) name, date, size and path ...

That said, I'm afraid the file isn't *in the* recycle bin; what we see are pointers to deleted files (the files new home address has been changed, without the file being moved). That's why it's possible to recover deleted files (with certain tools) even if the recycle bin is empty, as long as the space, sectors, on the drive hasn't been used for something else.

So, the recycle bin is a special, virtual if you like, folder that keeps an index of deleted files (but as you know files can also be removed without sending this info to the recycle bin).

From this we can conclude that it is possible to recover, or via a command prompt copy, files on a live system, but if you mount an image there are no actual files to copy in the recycle bin, just the index mentioned above. If there are deleted files in the Recycle bin they point to some place on that image of the partition.

I can't test all aspects of this since I usually don't keep files in the Recycle bin and it's empty when backups are done. It's perhaps possible to use some tool to hunt down the deleted files when an image is mounted (remember, if the Recycle bin includes them in an index they are still there, even if they can't be seen (in their original place); if the Recycle bin is empty they could still be there, but since the space is marked as free it could have been written to, that said, in that case I gather it depends on the backup, since not all backups include space marked as free). Another option is to restore the image of the drive and then access the Recycle bin and restore the file(s).

(As mentioned by Joe, it's possible to show the recycle bin if you change settings, but you will probably stumble on access denied.)

[Argus]

Wait a minute; I was between my last coffee and my first.

(As mentioned above I'm not running backups with files or folders in the Recycle bin(s).)

Files are indeed moved to a subfolder of $Recycle.bin (didn't mention the subfolders since not that important in this case, one would have to navigate there anyhow), these subfolders will be the same as the user SID (security identifier of the user).

As mentioned there will also be a corresponding file with metadata, starting with $I, information, using the same extension; I think they are all of the size 544 bytes (the names and behaviour changed with Windows Vista).

As many knows it's possible to bypass the Recycle bin when deleting either via changed setting or using Shift-Delete; some other third party software may also bypass the Recycle bin, this is also the case when deleting files via a Command Prompt.

I'm not completely sure what goes on "behind the scene" (what is actually marked as free space by the OS, or if other flags are set; that is, the file isn't moved but marked as not being there and a copy is sent to the Recycle bin), but a copy of the deleted file is stored in a subfolder (as per above) to $Recycle.bin; as I mentioned, it is possible to copy from that place. A copy from $Recycle.bin, as I did via a Command Prompt, doesn't, as is expected when copying files in Windows, restore all metadata, the creation date (or time) is when being copied from the recycle bin. If using the Recycle bin's restore feature all metadata will be restored.

If using a Command Prompt you can easily navigate to subfolders with the help of Tab, i.e. to move from $Recycle.Bin to a subfolder, type CD, press [Space] and then press     , and you can then cycle through the subfolders (by pressing Tab).

The above said, I don't know how ShadowProtect will treat the Recycle Bin's system folder.

[jmt356]

Joe: Even when I have protected operating system files displayed, I am experiencing the same behavior where entering $Recycle.bin into File Explorer causes a new tab in Google Chrome to open with the message, "This site can’t be reached."

Argus: I cannot even find where on the backup image to navigate to in order to locate the Recycle Bin and determine whether there are even files (or file pointers, so to speak) in there.

[Argus]

As mentioned in earlier post you can either restore your backup, restore the deleted files (from the Recycle bin), copy the files somewhere and then return to (restore) your latest backup, i.e. where you are today. (The Recycle bin isn't a good place to store files.) Another option is to copy files via command line interface (below), or perhaps via Explorer (if taking ownership).

- Prepare a place to which you can copy the files.

With the image mounted:
- Open a Command Prompt: press Start, type cmd in start search box.

(If running, what, v. 1703 or later, you'll have to use PowerShell if you don't want to temporarily switch back to using the Command Prompt; the setting for this is in Taskbar settings.)

(If using PowerShell: right-click on Start and select: (ta-da!) Windows PowerShell.)

- Change drive letter to the one assigned to the mounted drive, say "X": type [Drive letter]: (for example, X:) and press Enter.

- Make sure you are the root of the partition: type CD\ and press Enter.

- Change directory to recycle.bin: Simply type CD press [Space] then      (as mentioned above), until you see $recycle.bin then press Enter.

- Change directory to the subfolder linked to the user account (a long SID, as mentioned above): type CD [Space] then      (say, two times).

- You should now see something similar to:
X:\$Recycle.Bin\S-1-5-21 ... >

- Type dir to see the content of that folder.

If you are with me this far, do you see anything?


(As for Windows 10, as far as I'm concerned it's teletubbies & telemetrics with constantly changing settings, sigh.)

[JoeP]

In File Explorer once you allow protected objects to be displayed then click on the root of a drive. You should see the Recycle bin in the right pane. You may open it as you do any other folder. If you want to type it into the address bar be sure to include the drive such as C:\$Recycle.bin

[ChrisGreaves]

If using a Command Prompt you can easily navigate to subfolders with the help of Tab, i.e. to move from $Recycle.Bin to a subfolder, type CD, press [Space] and then press     , and you can then cycle through the subfolders (by pressing Tab).

Voted “Cool Trick of the Weak” here in Toronto.

Simply type CD press [Space] then      (as mentioned above), until you see $recycle.bin then press Enter.
Voted “Coolest Trick of the Week” here in Toronto.

I can see that I’m need to spend a lot more time learning about DOS.

Many Thanks
Chris