Course 36 - Windows Forensics and Tools | Episode 10: Decoding Metadata and File Internals

About this episode

This episode covers Windows forensics focusing on the Recycle Bin and techniques for recovering deleted files.

In this lesson, you’ll learn about: Windows Recycle Bin forensics and deleted file recovery1. Why the Recycle Bin Matters in Forensics Deleting a file in Windows does not immediately erase it Instead, Windows: Moves it to a hidden system structure Renames it Keeps both metadata and data intact 🔹 Key Idea The Recycle Bin is often a hidden evidence repository 2. Core Forensic Insight Deleted files usually remain: On disk (physically intact) With modified references only 👉 Result: Investigators can often recover: Files Paths Deletion timestamps 3. Legacy Windows Recycle Bin (Windows XP and earlier)🔹 Structure Used INFO2 file Stored inside: Recycler folder 🔹 What it contains Original file path File size Deletion order 👉 Key Insight: Acts as an index of deleted files 4. Modern Windows Recycle Bin (Vista → Windows 10)🔹 Structure Used $Recycle.Bin 🔹 File Pair SystemEach deleted file creates two entries: $R file Contains actual file data $I file Contains metadata: Original name Path Deletion timestamp 👉 Key Insight: Data and metadata are split for tracking integrity 5. Windows 10 Forensic Markers🔹 Version Identification $I file headers contain version indicators: 01 → older…

Topics covered

• Windows forensics
• deleted file recovery
• Recycle Bin analysis
• forensic markers
• hex-level analysis

Keywords

• forensics
• Recycle Bin
• deleted files
• metadata
• file recovery
• Windows 10
• hex analysis

Mentioned in this episode

Organizations: Windows, Windows XP, Windows Vista, Windows 10

Products: INFO2 file, $Recycle.Bin, $R file, $I file, Hex editors, Forensic analysis tools

More episodes of CyberCode Academy

• Course 36 - Windows Forensics and Tools | Episode 14: A Guide to Steganography and OpenStego · June 12, 2026 · 18 min
• Course 36 - Windows Forensics and Tools | Episode 13: Decoding Registry Artifacts and Connection History · June 11, 2026 · 13 min
• Course 36 - Windows Forensics and Tools | Episode 12: A Forensic Guide to Windows User Artifacts · June 10, 2026 · 18 min
• Course 36 - Windows Forensics and Tools | Episode 11: Unlocking Hidden Metadata and Browser History · June 9, 2026 · 21 min
• Course 36 - Windows Forensics and Tools | Episode 9: Uncovering Hidden Evidence · June 7, 2026 · 25 min
• Course 36 - Windows Forensics and Tools | Episode 8: Efficiency, Evidence, and Forensics · June 6, 2026 · 23 min