Course Curriculum

  • 01

    Introduction

    • Recycle Bin

    • Tools Requirements
  • 02

    File Format

    • File Formats

    • Check-in Quiz

    • Check-in Quiz (Hands-on)

    • Check-in Quiz (Hands-on) - Solution
  • 03

    Using Recycle Bin Tools

    • Using Recycle Bin Tools
  • 04

    Recovering or Permanently Deleting Files

    • Recovering Permanently Deleted Files
  • 05

    Labs and Exercises

    • Required Files

    • Lab 01 - Recycle Bin

    • Lab 01 - Recycle Bin - Solutions

6 CPE Credits

After completing this course, you will earn:

Get Started Now

Learn how to investigate Windows Recycle Bin Now.

Enroll for Free

Learning Outcomes

After completing this course, you will learn the following.

  • Understand the differences between $R and $I Recycle Bin files and learn how to parse them

  • Learn the role of timestamps in Recycle Bin artifacts

  • Parse the hex content of $R and $I files

  • Learn how to use RBCmd.exe and Rifiuti2 Recycle Bin parsing tools for forensic investigation

  • Review artifacts left behind from permanently deleting or recovering files

  • Identify artifacts left behind from permanently deleting or recovering files

  • Locate files that got recovered from the Recycle Bin

Technical Requirements

For the hands-on labs in this course

  • Windows 10 operating system (recommended)

  • Internet Connection

  • FTK Imager here

  • Eric Zimmerman Tools here

  • 010 Editor here or HxD Editor here

Course Reviews

Olatunji Olumide

4 star rating

“Great Material and very straight forward”

“Great Material and very straight forward”

→Read Less

L.M Charana Shenal Thilakarathna

5 star rating

“Very Valuable course ”

“Very Valuable course ”

→Read Less

Lorie Hermesdorf

4 star rating

“Excellent introduction to Recycle Bin forensics. Very straight forward, good detailed graphics.”

“Excellent introduction to Recycle Bin forensics. Very straight forward, good detailed graphics.”

→Read Less

Linda Vue

5 star rating

“Easy to follow and love that direct links were provided to the tools used.”

“Easy to follow and love that direct links were provided to the tools used.”

→Read Less

What is next at Cyber 5W?

Add Your Email to The Mailing List to Get The Latest Updates