Course curriculum

  • 01

    Introduction

    • Recycle Bin

    • Tools Requirements

  • 02

    File Format

    • File Formats

    • Check-in Quiz

    • Check-in Quiz (Hands-on)

    • Check-in Quiz (Hands-on) - Solution

  • 03

    Using Recycle Bin Tools

    • Using Recycle Bin Tools

  • 04

    Recovering or Permanently Deleting Files

    • Recovering Permanently Deleted Files

  • 05

    Labs and Exercises

    • Required Files

    • Lab 01 - Recycle Bin

    • Lab 01 - Recycle Bin - Solutions

Get Started Now

Learn how to investigate Windows Recycle Bin Now.

Learning Outcomes

After completing this course, you will learn the following.

  • Understand the differences between $R and $I Recycle Bin files and learn how to parse them

  • Learn the role of timestamps in Recycle Bin artifacts

  • Parse the hex content of $R and $I files

  • Learn how to use RBCmd.exe and Rifiuti2 Recycle Bin parsing tools for forensic investigation

  • Review artifacts left behind from permanently deleting or recovering files

  • Identify artifacts left behind from permanently deleting or recovering files

  • Locate files that got recovered from the Recycle Bin

Technical Requirements

For the hands-on labs in this course

  • Windows 10 operating system (recommended)

  • Internet Connection

  • FTK Imager here

  • Eric Zimmerman Tools here

  • 010 Editor here or HxD Editor here

Course Reviews

Olatunji Olumide

4 star rating

“Great Material and very straight forward”

“Great Material and very straight forward”

Read Less

What is next at Cyber 5W?

Add Your Email to The Mailing List to Get The Latest Updates