Course Curriculum

  • 01

    Introduction

    • Recycle Bin

    • Tools Requirements

  • 02

    File Format

    • File Formats

    • Check-in Quiz

    • Check-in Quiz (Hands-on)

    • Check-in Quiz (Hands-on) - Solution

  • 03

    Using Recycle Bin Tools

    • Using Recycle Bin Tools

  • 04

    Recovering or Permanently Deleting Files

    • Recovering Permanently Deleted Files

  • 05

    Labs and Exercises

    • Required Files

    • Lab 01 - Recycle Bin

    • Lab 01 - Recycle Bin - Solutions

6 CPE Credits

After completing this course, you will earn:

Get Started Now

Learn how to investigate Windows Recycle Bin Now.

Learning Outcomes

After completing this course, you will learn the following.

  • Understand the differences between $R and $I Recycle Bin files and learn how to parse them

  • Learn the role of timestamps in Recycle Bin artifacts

  • Parse the hex content of $R and $I files

  • Learn how to use RBCmd.exe and Rifiuti2 Recycle Bin parsing tools for forensic investigation

  • Review artifacts left behind from permanently deleting or recovering files

  • Identify artifacts left behind from permanently deleting or recovering files

  • Locate files that got recovered from the Recycle Bin

Technical Requirements

For the hands-on labs in this course

  • Windows 10 operating system (recommended)

  • Internet Connection

  • FTK Imager here

  • Eric Zimmerman Tools here

  • 010 Editor here or HxD Editor here

Course Reviews

Olatunji Olumide

4 star rating

“Great Material and very straight forward”

“Great Material and very straight forward”

Read Less

L.M Charana Shenal Thilakarathna

5 star rating

“Very Valuable course ”

“Very Valuable course ”

Read Less

Lorie Hermesdorf

4 star rating

“Excellent introduction to Recycle Bin forensics. Very straight forward, good detailed graphics.”

“Excellent introduction to Recycle Bin forensics. Very straight forward, good detailed graphics.”

Read Less

Linda Vue

5 star rating

“Easy to follow and love that direct links were provided to the tools used.”

“Easy to follow and love that direct links were provided to the tools used.”

Read Less

What is next at Cyber 5W?

Add Your Email to The Mailing List to Get The Latest Updates