rifiuti2

Rifiuti2 analyses recycle bin files from Windows, typically used during Windows computer forensics. It can extract critical metadata like file deletion time, original path, size of deleted files, and status of whether the deleted files have been moved out from the recycle bin since they were trashed.

Rifiuti2 is a rewrite of the original rifiuti tool, extended to cover more functionalities. It handles recycle bin formats up to Windows 10, as well as ancient versions like Windows 95, NT4, and ME. It supports all localized versions of Windows, including both Unicode-based and legacy ones using ANSI code pages, and provides output in XML format or original tab-delimited text.

The tool is designed to be portable and runs in command line environments. Two programs, rifiuti2 and rifiuti-vista, are used depending on the relevant Windows recycle bin format.

Rifiuti2 parses INFO2 files for legacy Windows recycle bin formats and uses rifiuti-vista to parse index files in C:\$Recycle.Bin style folders for Vista and later versions. It extracts metadata such as deletion times (in UTC by default or local time with -z), original paths (including legacy 8.3 paths with codepage support), file sizes, and permanent deletion status. Output can be formatted as tab-delimited text or XML.