Lion Cipher Lab
Recover deleted-file evidence from the Windows Recycle Bin ($I/$R)
- Digital Forensics & IR (DFIR)
- Intermediate
- ~45 min
- Free · no account required
Why it matters
When someone deletes a file the normal way — Delete key, right-click Delete, drag to the bin — Windows does not erase it. It moves it into a hidden $Recycle.Bin folder and writes a tiny companion file that records where the file came from, how big it was, and the exact second it was deleted. For an investigator that is gold: it proves a specific file existed, names the folder it lived in (even if that folder is now gone), and timestamps the deletion. Learning to read that record by hand — instead of trusting a tool you can't explain in court — is a core Windows DFIR skill.
What you'll learn
- Windows Recycle Bin forensics
- parsing the $I metadata format
- reading binary structures with Python struct
- converting Windows FILETIME timestamps
- building deleted-file timelines
Steps in this lab
- What the Recycle Bin actually keeps
- When you'd reach for this — and when it won't help
- Build the evidence yourself (safe and offline)
- Find your SID and work on a copy, not the original
- The $I file format, byte by byte
- Parse it with Python
- Cross-check against the $R content and verify
- How a pro does it differently, and the honest limits