Hi all,

I work a lot in windows from the command line. I'd like to be able to,
instead of only deleting a file (f.x. "del *.tmp") be able to move it
to the trashcan.

I could just move to C:\MyTrashCan, but I'd like it to be able to
browse, and preferably replace files later with the standard trash can
view.

Thanks,
Per

Move
Moves one or more files from one directory to the specified directory.

Type in a command prompt: Move /?

More Move HELP.
Paste the following line into Start | Run and click OK...

hh ntcmds.chm::/move.htm

Each hard disk or partition contains a hidden folder named Recycler. The
Recycler folder is used only on NTFS partitions. On FAT32 the RECYCLED
folder is used. The Recycler folder contains a Recycle Bin for each user
that logs on to the computer, sorted by their security identifier (SID).

My hard drive is formatted NTFS.

This is MY SID #
S-1-5-21-1708537768-15xx36667-1202660629-1003

This is MY Recycle Bin
C:\RECYCLER\S-1-5-21-1708537768-15xx36667-1202660629-1003

Your Recycle Bin would be similar, but you need to know your SID #.

This registry key lists all of the SIDs.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

To tell which user has which SID, click on each SID, look at
ProfileImagePath, the Data has the user name at the end of the path. I.e.
%SystemDrive%\Documents and Settings\Wesley P. Vogel

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:1164105114.755437.96400@j44g2000cwa.googlegro ups.com,
per9000 <per9000******.com> hunted and pecked:
> Hi all,
>
> I work a lot in windows from the command line. I'd like to be able to,
> instead of only deleting a file (f.x. "del *.tmp") be able to move it
> to the trashcan.
>
> I could just move to C:\MyTrashCan, but I'd like it to be able to
> browse, and preferably replace files later with the standard trash can
> view.
>
> Thanks,
> Per

Move
Moves one or more files from one directory to the specified directory.

Type in a command prompt: Move /?

More Move HELP.
Paste the following line into Start | Run and click OK...

hh ntcmds.chm::/move.htm

Each hard disk or partition contains a hidden folder named Recycler. The
Recycler folder is used only on NTFS partitions. On FAT32 the RECYCLED
folder is used. The Recycler folder contains a Recycle Bin for each user
that logs on to the computer, sorted by their security identifier (SID).

My hard drive is formatted NTFS.

This is MY SID #
S-1-5-21-1708537768-15xx36667-1202660629-1003

This is MY Recycle Bin
C:\RECYCLER\S-1-5-21-1708537768-15xx36667-1202660629-1003

Your Recycle Bin would be similar, but you need to know your SID #.

This registry key lists all of the SIDs.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

To tell which user has which SID, click on each SID, look at
ProfileImagePath, the Data has the user name at the end of the path. I.e.
%SystemDrive%\Documents and Settings\Wesley P. Vogel

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:1164105114.755437.96400@j44g2000cwa.googlegro ups.com,
per9000 <per9000******.com> hunted and pecked:
> Hi all,
>
> I work a lot in windows from the command line. I'd like to be able to,
> instead of only deleting a file (f.x. "del *.tmp") be able to move it
> to the trashcan.
>
> I could just move to C:\MyTrashCan, but I'd like it to be able to
> browse, and preferably replace files later with the standard trash can
> view.
>
> Thanks,
> Per

Hi Wesley,

yes, indeed this seems to move files to the trashcan-folder. From the
command line I can now see the file (I emptied the trashcan so it was
empty before I put hello_world.log in there)

....
Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05

2006-02-13 14:13 2 180 hello_world.log
1 File(s) 2 180 bytes
....

But when I look in the trashcan using the standard GUI I cannot see the
file in there. The trashcan looks as if is empty.

Also, I'd like to be able to restore the files put in the trashcan
(even if I put them there from the command line). Typically a file has
an original location, a date it was removed etc.

Just to illustrate: I created a file "testing_2.txt" and put it in
trash from the regular gui.

Now if I look in the folder from DOS it looks like this:

Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05

2006-11-22 09:08 0 Dc12466.txt
2006-02-13 14:13 2 180 hello_world.log

Or using Cygwin "ls -lh"
total 9.0K
-rwx------+ 1 per None 0 Nov 22 09:08 Dc12466.txt
-rwx------+ 1 per None 820 Nov 22 09:08 INFO2
-rwx------+ 1 per None 65 Nov 1 11:42 desktop.ini
-rwx------+ 1 per None 2.2K Feb 13 2006 hello_world.log

The file INFO2 seems to contain the info I need to integrate

>type INFO2
♣ u☺ ▒0 ♥ æö♀☺C:\Documents and
Settings\per\Desktop\testing_2.txt

♫╟☺ C : \ D o c u m e n t s a n d S e t t i n g s \ p e r
\ D e s k t o p \ t e s t i n g _ 2 . t x t

My ultimate goal would be a bat-file (f.x. foobar.bat) in my bin-folder
looking something like this:
move /Y %* C:\RECYCLER\S-1-5-21-*NUMBERS*05
That integrates with the regular trashcan. Being able to restore later
is my goal.

Is there perhaps some other exe-file that is run when a user presses
the "delete" button in a regular folder view? and/or generates the info
in INFO2?

Thanks,
Per


Wesley Vogel wrote:
> Move
> Moves one or more files from one directory to the specified directory.
>
> Type in a command prompt: Move /?
>
> More Move HELP.
> Paste the following line into Start | Run and click OK...
>
> hh ntcmds.chm::/move.htm
>
> Each hard disk or partition contains a hidden folder named Recycler. The
> Recycler folder is used only on NTFS partitions. On FAT32 the RECYCLED
> folder is used. The Recycler folder contains a Recycle Bin for each user
> that logs on to the computer, sorted by their security identifier (SID).
>
> My hard drive is formatted NTFS.
>
> This is MY SID #
> S-1-5-21-1708537768-15xx36667-1202660629-1003
>
> This is MY Recycle Bin
> C:\RECYCLER\S-1-5-21-1708537768-15xx36667-1202660629-1003
>
> Your Recycle Bin would be similar, but you need to know your SID #.
>
> This registry key lists all of the SIDs.
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
>
> To tell which user has which SID, click on each SID, look at
> ProfileImagePath, the Data has the user name at the end of the path. I.e.
> %SystemDrive%\Documents and Settings\Wesley P. Vogel
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In news:1164105114.755437.96400@j44g2000cwa.googlegro ups.com,
> per9000 <per9000******.com> hunted and pecked:
> > Hi all,
> >
> > I work a lot in windows from the command line. I'd like to be able to,
> > instead of only deleting a file (f.x. "del *.tmp") be able to move it
> > to the trashcan.
> >
> > I could just move to C:\MyTrashCan, but I'd like it to be able to
> > browse, and preferably replace files later with the standard trash can
> > view.
> >
> > Thanks,
> > Per

Hi Wesley,

yes, indeed this seems to move files to the trashcan-folder. From the
command line I can now see the file (I emptied the trashcan so it was
empty before I put hello_world.log in there)

....
Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05

2006-02-13 14:13 2 180 hello_world.log
1 File(s) 2 180 bytes
....

But when I look in the trashcan using the standard GUI I cannot see the
file in there. The trashcan looks as if is empty.

Also, I'd like to be able to restore the files put in the trashcan
(even if I put them there from the command line). Typically a file has
an original location, a date it was removed etc.

Just to illustrate: I created a file "testing_2.txt" and put it in
trash from the regular gui.

Now if I look in the folder from DOS it looks like this:

Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05

2006-11-22 09:08 0 Dc12466.txt
2006-02-13 14:13 2 180 hello_world.log

Or using Cygwin "ls -lh"
total 9.0K
-rwx------+ 1 per None 0 Nov 22 09:08 Dc12466.txt
-rwx------+ 1 per None 820 Nov 22 09:08 INFO2
-rwx------+ 1 per None 65 Nov 1 11:42 desktop.ini
-rwx------+ 1 per None 2.2K Feb 13 2006 hello_world.log

The file INFO2 seems to contain the info I need to integrate

>type INFO2
♣ u☺ ▒0 ♥ æö♀☺C:\Documents and
Settings\per\Desktop\testing_2.txt

♫╟☺ C : \ D o c u m e n t s a n d S e t t i n g s \ p e r
\ D e s k t o p \ t e s t i n g _ 2 . t x t

My ultimate goal would be a bat-file (f.x. foobar.bat) in my bin-folder
looking something like this:
move /Y %* C:\RECYCLER\S-1-5-21-*NUMBERS*05
That integrates with the regular trashcan. Being able to restore later
is my goal.

Is there perhaps some other exe-file that is run when a user presses
the "delete" button in a regular folder view? and/or generates the info
in INFO2?

Thanks,
Per


Wesley Vogel wrote:
> Move
> Moves one or more files from one directory to the specified directory.
>
> Type in a command prompt: Move /?
>
> More Move HELP.
> Paste the following line into Start | Run and click OK...
>
> hh ntcmds.chm::/move.htm
>
> Each hard disk or partition contains a hidden folder named Recycler. The
> Recycler folder is used only on NTFS partitions. On FAT32 the RECYCLED
> folder is used. The Recycler folder contains a Recycle Bin for each user
> that logs on to the computer, sorted by their security identifier (SID).
>
> My hard drive is formatted NTFS.
>
> This is MY SID #
> S-1-5-21-1708537768-15xx36667-1202660629-1003
>
> This is MY Recycle Bin
> C:\RECYCLER\S-1-5-21-1708537768-15xx36667-1202660629-1003
>
> Your Recycle Bin would be similar, but you need to know your SID #.
>
> This registry key lists all of the SIDs.
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
>
> To tell which user has which SID, click on each SID, look at
> ProfileImagePath, the Data has the user name at the end of the path. I.e.
> %SystemDrive%\Documents and Settings\Wesley P. Vogel
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In news:1164105114.755437.96400@j44g2000cwa.googlegro ups.com,
> per9000 <per9000******.com> hunted and pecked:
> > Hi all,
> >
> > I work a lot in windows from the command line. I'd like to be able to,
> > instead of only deleting a file (f.x. "del *.tmp") be able to move it
> > to the trashcan.
> >
> > I could just move to C:\MyTrashCan, but I'd like it to be able to
> > browse, and preferably replace files later with the standard trash can
> > view.
> >
> > Thanks,
> > Per

The file is renamed + the info is generated in InFO2 file.
http://support.microsoft.com/kb/136517

--
Ayush [ Be ''?'' Happy ]
-------------
Search - www.Google.com | Wikipedia - http://en.wikipedia.org
Snip your long urls - http://snipurl.com/
-------------


Replid to [per9000]s message :
-----------------------------------------------------------
> Hi Wesley,
>
> yes, indeed this seems to move files to the trashcan-folder. From the
> command line I can now see the file (I emptied the trashcan so it was
> empty before I put hello_world.log in there)
>
> ...
> Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05
>
> 2006-02-13 14:13 2 180 hello_world.log
> 1 File(s) 2 180 bytes
> ...
>
> But when I look in the trashcan using the standard GUI I cannot see
> the file in there. The trashcan looks as if is empty.
>
> Also, I'd like to be able to restore the files put in the trashcan
> (even if I put them there from the command line). Typically a file has
> an original location, a date it was removed etc.
>
> Just to illustrate: I created a file "testing_2.txt" and put it in
> trash from the regular gui.
>
> Now if I look in the folder from DOS it looks like this:
>
> Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05
>
> 2006-11-22 09:08 0 Dc12466.txt
> 2006-02-13 14:13 2 180 hello_world.log
>
> Or using Cygwin "ls -lh"
> total 9.0K
> -rwx------+ 1 per None 0 Nov 22 09:08 Dc12466.txt
> -rwx------+ 1 per None 820 Nov 22 09:08 INFO2
> -rwx------+ 1 per None 65 Nov 1 11:42 desktop.ini
> -rwx------+ 1 per None 2.2K Feb 13 2006 hello_world.log
>
> The file INFO2 seems to contain the info I need to integrate
>
>> type INFO2
> ? u? ?0 ? æö??C:\Documents and
> Settings\per\Desktop\testing_2.txt
>
> ??? C : \ D o c u m e n t s a n d S e t t i n g s \ p e r
> \ D e s k t o p \ t e s t i n g _ 2 . t x t
>
> My ultimate goal would be a bat-file (f.x. foobar.bat) in my
> bin-folder looking something like this:
> move /Y %* C:\RECYCLER\S-1-5-21-*NUMBERS*05
> That integrates with the regular trashcan. Being able to restore later
> is my goal.
>
> Is there perhaps some other exe-file that is run when a user presses
> the "delete" button in a regular folder view? and/or generates the
> info in INFO2?
>
> Thanks,
> Per
>
>
> Wesley Vogel wrote:
>> Move
>> Moves one or more files from one directory to the specified
>> directory.
>>
>> Type in a command prompt: Move /?
>>
>> More Move HELP.
>> Paste the following line into Start | Run and click OK...
>>
>> hh ntcmds.chm::/move.htm
>>
>> Each hard disk or partition contains a hidden folder named Recycler.
>> The Recycler folder is used only on NTFS partitions. On FAT32 the
>> RECYCLED folder is used. The Recycler folder contains a Recycle Bin
>> for each user that logs on to the computer, sorted by their security
>> identifier (SID).
>>
>> My hard drive is formatted NTFS.
>>
>> This is MY SID #
>> S-1-5-21-1708537768-15xx36667-1202660629-1003
>>
>> This is MY Recycle Bin
>> C:\RECYCLER\S-1-5-21-1708537768-15xx36667-1202660629-1003
>>
>> Your Recycle Bin would be similar, but you need to know your SID #.
>>
>> This registry key lists all of the SIDs.
>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
>> NT\CurrentVersion\ProfileList
>>
>> To tell which user has which SID, click on each SID, look at
>> ProfileImagePath, the Data has the user name at the end of the path.
>> I.e. %SystemDrive%\Documents and Settings\Wesley P. Vogel
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news:1164105114.755437.96400@j44g2000cwa.googlegro ups.com,
>> per9000 <per9000******.com> hunted and pecked:
>>> Hi all,
>>>
>>> I work a lot in windows from the command line. I'd like to be able
>>> to, instead of only deleting a file (f.x. "del *.tmp") be able to
>>> move it to the trashcan.
>>>
>>> I could just move to C:\MyTrashCan, but I'd like it to be able to
>>> browse, and preferably replace files later with the standard trash
>>> can view.
>>>
>>> Thanks,
>>> Per

The file is renamed + the info is generated in InFO2 file.
http://support.microsoft.com/kb/136517

--
Ayush [ Be ''?'' Happy ]
-------------
Search - www.Google.com | Wikipedia - http://en.wikipedia.org
Snip your long urls - http://snipurl.com/
-------------


Replid to [per9000]s message :
-----------------------------------------------------------
> Hi Wesley,
>
> yes, indeed this seems to move files to the trashcan-folder. From the
> command line I can now see the file (I emptied the trashcan so it was
> empty before I put hello_world.log in there)
>
> ...
> Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05
>
> 2006-02-13 14:13 2 180 hello_world.log
> 1 File(s) 2 180 bytes
> ...
>
> But when I look in the trashcan using the standard GUI I cannot see
> the file in there. The trashcan looks as if is empty.
>
> Also, I'd like to be able to restore the files put in the trashcan
> (even if I put them there from the command line). Typically a file has
> an original location, a date it was removed etc.
>
> Just to illustrate: I created a file "testing_2.txt" and put it in
> trash from the regular gui.
>
> Now if I look in the folder from DOS it looks like this:
>
> Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05
>
> 2006-11-22 09:08 0 Dc12466.txt
> 2006-02-13 14:13 2 180 hello_world.log
>
> Or using Cygwin "ls -lh"
> total 9.0K
> -rwx------+ 1 per None 0 Nov 22 09:08 Dc12466.txt
> -rwx------+ 1 per None 820 Nov 22 09:08 INFO2
> -rwx------+ 1 per None 65 Nov 1 11:42 desktop.ini
> -rwx------+ 1 per None 2.2K Feb 13 2006 hello_world.log
>
> The file INFO2 seems to contain the info I need to integrate
>
>> type INFO2
> ? u? ?0 ? æö??C:\Documents and
> Settings\per\Desktop\testing_2.txt
>
> ??? C : \ D o c u m e n t s a n d S e t t i n g s \ p e r
> \ D e s k t o p \ t e s t i n g _ 2 . t x t
>
> My ultimate goal would be a bat-file (f.x. foobar.bat) in my
> bin-folder looking something like this:
> move /Y %* C:\RECYCLER\S-1-5-21-*NUMBERS*05
> That integrates with the regular trashcan. Being able to restore later
> is my goal.
>
> Is there perhaps some other exe-file that is run when a user presses
> the "delete" button in a regular folder view? and/or generates the
> info in INFO2?
>
> Thanks,
> Per
>
>
> Wesley Vogel wrote:
>> Move
>> Moves one or more files from one directory to the specified
>> directory.
>>
>> Type in a command prompt: Move /?
>>
>> More Move HELP.
>> Paste the following line into Start | Run and click OK...
>>
>> hh ntcmds.chm::/move.htm
>>
>> Each hard disk or partition contains a hidden folder named Recycler.
>> The Recycler folder is used only on NTFS partitions. On FAT32 the
>> RECYCLED folder is used. The Recycler folder contains a Recycle Bin
>> for each user that logs on to the computer, sorted by their security
>> identifier (SID).
>>
>> My hard drive is formatted NTFS.
>>
>> This is MY SID #
>> S-1-5-21-1708537768-15xx36667-1202660629-1003
>>
>> This is MY Recycle Bin
>> C:\RECYCLER\S-1-5-21-1708537768-15xx36667-1202660629-1003
>>
>> Your Recycle Bin would be similar, but you need to know your SID #.
>>
>> This registry key lists all of the SIDs.
>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
>> NT\CurrentVersion\ProfileList
>>
>> To tell which user has which SID, click on each SID, look at
>> ProfileImagePath, the Data has the user name at the end of the path.
>> I.e. %SystemDrive%\Documents and Settings\Wesley P. Vogel
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news:1164105114.755437.96400@j44g2000cwa.googlegro ups.com,
>> per9000 <per9000******.com> hunted and pecked:
>>> Hi all,
>>>
>>> I work a lot in windows from the command line. I'd like to be able
>>> to, instead of only deleting a file (f.x. "del *.tmp") be able to
>>> move it to the trashcan.
>>>
>>> I could just move to C:\MyTrashCan, but I'd like it to be able to
>>> browse, and preferably replace files later with the standard trash
>>> can view.
>>>
>>> Thanks,
>>> Per

Hi Per,

When you delete a file, the complete path and file name is stored in a
hidden file called Info2 in the Recycler folder.

for example, Dc12466.txt

D means Deleted.
c means the dile was deleted from the C: drive.
12466 means it was the 12466th deleted file.
txt means it was a text file, probably testing_2.txt

I wonder why the high number, 12466? INFO2 messed up?

If I paste this into the Run command (Start | Run ) and click OK
C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003\info2
the Open With applet comes up.
Select Notepad and click OK or just double click on Notepad from the list.
INFO2 opens.

Or you can do this in a command prompt...

start C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003\info2

the Open With applet comes up.
Select Notepad and click OK or just double click on Notepad from the list.
INFO2 opens.

This what's in my INFO2...
C:\Documents and Settings\Wesley P. Vogel\Desktop\278startmenupin.reg

C : \ D o c u m e n t s a n d S e t t i n g s \ W e s l e y P . V o
g e l \ D e s k t o p \ 2 7 8 s t a r t m e n u p i n . r e g

C:\Documents and Settings\Wesley P. Vogel\Desktop\startmenupin.reg

C : \ D o c u m e n t s a n d S e t t i n g s \ W e s l e y P . V o
g e l \ D e s k t o p \ s t a r t m e n u p i n . r e g

C:\Documents and Settings\Wesley P. Vogel\Desktop\pinlistenable.reg

C : \ D o c u m e n t s a n d S e t t i n g s \ W e s l e y P . V o
g e l \ D e s k t o p \ p i n l i s t e n a b l e . r e g

C:\Documents and Settings\Wesley P. Vogel\Desktop\New Text Document.txt

C : \ D o c u m e n t s a n d S e t t i n g s \ W e s l e y P . V o
g e l \ D e s k t o p \ N e w T e x t D o c u m e n t . t x t
------------

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\>cd C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003

C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003>dir
Volume in drive C is Local Disk
Volume Serial Number is 901E-9F82

Directory of C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003

22-Nov-06 10:46 AM 1,454 Dc1.reg
22-Nov-06 10:43 AM 1,454 Dc2.reg
22-Nov-06 10:45 AM 161 Dc3.reg
22-Nov-06 11:42 AM 0 Dc4.txt
4 File(s) 3,069 bytes
0 Dir(s) 2,128,506,880 bytes free

C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003>
--------------

You can see how Dc1.reg, Dc2.reg, Dc3.reg and Dc4.txt relate to
278startmenupin.reg, startmenupin.reg, pinlistenable.reg and New Text
Document.txt.

> Also, I'd like to be able to restore the files put in the trashcan
> (even if I put them there from the command line).

Would probably be some sort of a Shell function or call. I have no idea
which one and am not going to go look. Most of that stuff is over my head.

> But when I look in the trashcan using the standard GUI I cannot see the
> file in there. The trashcan looks as if is empty.

[[No files may appear in the Recycle Bin if the files in the Recycled folder
are damaged.]]

Run chkdsk. Reboot. Look at the Recycle Bin again.

INFO2 can become corrupted and if it cannot be fixed it needs to be deleted.

Cannot Delete Any Files in Windows
http://support.microsoft.com/kb/246726

How the Recycle Bin Stores Files
http://support.microsoft.com/kb/136517

> Is there perhaps some other exe-file that is run when a user presses
> the "delete" button in a regular folder view? and/or generates the info
> in INFO2?

My silly wild a** guess would be explorer.exe and shell32.dll.

I just found this one, looks interesting haven't read it yet.

Forensic Analysis of Microsoft Windows Recycle Bin Records
http://www.e-fense.com/helix/Docs/Re...nstruction.pdf
or view as html
http://72.14.253.104/search?q=cache:...s&ct=clnk&cd=2


--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:1164183657.335836.260370@f16g2000cwb.googlegr oups.com,
per9000 <per9000******.com> hunted and pecked:
> Hi Wesley,
>
> yes, indeed this seems to move files to the trashcan-folder. From the
> command line I can now see the file (I emptied the trashcan so it was
> empty before I put hello_world.log in there)
>
> ...
> Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05
>
> 2006-02-13 14:13 2 180 hello_world.log
> 1 File(s) 2 180 bytes
> ...
>
> But when I look in the trashcan using the standard GUI I cannot see the
> file in there. The trashcan looks as if is empty.
>
> Also, I'd like to be able to restore the files put in the trashcan
> (even if I put them there from the command line). Typically a file has
> an original location, a date it was removed etc.
>
> Just to illustrate: I created a file "testing_2.txt" and put it in
> trash from the regular gui.
>
> Now if I look in the folder from DOS it looks like this:
>
> Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05
>
> 2006-11-22 09:08 0 Dc12466.txt
> 2006-02-13 14:13 2 180 hello_world.log
>
> Or using Cygwin "ls -lh"
> total 9.0K
> -rwx------+ 1 per None 0 Nov 22 09:08 Dc12466.txt
> -rwx------+ 1 per None 820 Nov 22 09:08 INFO2
> -rwx------+ 1 per None 65 Nov 1 11:42 desktop.ini
> -rwx------+ 1 per None 2.2K Feb 13 2006 hello_world.log
>
> The file INFO2 seems to contain the info I need to integrate
>
>> type INFO2
> ♣ u☺ ▒0 ♥ æö♀☺C:\Documents and
> Settings\per\Desktop\testing_2.txt
>
> ♫╟☺ C : \ D o c u m e n t s a n d S e t t i n g s \ p e r
> \ D e s k t o p \ t e s t i n g _ 2 . t x t
>
> My ultimate goal would be a bat-file (f.x. foobar.bat) in my bin-folder
> looking something like this:
> move /Y %* C:\RECYCLER\S-1-5-21-*NUMBERS*05
> That integrates with the regular trashcan. Being able to restore later
> is my goal.
>
> Is there perhaps some other exe-file that is run when a user presses
> the "delete" button in a regular folder view? and/or generates the info
> in INFO2?
>
> Thanks,
> Per
>
>
> Wesley Vogel wrote:
>> Move
>> Moves one or more files from one directory to the specified directory.
>>
>> Type in a command prompt: Move /?
>>
>> More Move HELP.
>> Paste the following line into Start | Run and click OK...
>>
>> hh ntcmds.chm::/move.htm
>>
>> Each hard disk or partition contains a hidden folder named Recycler. The
>> Recycler folder is used only on NTFS partitions. On FAT32 the RECYCLED
>> folder is used. The Recycler folder contains a Recycle Bin for each user
>> that logs on to the computer, sorted by their security identifier (SID).
>>
>> My hard drive is formatted NTFS.
>>
>> This is MY SID #
>> S-1-5-21-1708537768-15xx36667-1202660629-1003
>>
>> This is MY Recycle Bin
>> C:\RECYCLER\S-1-5-21-1708537768-15xx36667-1202660629-1003
>>
>> Your Recycle Bin would be similar, but you need to know your SID #.
>>
>> This registry key lists all of the SIDs.
>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
>> NT\CurrentVersion\ProfileList
>>
>> To tell which user has which SID, click on each SID, look at
>> ProfileImagePath, the Data has the user name at the end of the path.
>> I.e. %SystemDrive%\Documents and Settings\Wesley P. Vogel
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news:1164105114.755437.96400@j44g2000cwa.googlegro ups.com,
>> per9000 <per9000******.com> hunted and pecked:
>>> Hi all,
>>>
>>> I work a lot in windows from the command line. I'd like to be able to,
>>> instead of only deleting a file (f.x. "del *.tmp") be able to move it
>>> to the trashcan.
>>>
>>> I could just move to C:\MyTrashCan, but I'd like it to be able to
>>> browse, and preferably replace files later with the standard trash can
>>> view.
>>>
>>> Thanks,
>>> Per

Hi Per,

When you delete a file, the complete path and file name is stored in a
hidden file called Info2 in the Recycler folder.

for example, Dc12466.txt

D means Deleted.
c means the dile was deleted from the C: drive.
12466 means it was the 12466th deleted file.
txt means it was a text file, probably testing_2.txt

I wonder why the high number, 12466? INFO2 messed up?

If I paste this into the Run command (Start | Run ) and click OK
C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003\info2
the Open With applet comes up.
Select Notepad and click OK or just double click on Notepad from the list.
INFO2 opens.

Or you can do this in a command prompt...

start C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003\info2

the Open With applet comes up.
Select Notepad and click OK or just double click on Notepad from the list.
INFO2 opens.

This what's in my INFO2...
C:\Documents and Settings\Wesley P. Vogel\Desktop\278startmenupin.reg

C : \ D o c u m e n t s a n d S e t t i n g s \ W e s l e y P . V o
g e l \ D e s k t o p \ 2 7 8 s t a r t m e n u p i n . r e g

C:\Documents and Settings\Wesley P. Vogel\Desktop\startmenupin.reg

C : \ D o c u m e n t s a n d S e t t i n g s \ W e s l e y P . V o
g e l \ D e s k t o p \ s t a r t m e n u p i n . r e g

C:\Documents and Settings\Wesley P. Vogel\Desktop\pinlistenable.reg

C : \ D o c u m e n t s a n d S e t t i n g s \ W e s l e y P . V o
g e l \ D e s k t o p \ p i n l i s t e n a b l e . r e g

C:\Documents and Settings\Wesley P. Vogel\Desktop\New Text Document.txt

C : \ D o c u m e n t s a n d S e t t i n g s \ W e s l e y P . V o
g e l \ D e s k t o p \ N e w T e x t D o c u m e n t . t x t
------------

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\>cd C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003

C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003>dir
Volume in drive C is Local Disk
Volume Serial Number is 901E-9F82

Directory of C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003

22-Nov-06 10:46 AM 1,454 Dc1.reg
22-Nov-06 10:43 AM 1,454 Dc2.reg
22-Nov-06 10:45 AM 161 Dc3.reg
22-Nov-06 11:42 AM 0 Dc4.txt
4 File(s) 3,069 bytes
0 Dir(s) 2,128,506,880 bytes free

C:\RECYCLER\S-1-5-21-1708537768-1580436667-1202660629-1003>
--------------

You can see how Dc1.reg, Dc2.reg, Dc3.reg and Dc4.txt relate to
278startmenupin.reg, startmenupin.reg, pinlistenable.reg and New Text
Document.txt.

> Also, I'd like to be able to restore the files put in the trashcan
> (even if I put them there from the command line).

Would probably be some sort of a Shell function or call. I have no idea
which one and am not going to go look. Most of that stuff is over my head.

> But when I look in the trashcan using the standard GUI I cannot see the
> file in there. The trashcan looks as if is empty.

[[No files may appear in the Recycle Bin if the files in the Recycled folder
are damaged.]]

Run chkdsk. Reboot. Look at the Recycle Bin again.

INFO2 can become corrupted and if it cannot be fixed it needs to be deleted.

Cannot Delete Any Files in Windows
http://support.microsoft.com/kb/246726

How the Recycle Bin Stores Files
http://support.microsoft.com/kb/136517

> Is there perhaps some other exe-file that is run when a user presses
> the "delete" button in a regular folder view? and/or generates the info
> in INFO2?

My silly wild a** guess would be explorer.exe and shell32.dll.

I just found this one, looks interesting haven't read it yet.

Forensic Analysis of Microsoft Windows Recycle Bin Records
http://www.e-fense.com/helix/Docs/Re...nstruction.pdf
or view as html
http://72.14.253.104/search?q=cache:...s&ct=clnk&cd=2


--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:1164183657.335836.260370@f16g2000cwb.googlegr oups.com,
per9000 <per9000******.com> hunted and pecked:
> Hi Wesley,
>
> yes, indeed this seems to move files to the trashcan-folder. From the
> command line I can now see the file (I emptied the trashcan so it was
> empty before I put hello_world.log in there)
>
> ...
> Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05
>
> 2006-02-13 14:13 2 180 hello_world.log
> 1 File(s) 2 180 bytes
> ...
>
> But when I look in the trashcan using the standard GUI I cannot see the
> file in there. The trashcan looks as if is empty.
>
> Also, I'd like to be able to restore the files put in the trashcan
> (even if I put them there from the command line). Typically a file has
> an original location, a date it was removed etc.
>
> Just to illustrate: I created a file "testing_2.txt" and put it in
> trash from the regular gui.
>
> Now if I look in the folder from DOS it looks like this:
>
> Directory of C:\RECYCLER\S-1-5-21-*NUMBERS*05
>
> 2006-11-22 09:08 0 Dc12466.txt
> 2006-02-13 14:13 2 180 hello_world.log
>
> Or using Cygwin "ls -lh"
> total 9.0K
> -rwx------+ 1 per None 0 Nov 22 09:08 Dc12466.txt
> -rwx------+ 1 per None 820 Nov 22 09:08 INFO2
> -rwx------+ 1 per None 65 Nov 1 11:42 desktop.ini
> -rwx------+ 1 per None 2.2K Feb 13 2006 hello_world.log
>
> The file INFO2 seems to contain the info I need to integrate
>
>> type INFO2
> ♣ u☺ ▒0 ♥ æö♀☺C:\Documents and
> Settings\per\Desktop\testing_2.txt
>
> ♫╟☺ C : \ D o c u m e n t s a n d S e t t i n g s \ p e r
> \ D e s k t o p \ t e s t i n g _ 2 . t x t
>
> My ultimate goal would be a bat-file (f.x. foobar.bat) in my bin-folder
> looking something like this:
> move /Y %* C:\RECYCLER\S-1-5-21-*NUMBERS*05
> That integrates with the regular trashcan. Being able to restore later
> is my goal.
>
> Is there perhaps some other exe-file that is run when a user presses
> the "delete" button in a regular folder view? and/or generates the info
> in INFO2?
>
> Thanks,
> Per
>
>
> Wesley Vogel wrote:
>> Move
>> Moves one or more files from one directory to the specified directory.
>>
>> Type in a command prompt: Move /?
>>
>> More Move HELP.
>> Paste the following line into Start | Run and click OK...
>>
>> hh ntcmds.chm::/move.htm
>>
>> Each hard disk or partition contains a hidden folder named Recycler. The
>> Recycler folder is used only on NTFS partitions. On FAT32 the RECYCLED
>> folder is used. The Recycler folder contains a Recycle Bin for each user
>> that logs on to the computer, sorted by their security identifier (SID).
>>
>> My hard drive is formatted NTFS.
>>
>> This is MY SID #
>> S-1-5-21-1708537768-15xx36667-1202660629-1003
>>
>> This is MY Recycle Bin
>> C:\RECYCLER\S-1-5-21-1708537768-15xx36667-1202660629-1003
>>
>> Your Recycle Bin would be similar, but you need to know your SID #.
>>
>> This registry key lists all of the SIDs.
>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
>> NT\CurrentVersion\ProfileList
>>
>> To tell which user has which SID, click on each SID, look at
>> ProfileImagePath, the Data has the user name at the end of the path.
>> I.e. %SystemDrive%\Documents and Settings\Wesley P. Vogel
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news:1164105114.755437.96400@j44g2000cwa.googlegro ups.com,
>> per9000 <per9000******.com> hunted and pecked:
>>> Hi all,
>>>
>>> I work a lot in windows from the command line. I'd like to be able to,
>>> instead of only deleting a file (f.x. "del *.tmp") be able to move it
>>> to the trashcan.
>>>
>>> I could just move to C:\MyTrashCan, but I'd like it to be able to
>>> browse, and preferably replace files later with the standard trash can
>>> view.
>>>
>>> Thanks,
>>> Per

Hi Wesley,


> When you delete a file, the complete path and file name is stored in a
> hidden file called Info2 in the Recycler folder.

Ok, I suspected something like that.


> I wonder why the high number, 12466? INFO2 messed up?

I create tons of log files at work (most of which I just delete - these
are the ones I'd like to put in the trash instead of hard-killing
them). Probably that's why I have the large number.

I'll try to avoid hacking INFO2 - but I am tempted :)


> > Also, I'd like to be able to restore the files put in the trashcan
> > (even if I put them there from the command line).
>
> Would probably be some sort of a Shell function or call. I have no idea
> which one and am not going to go look. Most of that stuff is over my head.

Ok, that's too bad - I was hoping for some way to '"press the delete
button in the gui" from the console'.


> > But when I look in the trashcan using the standard GUI I cannot see the
> > file in there. The trashcan looks as if is empty.
>
> [[No files may appear in the Recycle Bin if the files in the Recycled folder
> are damaged.]]
>

This was probably an artifact from
move /Y *.* C:\RECYCLER\*numbers*

I put a file in there from the console - I could not see the file from
the trashcan view. Probably because there was no info of it in INFO2. I
removed the file from the console and now the trashcan seems healthy.


> Forensic Analysis of Microsoft Windows Recycle Bin Records
> http://www.e-fense.com/helix/Docs/Re...nstruction.pdf

Seems interesting - but I don't want to risk a trash-can-crash by
hacking INFO2. I was looking for some exe/dll-file to call to do the
dirty work for me.


> Hope this helps. Let us know.

Well, it didn't solve my "problem" but it explained a lot. Thanks.

/Per

Hi Wesley,


> When you delete a file, the complete path and file name is stored in a
> hidden file called Info2 in the Recycler folder.

Ok, I suspected something like that.


> I wonder why the high number, 12466? INFO2 messed up?

I create tons of log files at work (most of which I just delete - these
are the ones I'd like to put in the trash instead of hard-killing
them). Probably that's why I have the large number.

I'll try to avoid hacking INFO2 - but I am tempted :)


> > Also, I'd like to be able to restore the files put in the trashcan
> > (even if I put them there from the command line).
>
> Would probably be some sort of a Shell function or call. I have no idea
> which one and am not going to go look. Most of that stuff is over my head.

Ok, that's too bad - I was hoping for some way to '"press the delete
button in the gui" from the console'.


> > But when I look in the trashcan using the standard GUI I cannot see the
> > file in there. The trashcan looks as if is empty.
>
> [[No files may appear in the Recycle Bin if the files in the Recycled folder
> are damaged.]]
>

This was probably an artifact from
move /Y *.* C:\RECYCLER\*numbers*

I put a file in there from the console - I could not see the file from
the trashcan view. Probably because there was no info of it in INFO2. I
removed the file from the console and now the trashcan seems healthy.


> Forensic Analysis of Microsoft Windows Recycle Bin Records
> http://www.e-fense.com/helix/Docs/Re...nstruction.pdf

Seems interesting - but I don't want to risk a trash-can-crash by
hacking INFO2. I was looking for some exe/dll-file to call to do the
dirty work for me.


> Hope this helps. Let us know.

Well, it didn't solve my "problem" but it explained a lot. Thanks.

/Per

Howdy Per,

> Ok, that's too bad - I was hoping for some way to '"press the delete
> button in the gui" from the console'.

I believe that the del command is the same as hitting Shift + Delete on the
keyboard.

Warning
After you delete a file from your disk using del, you cannot retrieve it.

Type in Start | Run
hh ntcmds.chm::/del.htm

SHIFT+DELETE
Delete selected item permanently without placing the item in the Recycle
Bin.

To permanently delete a file, press and hold down SHIFT and drag it to the
Recycle Bin. The item is permanently deleted and cannot be retrieved from
the Recycle Bin.

> This was probably an artifact from
> move /Y *.* C:\RECYCLER\*numbers*
>
> I put a file in there from the console - I could not see the file from
> the trashcan view. Probably because there was no info of it in INFO2. I
> removed the file from the console and now the trashcan seems healthy.

That would explain it.

You ought to buy a mouse. That right click is the latest thing. ;-)

You might use a VBS script, see...
To delete a text file and send it to the Recycle Bin
here...
How to: Delete a File in Visual Basic
http://msdn2.microsoft.com/en-gb/lib...4b(VS.80).aspx

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:1164271799.736422.75460@k70g2000cwa.googlegro ups.com,
per9000 <per9000******.com> hunted and pecked:
> Hi Wesley,
>
>
>> When you delete a file, the complete path and file name is stored in a
>> hidden file called Info2 in the Recycler folder.
>
> Ok, I suspected something like that.
>
>
>> I wonder why the high number, 12466? INFO2 messed up?
>
> I create tons of log files at work (most of which I just delete - these
> are the ones I'd like to put in the trash instead of hard-killing
> them). Probably that's why I have the large number.
>
> I'll try to avoid hacking INFO2 - but I am tempted :)
>
>
>>> Also, I'd like to be able to restore the files put in the trashcan
>>> (even if I put them there from the command line).
>>
>> Would probably be some sort of a Shell function or call. I have no idea
>> which one and am not going to go look. Most of that stuff is over my
>> head.
>
> Ok, that's too bad - I was hoping for some way to '"press the delete
> button in the gui" from the console'.
>
>
>>> But when I look in the trashcan using the standard GUI I cannot see the
>>> file in there. The trashcan looks as if is empty.
>>
>> [[No files may appear in the Recycle Bin if the files in the Recycled
>> folder are damaged.]]
>>
>
> This was probably an artifact from
> move /Y *.* C:\RECYCLER\*numbers*
>
> I put a file in there from the console - I could not see the file from
> the trashcan view. Probably because there was no info of it in INFO2. I
> removed the file from the console and now the trashcan seems healthy.
>
>
>> Forensic Analysis of Microsoft Windows Recycle Bin Records
>> http://www.e-fense.com/helix/Docs/Re...nstruction.pdf
>
> Seems interesting - but I don't want to risk a trash-can-crash by
> hacking INFO2. I was looking for some exe/dll-file to call to do the
> dirty work for me.
>
>
>> Hope this helps. Let us know.
>
> Well, it didn't solve my "problem" but it explained a lot. Thanks.
>
> /Per

Howdy Per,

> Ok, that's too bad - I was hoping for some way to '"press the delete
> button in the gui" from the console'.

I believe that the del command is the same as hitting Shift + Delete on the
keyboard.

Warning
After you delete a file from your disk using del, you cannot retrieve it.

Type in Start | Run
hh ntcmds.chm::/del.htm

SHIFT+DELETE
Delete selected item permanently without placing the item in the Recycle
Bin.

To permanently delete a file, press and hold down SHIFT and drag it to the
Recycle Bin. The item is permanently deleted and cannot be retrieved from
the Recycle Bin.

> This was probably an artifact from
> move /Y *.* C:\RECYCLER\*numbers*
>
> I put a file in there from the console - I could not see the file from
> the trashcan view. Probably because there was no info of it in INFO2. I
> removed the file from the console and now the trashcan seems healthy.

That would explain it.

You ought to buy a mouse. That right click is the latest thing. ;-)

You might use a VBS script, see...
To delete a text file and send it to the Recycle Bin
here...
How to: Delete a File in Visual Basic
http://msdn2.microsoft.com/en-gb/lib...4b(VS.80).aspx

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:1164271799.736422.75460@k70g2000cwa.googlegro ups.com,
per9000 <per9000******.com> hunted and pecked:
> Hi Wesley,
>
>
>> When you delete a file, the complete path and file name is stored in a
>> hidden file called Info2 in the Recycler folder.
>
> Ok, I suspected something like that.
>
>
>> I wonder why the high number, 12466? INFO2 messed up?
>
> I create tons of log files at work (most of which I just delete - these
> are the ones I'd like to put in the trash instead of hard-killing
> them). Probably that's why I have the large number.
>
> I'll try to avoid hacking INFO2 - but I am tempted :)
>
>
>>> Also, I'd like to be able to restore the files put in the trashcan
>>> (even if I put them there from the command line).
>>
>> Would probably be some sort of a Shell function or call. I have no idea
>> which one and am not going to go look. Most of that stuff is over my
>> head.
>
> Ok, that's too bad - I was hoping for some way to '"press the delete
> button in the gui" from the console'.
>
>
>>> But when I look in the trashcan using the standard GUI I cannot see the
>>> file in there. The trashcan looks as if is empty.
>>
>> [[No files may appear in the Recycle Bin if the files in the Recycled
>> folder are damaged.]]
>>
>
> This was probably an artifact from
> move /Y *.* C:\RECYCLER\*numbers*
>
> I put a file in there from the console - I could not see the file from
> the trashcan view. Probably because there was no info of it in INFO2. I
> removed the file from the console and now the trashcan seems healthy.
>
>
>> Forensic Analysis of Microsoft Windows Recycle Bin Records
>> http://www.e-fense.com/helix/Docs/Re...nstruction.pdf
>
> Seems interesting - but I don't want to risk a trash-can-crash by
> hacking INFO2. I was looking for some exe/dll-file to call to do the
> dirty work for me.
>
>
>> Hope this helps. Let us know.
>
> Well, it didn't solve my "problem" but it explained a lot. Thanks.
>
> /Per

Hi.

Wesley Vogel wrote:
> You ought to buy a mouse. That right click is the latest thing. ;-)

Mouse schmouse, me like qwerty :-D


>
> You might use a VBS script, see...
> To delete a text file and send it to the Recycle Bin
> here...
> How to: Delete a File in Visual Basic
> http://msdn2.microsoft.com/en-gb/lib...4b(VS.80).aspx
>
> --
> Hope this helps. Let us know.

Yes, that could be perfect (I always needed an excuse to learn Visual
Basic (but I would have thought I'd learn VB.NET before VBS)) so this
could be really excellent.

The key seems to be (in VB.NET):
My.Computer.FileSystem.DeleteFile("C:\test.txt", _
FileIO.UIOption.AllDialogs, FileIO.RecycleOption.SendToRecycleBin)

I'll try it out and tell you what happens - unless I make a bad loop...

Thanks,
Per

Hi.

Wesley Vogel wrote:
> You ought to buy a mouse. That right click is the latest thing. ;-)

Mouse schmouse, me like qwerty :-D


>
> You might use a VBS script, see...
> To delete a text file and send it to the Recycle Bin
> here...
> How to: Delete a File in Visual Basic
> http://msdn2.microsoft.com/en-gb/lib...4b(VS.80).aspx
>
> --
> Hope this helps. Let us know.

Yes, that could be perfect (I always needed an excuse to learn Visual
Basic (but I would have thought I'd learn VB.NET before VBS)) so this
could be really excellent.

The key seems to be (in VB.NET):
My.Computer.FileSystem.DeleteFile("C:\test.txt", _
FileIO.UIOption.AllDialogs, FileIO.RecycleOption.SendToRecycleBin)

I'll try it out and tell you what happens - unless I make a bad loop...

Thanks,
Per