How to use '$RECYCLE.BIN' to recover files?

Fri Jul 12 17:23:28 GMT 2024

On 2024年07月12日 10:33, Tom Legrady via Cygwin wrote:
> Using cygwin on Windows 11, I ran a command that was over-enthusiastic in 
> deleting files. Now files I would like to have are in the $RECYCLE.BIN, with 
> names like '$I0BEVIM.pdf'.
>> How can I restore these files' original name and path?

See:
	https://en.wikipedia.org/wiki/Trash_(computing)#Microsoft_Windows
	
	https://superuser.com/a/1736690
for low level details for Vista onwards: original file or directory hard linked 
in /proc/cygdrive/D/\$Recycle.Bin/S-1-5-21-*-*-*-UID/\$RXXXXXX.type and metadata 
saved in /proc/cygdrive/D/\$Recycle.Bin/S-1-5-21-*-*-*-UID/\$IXXXXXX.type where 
UID is often 1000 or 1001 with personal desktop local accounts, and you only 
have access to your own, unless elevated as admin, e.g.
$ ls -glort /proc/cygdrive/d/\$Recycle.Bin/S-1-5-21-*-*-*-1001/
total 3
-rwx------+ 1 129 Apr 2 2020 desktop.ini
drwxr-xr-x 1 0 Dec 12 2021 '$RVW0RM1'
-rw-r--r--+ 1 0 Oct 22 2023 '$RQWOLZK.ini-save'
-rwx------+ 1 254 Oct 22 2023 '$IQWOLZK.ini-save'
-rwx------+ 1 82 Oct 22 2023 '$IVW0RM1'
$ xxd -c8 -g8 /proc/cygdrive/d/\$Recycle.Bin/S-1-5-21-*-*-*-1001/\$IVW0RM1
00000000: 0200000000000000 ........	# header (le)
00000008: 0000000000000000 ........	# file size (le)
00000010: e04bc8060b05da01 .K......	# deleted time (le 100ns Windows)
00000018: 1b00000044003a00 ....D.:.	# path length(le 4) path (4+ UCS-2)
00000020: 5c00760061007200 \.v.a.r.
00000028: 5c00630061006300 \.c.a.c.
00000030: 680065005c007300 h.e.\.s.
00000038: 6500740075007000 e.t.u.p.
00000040: 5c00650074006300 \.e.t.c.
00000048: 5c0070006b006900 \.p.k.i.
00000050: 0000 ..
-- 
Take care. Thanks, Brian Inglis Calgary, Alberta, Canada
La perfection est atteinte Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter not when there is no more to add
mais lorsqu'il n'y a plus rien à retirer but when there is no more to cut
 -- Antoine de Saint-Exupéry