> For the complete documentation index, see [llms.txt](https://psmths.gitbook.io/windows-forensics/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/filesystem-artifacts/recycle-bin-files.md).

# Recycle Bin $I/$R Files

In modern versions of Windows, when a file is deleted, it is sent to the Recycle Bin first. Under the hood this constitutes the creation of two unique files prepended by `$I` and `$R` and appended with the original file's extension such as:

* `$RMYY8AS.txt`
* `$IMYY8AS.txt`

The `$I` file contains information about the deleted file. The `$R` file contains the full contents of that deleted file.

## Analysis Value

{% content-ref url="/pages/LRJZQZsAd12i4mDfGwuK" %}
[Security Identifier](/windows-forensics/artifacts-by-activity/account-activity/security-identifier.md)
{% endcontent-ref %}

{% content-ref url="/pages/V3cDcDJogcr4slquHEzB" %}
[File Path](/windows-forensics/artifacts-by-activity/file-activity/file-path.md)
{% endcontent-ref %}

{% content-ref url="/pages/rmCTRMRp4lWv3ij2JpeD" %}
[File Deletion](/windows-forensics/artifacts-by-activity/file-activity/deletion.md)
{% endcontent-ref %}

{% content-ref url="/pages/nmru9qr1jF7O0ZoLkyQK" %}
[File Size](/windows-forensics/artifacts-by-activity/file-activity/size.md)
{% endcontent-ref %}

## Operating System Availability

| Major Version | Support | Major Version | Support |
| ------------- | ------- | ------------- | ------- |
| Windows 11    | ✅       | Server 2019   | ✅       |
| Windows 10    | ✅       | Server 2016   | ✅       |
| Windows 8     | ✅       | Server 2012   | ✅       |
| Windows 7     | ✅       | Server 2008   | ✅       |
| Windows Vista | ✅       | Server 2003   | ❌       |
| Windows XP    | ❌       |               |         |

## Artifact Location(s)

* `C:\$Recycle.Bin\{USER_SID}`

## Artifact Parsers

* KAPE (Extraction and Parsing)
* [RBCmd](https://github.com/EricZimmerman/RBCmd)

## Artifact Interpretation

The presence of this artifact indicates that a file was deleted and sent to the recycle bin.

The user who deleted the file will have their SID shown as the parent directory for the `$I` and `$R` files, for example:

* `C:\$Recycle.Bin\S-1-5-21-3471133136-2963561160-3931775028-1000\$RMYY8AS.txt`
* `C:\$Recycle.Bin\S-1-5-21-3471133136-2963561160-3931775028-1000\$IMYY8AS.txt`

In this case, `S-1-5-21-3471133136-2963561160-3931775028-1000` is the User SID.

The `$R` file contains the full contents of the original deleted file.

The `$I` file contains the following data:

* Size of the original file
* Full path of the original file
* Deletion time and date