# Recycle Bin $I/$R Files

In modern versions of Windows, when a file is deleted, it is sent to the Recycle Bin first. Under the hood this constitutes the creation of two unique files prepended by `$I` and `$R` and appended with the original file's extension such as:

* `$RMYY8AS.txt`
* `$IMYY8AS.txt`

The `$I` file contains information about the deleted file. The `$R` file contains the full contents of that deleted file.

## Analysis Value

{% content-ref url="../../artifacts-by-activity/account-activity/security-identifier" %}
[security-identifier](../../artifacts-by-activity/account-activity/security-identifier)
{% endcontent-ref %}

{% content-ref url="../../artifacts-by-activity/file-activity/file-path" %}
[file-path](../../artifacts-by-activity/file-activity/file-path)
{% endcontent-ref %}

{% content-ref url="../../artifacts-by-activity/file-activity/deletion" %}
[deletion](../../artifacts-by-activity/file-activity/deletion)
{% endcontent-ref %}

{% content-ref url="../../artifacts-by-activity/file-activity/size" %}
[size](../../artifacts-by-activity/file-activity/size)
{% endcontent-ref %}

## Operating System Availability

| Major Version | Support | Major Version | Support |
| ------------- | ------- | ------------- | ------- |
| Windows 11    | ✅       | Server 2019   | ✅       |
| Windows 10    | ✅       | Server 2016   | ✅       |
| Windows 8     | ✅       | Server 2012   | ✅       |
| Windows 7     | ✅       | Server 2008   | ✅       |
| Windows Vista | ✅       | Server 2003   | ❌       |
| Windows XP    | ❌       |               |         |

## Artifact Location(s)

* `C:\$Recycle.Bin\{USER_SID}`

## Artifact Parsers

* KAPE (Extraction and Parsing)
* [RBCmd](https://github.com/EricZimmerman/RBCmd)

## Artifact Interpretation

The presence of this artifact indicates that a file was deleted and sent to the recycle bin.

The user who deleted the file will have their SID shown as the parent directory for the `$I` and `$R` files, for example:

* `C:\$Recycle.Bin\S-1-5-21-3471133136-2963561160-3931775028-1000\$RMYY8AS.txt`
* `C:\$Recycle.Bin\S-1-5-21-3471133136-2963561160-3931775028-1000\$IMYY8AS.txt`

In this case, `S-1-5-21-3471133136-2963561160-3931775028-1000` is the User SID.

The `$R` file contains the full contents of the original deleted file.

The `$I` file contains the following data:

* Size of the original file
* Full path of the original file
* Deletion time and date
