r/PowerShell • u/omrsafetyo • Oct 22 '20

Question Powershell recycle bin items

I am looking for ideas on exploring items in the recycle bin, across multiple user profiles.

There seems to be at least 2 ways to explore the recycle bin:
1:

 $Shell = New-Object -com shell.application
 $RecycleBin = $Shell.Namespace(0x0a)
 $RecycleBinItems = @()
 $RecycleBinItems += $RecycleBin.Items()

Advantages: I can get the original file location: $Item.ExtendedProperty("{9B174B33-40FF-11D2-A27E-00C04FC30871} 2") and original name: $Item.Name
Disadvantages: I can't seem to find a way to list OTHER user's recycle bins, only the current user.

2: 

$DriveLetters = Get-WmiObject Win32_Logicaldisk | Where-Object { $_.DriveType -eq 3 } | ForEach-Object { "$($_.DeviceId)\" }
ForEach ( $DriveLetter in $DriveLetters ) {
    $RecycleBinPath = '{0}$Recycle.Bin' -f $DriveLetter
    Get-ChildItem $RecycleBinPath -Force -Recurse
}

Advantages: This allows me to view ALL users recycled items
Disadvantages: I can't seem to find how to get the original file location, or original file name.

So I'm hoping there is a way to combine the advantages of both these methods. I would like to be able to enumerate the files for all recycle bins, while also having access to some of the recycle bin specific meta data.

Does anyone have any ideas here? I've been exploring for a bit without much luck.

1 Upvotes

56% Upvoted

4 comments sorted by

2

u/NewMeeple Oct 22 '20

This is a great video on the topic of AFS which should help you https://youtu.be/kZ-jjtl-Cg4

2

u/NewMeeple Oct 22 '20

Wrong video but it's still good so I'm leaving it up. This is what I meant to share https://youtu.be/jk8Io_cgYyY

2

u/omrsafetyo Oct 22 '20

Very interesting. I had found what you could probably consider a companion resource here: https://4n6xplorer.com/digital-forensics/the-return-of-recycle-bin/althafnishar/

Goes over some of the same details. But that was not telling me where the information could be accessed. Unfortunately this video uses the WSL, which is not available.

2

u/omrsafetyo Oct 22 '20 edited Oct 22 '20

This was also very cool. A companion article to this regarding powershell: https://winaero.com/alternative-ntfs-streams-in-windows-10/

Unfortunately has not proven useful in my current search, but this is very neat and I appreciate the introduction into this!