DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org ACC8538319C3
Message-ID: <20f87410-ef55-4106-9850-20aee54e0259@SystematicSW.ab.ca>
Date: Fri, 12 Jul 2024 11:23:28 -0600
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: How to use '$RECYCLE.BIN' to recover files?
Content-Language: en-CA
To: cygwin AT cygwin DOT com
References: <665b9323-b71b-4cf2-badf-bb82d7b5230b AT TomLegrady DOT com>
Autocrypt: addr=Brian DOT Inglis AT Shaw DOT ca; keydata=
 xjMEXopx9BYJKwYBBAHaRw8BAQdAPq8FIaW+Bz7xnfyJ1gHQyf2EZo5sAwSPy/bRAcLeWl/N
 I0JyaWFuIEluZ2xpcyA8QnJpYW4uSW5nbGlzQFNoYXcuY2E+wpYEExYIAD4WIQTG63sbl+cr
 2nyOuZiKvQKcH1E27wUCXopx9AIbAwUJCWYBgAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAK
 CRCKvQKcH1E276DmAP91Bt8kfJhKHYb9b2sao2fxwJFsl1GlRi516WKI0OkphQEA+ULITsPs
 blfzSq+GgI7q4LPfRfTLy4Oo3gorlnhnfgnOOAReinH0EgorBgEEAZdVAQUBAQdAepgIsLwm
 GQicfoIBaB9xHp63MQJqVCPbgPzESTg7EEwDAQgHwn0EGBYIACYWIQTG63sbl+cr2nyOuZiK
 vQKcH1E27wUCXopx9AIbDAUJCWYBgAAKCRCKvQKcH1E27+zoAP4u2ivMQBAqaMeLOilqRWgy
 nV2ATImz1p2v1H5P4kBiDwD3caPK1cxU5lijzuSDCjgtIpgF/avHbjA32fxJdIRwAA==
Organization: Systematic Software
In-Reply-To: <665b9323-b71b-4cf2-badf-bb82d7b5230b@TomLegrady.com>
Precedence: list
From: Brian Inglis via Cygwin <cygwin AT cygwin DOT com>
Reply-To: cygwin AT cygwin DOT com
Cc: Brian Inglis <Brian DOT Inglis AT SystematicSW DOT ab DOT ca>
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Errors-To: cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit

On 2024-07-12 10:33, Tom Legrady via Cygwin wrote:
> Using cygwin on Windows 11, I ran a command that was over-enthusiastic in 
> deleting files. Now files I would like to have are in the $RECYCLE.BIN, with 
> names like '$I0BEVIM.pdf'.
> 
> How can I restore these files' original name and path?

See:

	https://en.wikipedia.org/wiki/Trash_(computing)#Microsoft_Windows
	
	https://superuser.com/a/1736690

for low level details for Vista onwards: original file or directory hard linked 
in /proc/cygdrive/D/\$Recycle.Bin/S-1-5-21-*-*-*-UID/\$RXXXXXX.type and metadata 
saved in /proc/cygdrive/D/\$Recycle.Bin/S-1-5-21-*-*-*-UID/\$IXXXXXX.type where 
UID is often 1000 or 1001 with personal desktop local accounts, and you only 
have access to your own, unless elevated as admin, e.g.

$ ls -glort /proc/cygdrive/d/\$Recycle.Bin/S-1-5-21-*-*-*-1001/
total 3
-rwx------+ 1 129 Apr  2  2020  desktop.ini
drwxr-xr-x  1   0 Dec 12  2021 '$RVW0RM1'
-rw-r--r--+ 1   0 Oct 22  2023 '$RQWOLZK.ini-save'
-rwx------+ 1 254 Oct 22  2023 '$IQWOLZK.ini-save'
-rwx------+ 1  82 Oct 22  2023 '$IVW0RM1'
$ xxd -c8 -g8 /proc/cygdrive/d/\$Recycle.Bin/S-1-5-21-*-*-*-1001/\$IVW0RM1
00000000: 0200000000000000  ........	# header (le)
00000008: 0000000000000000  ........	# file size (le)
00000010: e04bc8060b05da01  .K......	# deleted time (le 100ns Windows)
00000018: 1b00000044003a00  ....D.:.	# path length(le 4) path (4+ UCS-2)
00000020: 5c00760061007200  \.v.a.r.
00000028: 5c00630061006300  \.c.a.c.
00000030: 680065005c007300  h.e.\.s.
00000038: 6500740075007000  e.t.u.p.
00000040: 5c00650074006300  \.e.t.c.
00000048: 5c0070006b006900  \.p.k.i.
00000050: 0000              ..

-- 
Take care. Thanks, Brian Inglis              Calgary, Alberta, Canada

La perfection est atteinte                   Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter  not when there is no more to add
mais lorsqu'il n'y a plus rien à retirer     but when there is no more to cut
                                 -- Antoine de Saint-Exupéry

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple