DKIM-Filter: OpenDKIM Filter v2.11.0 delorie.com 46CLF08Q2590370 Authentication-Results: delorie.com; dkim=pass (1024-bit key, unprotected) header.d=cygwin.com header.i=@cygwin.com header.a=rsa-sha256 header.s=default header.b=Jv8k/KtV X-Recipient: archive-cygwin AT delorie DOT com DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 17B83385EC2A DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com; s=default; t=1720818897; bh=4ONGI3AbhF65EM2Ou7cqDselAVsjHLJeSncp6z63XM4=; h=References:In-Reply-To:Date:Subject:To:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To: From; b=Jv8k/KtVIqAGHVDii8IzsSIJdrNZBOWVzMI6bISX82oe56iYnmTqlWwMtaGkKFJz0 yyVUcE7kAjjzjzIAXIC9DkKznCjv0Su5+kRxcxrpQu2dRUuxhXicK2vMf4RazqYw1B KGx1FKhSq5J1KGhEtL9J+q6gpDrbRq2fS/+zgh2I= X-Original-To: cygwin AT cygwin DOT com Delivered-To: cygwin AT cygwin DOT com DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 93C5938319FD ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 93C5938319FD ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1720818802; cv=none; b=nJIcOhWpJQI6BEJTOuGeLS3XepIAPnHls44x/ebl6EcZjQzZiXvps5j0BiUkzyT6PUM38gOZp8ZtlSyG2ZzDbO5mnxIEs5UbBV8NEKn2BnJkydYsdowexPKksfncfONawy9j3QrCnBpt1tfiMrrR5OtseOVK9XLLb9pSCZtMT3w= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1720818802; c=relaxed/simple; bh=BfT7hTv1zryXT4U7PSUltQ/7Q5RnhJI7HuBrEzn6NbY=; h=DKIM-Signature:MIME-Version:From:Date:Message-ID:Subject:To; b=OSmH1sy8+eFRxAfrEBYF9fj9k8fU5Hgm6qAaXo5px940VzOwvAxzpDegk6fPn+qY6WivCm1ctmIY9+jkNQdFv7uuuVyDVygKZGxJQwLPxrr6zdGq9AXWFnAN2ZLpjg+YbFXXM/8/EH8k4V/7lAjU8KkJ0PIIsvCtVgOvmcwTal0= ARC-Authentication-Results: i=1; server2.sourceware.org X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720818797; x=1721423597; h=content-transfer-encoding:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cmsPJcpT5XJC7djtG5s+HHVWmQpjYulix3E2dNp4uV8=; b=vELxnIwHvXUKfZGTM+3b6kgW7le/2Vd8VU/mUODOs6zEQnX5T/TCcick9ZmM59aFQK ALrtlFo1zGYhcpTlC8xGHDOgTh8f+NWRTJsSytMur8yvmxYlgL7IY5A6GbdxQp/V1fYH 2hACxs1FchzuNErpqu8lQjcHjxp9YM4HQeuKcR2xWthp+ppH+jCpN10ivEh+Es4gCt2s +PMYnQm3y4Jb6k6l0hUP84UppVq+bzZxBdRBlpkSqA/wyiBhRohbG3FZwPjNOa/0Nq4X /XXQSO/3Z+hg9GNzAsWiWspoExKs6Ba40Tm5xmbLiWkH7ZQYXiVo7RBXS8BHv+A7hpSK 2smg== X-Gm-Message-State: AOJu0Yw0j5Vf1HE8q20sqmi8pJWhsdYCn7sEAUYLxuhxgkwRIjQbVztC q+o+66C0+OQSMCW2ceSqfS6iFz0vVtqvSF7P/JboMP1uMUUAv0Vr9i1L7s9/PivjRTmR/GEFG5m nXmQIBAVgYzr0da4gkyKcwpJH+LOCvg== X-Google-Smtp-Source: AGHT+IGMxZwEgVUBZGXHPRgE39X5DnD96GftsLfgdcOHq0LreND2KS1iGcPEodWRwSa502nMhVtf03DcjlrRjwBTZE0= X-Received: by 2002:a17:90a:3901:b0:2c2:e97f:89d8 with SMTP id 98e67ed59e1d1-2ca35c30bf1mr10278456a91.13.1720818797169; Fri, 12 Jul 2024 14:13:17 -0700 (PDT) MIME-Version: 1.0 References: <665b9323-b71b-4cf2-badf-bb82d7b5230b AT TomLegrady DOT com> <20f87410-ef55-4106-9850-20aee54e0259 AT SystematicSW DOT ab DOT ca> In-Reply-To: <20f87410-ef55-4106-9850-20aee54e0259@SystematicSW.ab.ca> Date: Fri, 12 Jul 2024 23:12:40 +0200 Message-ID: Subject: Re: How to use '$RECYCLE.BIN' to recover files? To: cygwin AT cygwin DOT com X-Spam-Status: No, score=-0.2 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: cygwin AT cygwin DOT com X-Mailman-Version: 2.1.30 List-Id: General Cygwin discussions and problem reports List-Archive: List-Post: List-Help: List-Subscribe: , From: Mark Liam Brown via Cygwin Reply-To: Mark Liam Brown Content-Type: text/plain; charset="utf-8" Sender: "Cygwin" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by delorie.com id 46CLF08Q2590370 On Fri, Jul 12, 2024 at 7:25 PM Brian Inglis via Cygwin wrote: > > On 2024-07-12 10:33, Tom Legrady via Cygwin wrote: > > Using cygwin on Windows 11, I ran a command that was over-enthusiastic in > > deleting files. Now files I would like to have are in the $RECYCLE.BIN, with > > names like '$I0BEVIM.pdf'. > > > > How can I restore these files' original name and path? > > See: > > https://en.wikipedia.org/wiki/Trash_(computing)#Microsoft_Windows > > https://superuser.com/a/1736690 > > for low level details for Vista onwards: original file or directory hard linked > in /proc/cygdrive/D/\$Recycle.Bin/S-1-5-21-*-*-*-UID/\$RXXXXXX.type and metadata > saved in /proc/cygdrive/D/\$Recycle.Bin/S-1-5-21-*-*-*-UID/\$IXXXXXX.type where > UID is often 1000 or 1001 with personal desktop local accounts, and you only > have access to your own, unless elevated as admin, e.g. > > $ ls -glort /proc/cygdrive/d/\$Recycle.Bin/S-1-5-21-*-*-*-1001/ > total 3 > -rwx------+ 1 129 Apr 2 2020 desktop.ini > drwxr-xr-x 1 0 Dec 12 2021 '$RVW0RM1' > -rw-r--r--+ 1 0 Oct 22 2023 '$RQWOLZK.ini-save' > -rwx------+ 1 254 Oct 22 2023 '$IQWOLZK.ini-save' > -rwx------+ 1 82 Oct 22 2023 '$IVW0RM1' > $ xxd -c8 -g8 /proc/cygdrive/d/\$Recycle.Bin/S-1-5-21-*-*-*-1001/\$IVW0RM1 > 00000000: 0200000000000000 ........ # header (le) > 00000008: 0000000000000000 ........ # file size (le) > 00000010: e04bc8060b05da01 .K...... # deleted time (le 100ns Windows) > 00000018: 1b00000044003a00 ....D.:. # path length(le 4) path (4+ UCS-2) > 00000020: 5c00760061007200 \.v.a.r. > 00000028: 5c00630061006300 \.c.a.c. > 00000030: 680065005c007300 h.e.\.s. > 00000038: 6500740075007000 e.t.u.p. > 00000040: 5c00650074006300 \.e.t.c. > 00000048: 5c0070006b006900 \.p.k.i. > 00000050: 0000 .. I think the question was: Does Cygwin have utilities which can restore the files from a script? Or how can a user call powershell to do the job? Mark -- IT Infrastructure Consultant Windows, Linux -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation: https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple