DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 93C5938319FD
MIME-Version: 1.0
References: <665b9323-b71b-4cf2-badf-bb82d7b5230b AT TomLegrady DOT com>
 <20f87410-ef55-4106-9850-20aee54e0259 AT SystematicSW DOT ab DOT ca>
In-Reply-To: <20f87410-ef55-4106-9850-20aee54e0259@SystematicSW.ab.ca>
Date: Fri, 12 Jul 2024 23:12:40 +0200
Message-ID: <CAN0SSYwzhu=4Q+g3Gj1gb6bdJb7TfpqOSdUDsWnvB1KZz7YxZA@mail.gmail.com>
Subject: Re: How to use '$RECYCLE.BIN' to recover files?
To: cygwin AT cygwin DOT com
From: Mark Liam Brown via Cygwin <cygwin AT cygwin DOT com>
Reply-To: Mark Liam Brown <brownmarkliam AT gmail DOT com>
Content-Type: text/plain; charset="utf-8"
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit

On Fri, Jul 12, 2024 at 7:25 PM Brian Inglis via Cygwin
<cygwin AT cygwin DOT com> wrote:
>
> On 2024-07-12 10:33, Tom Legrady via Cygwin wrote:
> > Using cygwin on Windows 11, I ran a command that was over-enthusiastic in
> > deleting files. Now files I would like to have are in the $RECYCLE.BIN, with
> > names like '$I0BEVIM.pdf'.
> >
> > How can I restore these files' original name and path?
>
> See:
>
>         https://en.wikipedia.org/wiki/Trash_(computing)#Microsoft_Windows
>
>         https://superuser.com/a/1736690
>
> for low level details for Vista onwards: original file or directory hard linked
> in /proc/cygdrive/D/\$Recycle.Bin/S-1-5-21-*-*-*-UID/\$RXXXXXX.type and metadata
> saved in /proc/cygdrive/D/\$Recycle.Bin/S-1-5-21-*-*-*-UID/\$IXXXXXX.type where
> UID is often 1000 or 1001 with personal desktop local accounts, and you only
> have access to your own, unless elevated as admin, e.g.
>
> $ ls -glort /proc/cygdrive/d/\$Recycle.Bin/S-1-5-21-*-*-*-1001/
> total 3
> -rwx------+ 1 129 Apr  2  2020  desktop.ini
> drwxr-xr-x  1   0 Dec 12  2021 '$RVW0RM1'
> -rw-r--r--+ 1   0 Oct 22  2023 '$RQWOLZK.ini-save'
> -rwx------+ 1 254 Oct 22  2023 '$IQWOLZK.ini-save'
> -rwx------+ 1  82 Oct 22  2023 '$IVW0RM1'
> $ xxd -c8 -g8 /proc/cygdrive/d/\$Recycle.Bin/S-1-5-21-*-*-*-1001/\$IVW0RM1
> 00000000: 0200000000000000  ........    # header (le)
> 00000008: 0000000000000000  ........    # file size (le)
> 00000010: e04bc8060b05da01  .K......    # deleted time (le 100ns Windows)
> 00000018: 1b00000044003a00  ....D.:.    # path length(le 4) path (4+ UCS-2)
> 00000020: 5c00760061007200  \.v.a.r.
> 00000028: 5c00630061006300  \.c.a.c.
> 00000030: 680065005c007300  h.e.\.s.
> 00000038: 6500740075007000  e.t.u.p.
> 00000040: 5c00650074006300  \.e.t.c.
> 00000048: 5c0070006b006900  \.p.k.i.
> 00000050: 0000              ..

I think the question was:
Does Cygwin have utilities which can restore the files from a script?
Or how can a user call powershell to do the job?

Mark
-- 
IT Infrastructure Consultant
Windows, Linux

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple