DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 7AC223858433
Message-ID: <04f97132-a755-4117-aa74-797d7b7f397a@Shaw.ca>
Date: Fri, 12 Jul 2024 18:37:00 -0600
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: How to use '$RECYCLE.BIN' to recover files?
Content-Language: en-CA
To: cygwin AT cygwin DOT com
References: <665b9323-b71b-4cf2-badf-bb82d7b5230b AT TomLegrady DOT com>
 <20f87410-ef55-4106-9850-20aee54e0259 AT SystematicSW DOT ab DOT ca>
 <CAN0SSYwzhu=4Q+g3Gj1gb6bdJb7TfpqOSdUDsWnvB1KZz7YxZA AT mail DOT gmail DOT com>
Autocrypt: addr=Brian DOT Inglis AT Shaw DOT ca; keydata=
 xjMEXopx9BYJKwYBBAHaRw8BAQdAPq8FIaW+Bz7xnfyJ1gHQyf2EZo5sAwSPy/bRAcLeWl/N
 I0JyaWFuIEluZ2xpcyA8QnJpYW4uSW5nbGlzQFNoYXcuY2E+wpYEExYIAD4WIQTG63sbl+cr
 2nyOuZiKvQKcH1E27wUCXopx9AIbAwUJCWYBgAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAK
 CRCKvQKcH1E276DmAP91Bt8kfJhKHYb9b2sao2fxwJFsl1GlRi516WKI0OkphQEA+ULITsPs
 blfzSq+GgI7q4LPfRfTLy4Oo3gorlnhnfgnOOAReinH0EgorBgEEAZdVAQUBAQdAepgIsLwm
 GQicfoIBaB9xHp63MQJqVCPbgPzESTg7EEwDAQgHwn0EGBYIACYWIQTG63sbl+cr2nyOuZiK
 vQKcH1E27wUCXopx9AIbDAUJCWYBgAAKCRCKvQKcH1E27+zoAP4u2ivMQBAqaMeLOilqRWgy
 nV2ATImz1p2v1H5P4kBiDwD3caPK1cxU5lijzuSDCjgtIpgF/avHbjA32fxJdIRwAA==
Organization: Inglis
In-Reply-To: <CAN0SSYwzhu=4Q+g3Gj1gb6bdJb7TfpqOSdUDsWnvB1KZz7YxZA@mail.gmail.com>
Precedence: list
From: Brian Inglis via Cygwin <cygwin AT cygwin DOT com>
Reply-To: cygwin AT cygwin DOT com
Cc: Brian Inglis <Brian DOT Inglis AT Shaw DOT ca>
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Errors-To: cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit

On 2024-07-12 15:12, Mark Liam Brown via Cygwin wrote:
> On Fri, Jul 12, 2024 at 7:25 PM Brian Inglis via Cygwin wrote:
>> On 2024-07-12 10:33, Tom Legrady via Cygwin wrote:
>>> Using cygwin on Windows 11, I ran a command that was over-enthusiastic in
>>> deleting files. Now files I would like to have are in the $RECYCLE.BIN, with
>>> names like '$I0BEVIM.pdf'.
>>> How can I restore these files' original name and path?
>> See:
>>          https://en.wikipedia.org/wiki/Trash_(computing)#Microsoft_Windows
>>          https://superuser.com/a/1736690
>> for low level details for Vista onwards: original file or directory hard linked
>> in /proc/cygdrive/D/\$Recycle.Bin/S-1-5-21-*-*-*-UID/\$RXXXXXX.type and metadata
>> saved in /proc/cygdrive/D/\$Recycle.Bin/S-1-5-21-*-*-*-UID/\$IXXXXXX.type where
>> UID is often 1000 or 1001 with personal desktop local accounts, and you only
>> have access to your own, unless elevated as admin, e.g.
>> $ ls -glort /proc/cygdrive/d/\$Recycle.Bin/S-1-5-21-*-*-*-1001/
>> total 3
>> -rwx------+ 1 129 Apr  2  2020  desktop.ini
>> drwxr-xr-x  1   0 Dec 12  2021 '$RVW0RM1'
>> -rw-r--r--+ 1   0 Oct 22  2023 '$RQWOLZK.ini-save'
>> -rwx------+ 1 254 Oct 22  2023 '$IQWOLZK.ini-save'
>> -rwx------+ 1  82 Oct 22  2023 '$IVW0RM1'
>> $ xxd -c8 -g8 /proc/cygdrive/d/\$Recycle.Bin/S-1-5-21-*-*-*-1001/\$IVW0RM1
>> 00000000: 0200000000000000  ........    # header (le)
>> 00000008: 0000000000000000  ........    # file size (le)
>> 00000010: e04bc8060b05da01  .K......    # deleted time (le 100ns Windows)
>> 00000018: 1b00000044003a00  ....D.:.    # path length(le 4) path (4+ UCS-2)
>> 00000020: 5c00760061007200  \.v.a.r.
>> 00000028: 5c00630061006300  \.c.a.c.
>> 00000030: 680065005c007300  h.e.\.s.
>> 00000038: 6500740075007000  e.t.u.p.
>> 00000040: 5c00650074006300  \.e.t.c.
>> 00000048: 5c0070006b006900  \.p.k.i.
>> 00000050: 0000              ..

> I think the question was:
> Does Cygwin have utilities which can restore the files from a script?
> Or how can a user call powershell to do the job?

That was not what the OP asked - he asked how.

Asking in a Cygwin group implies he is looking for a Cygwin solution to a 
problem someone created with Cygwin utilities.

I doubt anyone has bothered, so some background info to do the job is referred 
to, and illustrated somewhat.

The easy Windows answer is open Explorer on your 'Recycle Bin' and select 
'Restore' after selecting all those files deleted by mistake.

-- 
Take care. Thanks, Brian Inglis              Calgary, Alberta, Canada

La perfection est atteinte                   Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter  not when there is no more to add
mais lorsqu'il n'y a plus rien à retirer     but when there is no more to cut
                                 -- Antoine de Saint-Exupéry

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple