XProfan

- Page 1 -

Thanks the help of Roland and iF have I now The information over The Size Windows-wastebasket - OK - aaaaaber can too The actually Size the Papierkorbes check, if in this already erased data present are ??

Jörg
Sellmeyer

Probier time the:
Compile Mark Separation

!
ChDir "C:Recycler"WinXP
ChDir "C:Recycled"Win9x
AddFiles *"*"
ListBox$("",2)/pre>

there's certainly too yet a Registry entry, where one whom way read can.

Greeting
Jörg

Windows XP SP2 XProfan X4
... und hier mal was ganz anderes als Profan ...

- Page 2 -

Hello Jörg
your code shows me whom Content the Folder (Normalzustand: cache) on - the are 3 Folders 5 Files. (*.info + *.txt) The eigentliche Content the Papierkorbes must itself but somewhere differently hide and there be I überfragt. (To stupid

)

not To stupid => The thing is undokumentiert.
in the wastebasket there a File INFO (or. INFO2) The The Dateiinformationen the Papierkorbs contains - u.a. too The Size.

Perhaps helps the already moreover...
[quote:3af1232b6e]
From: daniel u. Thibault Subject: Recycling be internals Date: 16 Jul 1999 00:00:00 GMT Message-ID: <378F60AD.E938B0EE@DREV.DND.Ca> Content-Transfer-Encoding: 8bit X-Accept-Language: en,fr Content-Type: Text/plain; charset=iso-8859-1 Organization: Centre de recherches pour la =?iso-8859-1?Q?d=E9fense?=, Valcartier Mime-Version: 1.0 Reply-To: Thibault, daniel u. Newsgroups: borland.public.delphi.winapi A long time ago, Steve Schafer wrote: > The internal operation of the Recycle be is mostly undocumented, but article > Q136517 in the Microsoft KnowledgeBase has a little bit of information. In addition > to whats there, Ive discovered the following: > The files in the RECYCLED directory (there is one on each drive) contain each of > the files in the be, with their original names replaced by new names of the shape > D. > where is just the letter of the drive (A, B, C or whatever), number> is just on integer, and is the original file extension. so, for > example, D:FooMyFile.doc wants, when deleted, be moved to the RECYCLED > directory on drive D and renamed to something like DD3.doc. > > There are two additional files in the RECYCLED directory. The ridge is DESKTOP.INI, > whose sole purpose seems to be to provide a timestamp indicating when the > Recycle be what last emptied. The other file is called INFO (no extension), and it is > this file that contains all of the useful information you would need to restore > deleted files. > > INFO consists of a 20-byte header followed by one 280-byte record for each file > that has been deleted. The header consists of five 32-bit integers: > > bytes 0- 3: seems to always be zero; Version number? > bytes 4- 7: number of files in the Recycle be > bytes 8-11: next sequence number to use > bytes 12-15: = 280 (size of deleted file records) > bytes 16-19: utterly number of bytes occupied by deleted files > > Each deleted-file record consists of 260 bytes containing the full zero-terminated > path name of the deleted file, followed by a 20-byte trailer: > > bytes 0- 3: sequence number for this file > bytes 4- 7: drive letter for this file (A=0, B=1, etc.) > bytes 8-15: time when file what deleted, in FILETIME stature > bytes 16-19: number of bytes occupied by this file > > The numbers that specify the number of bytes occupied by deleted files includes > the cluster overhead; that is, a 1-byte file on a drive that uses 8192-byte clusters > is reported as occupying 8192 bytes. > > It appears that if several files are deleted during a single > operation, they wants all have the same deletion time stamp. You could use this > information to determine the granularity of your undo operations. > > The above applies to FAT partitions under the original Win95, and means Win95 OSR2. > The later versions of Win95 that have the new IE shell use a different structure for > the INFO file (which is now called INFO2). NT 4.0 means uses a different structure, > partly because it stores file names in Unicode. In any case, the basic idea seems to > be the same; just the details are different. The four bytes that I mentioned above > might be the Version number are different for the different formats. Heres what Ive found out about the FAT32 Win95 recycling be Info2 file structure: The Info2 header consists of five 32-bit integers: bytes 0- 3: seems to always be $00000004 bytes 4- 7: definitely NOT the number of files in the Recycle be bytes 8-11: definitely NOT the next sequence number to use bytes 12-15: = 280 (size of deleted file records) bytes 16-19: utterly number of bytes occupied by deleted files?? (The figure reads about 8 times too large, even when considering the cluster size...) Each deleted-file record consists of 260 bytes containing the full zero-terminated path name of the deleted file, followed by a 20-byte trailer: bytes 0- 3: sequence number for this file bytes 4- 7: drive letter for this file (A=0, B=1, etc.) bytes 8-15: time when file what deleted, in FILETIME stature bytes 16-19: number of bytes occupied by this file (a whole multiple of the cluster size) Under WinNT, the structure of Info is changed in only one regard: Each deleted file record is 2*MAX_PATH bytes longer because the 20-byte trailer is followed by the files fully qualified name and path in Unicode. The Info header Version integer means reads as $00000002. What I need help with is this: Under WinNT, the Info file and the deleted files end up in a sub-directory of RECYCLER (*hardship* RECYCLED, youll have noticed) that bears a long and weird name. Is this name always the same or does it obey to some hash function? Does RECYCLER ever contain more than one of these strange sub-dirs? Is this peculiar to HPFS? daniel u. Thibault a.k.a. Urhixidur a.k.a. Sire Bohémond de Nicée
[/quote:3af1232b6e]

Michael
Wodrich

I have the Quote time by the Translator coursed:[quote:ec0837dda4]
From : daniel u. Thibault Unterwirft: Wiederverwertung the Behälters internals date: on the 16. july 1999 00:00:00-WEZ-Nachrichtenpersonalausweis: <378F60AD.E938B0EE@DREV.DND.Ca> pleased Übertragungsverschlüsselung: 8-bit-X-Accept-Language: en, fr Zufriedener type: Text/Ebene; charset=iso-8859-1 organization: stand tappt im dunkeln in the Mittelpunkt de pour recherches la =? Iso-8859-1? Q? d=E9fense? =, Valcartier Pantomime-Version: 1.0 response-: Thibault, daniel u. Newsgroups: Borland.public.delphi.winapi to langer Time wrote Steve Schafer:> becomes The interne operation the Papierkorbs größtenteils undokumentiert, but Artikel> Q136517 in the Microsoft, the KnowledgeBase one small bisschen the information has. Außerdem> moreover, what there is, have I the subesquent discover:> The Files in the WIEDERVERWANDTEN directory (there one on each drive) include jeden> The Files in the box, with ihren ursprünglichen names supplant through new names the Form> D.>, where straight the character the Laufwerkes (A, B, C or take off) is, is Anzahl> straight a whole number, and is the ursprüngliche Dateinamenszusatz. means, für> example becomes D:FooMyFile.doc, if deleted, to that WIEDERVERWANDTEN> directory on the drive D moving and To something How DD3.doc umbenannt.>> gives it two additional Files in the WIEDERVERWANDTEN directory. the first is DESKTOP.INI,>, whose alleiniger object shining To his, circa a Zeitstempel available To to put, the indicating, als> wastebasket entleert letzt was. The others File INFO (no expansion) called, and it ist> these File, The The whole useful information contains, The Sie> erased Files would again produce must.>> exists INFO a 20-byte-a header followed a 280-byte-note for each Datei>, the deleted been is. The a header exists from five whole 32-bit-numbers:>> Bytes 0-3: shining always zero To sein; Versionsanzahl?> Bytes 4-7: amount of Files in the Papierkorb> Bytes 8-11: following follow-amount,> Bytes 12-15 To use: = 280 (Size of erased Dateiaufzeichnungen)> Bytes 16-19: The Gesamtzahl of Bytes occupied through erased Dateien>> Each note the delete-File exists from 260 Bytes, The the filled with the zero begrenzt> Pfadname the erased File, followed of a 20-byte-Trailer include:>> Bytes 0-3: follow-amount for these Datei> Bytes 4-7: Laufwerksbuchstabe for these File (A=0, B=1, etc.)> Bytes 8-15: Time, as File, in the FILETIME-Format> Bytes 16-19 deleted watts: The amount of Bytes occupied through these Datei>> The Anzahlen, The The amount of through erased Files besetzten Bytes indicate, umfasst> The Traube oben; d. h. a 1-byte-File one drive, the 8192-byte-Trauben> uses, becomes as the occupy of 8192 Bytes report.>> shining it, that, if several Files during of/ one Single> operation deleted go, tappt im dunkeln any dieselbe wipe out-Zeitmarke having go. tappt im dunkeln could das> information use, around the Körnung of their To to determine, Operationen open.>> counts The obengenannte on FETTE Teilungen under the ursprünglichen Win95, and Win95 OSR2.> The later versions of Win95, The whom new benefit D. H. shell-use a different structure für> The INFO-File having (the now INFO2 called becomes). NT 4.0 too use a different structure,> partly, because it Filenames in the Unicode save. anyway shining The Grundidee>, the same thing To sein; straight are The details differently. The four Bytes, The I oben> mentioned, could his The Versionsanzahl is for different Formate differently. here's, I of FAT32 Win95 Wiederverwertung the Behälters Info2 Dateiaufbau experienced have: The Info2 a header exists from five whole 32-bit-numbers: Bytes 0-3: shining always Bytes of 00000004 $ 4-7 To his: certainly NOT The amount of Files whom wastebasket-Bytes 8-11: certainly NOT The following follow-amount, Bytes 12-15 To use: = 280 (Size of erased Dateiaufzeichnungen) Bytes 16-19: Gesamtzahl of through erased Files besetzten Bytes?? (The number reads To large about 8time, even if, The Traube-Size ... betrachtend), Each note the delete-File from 260 Bytes exists, The The filled with the zero limited Pfadname the erased File, followed of a 20-byte-Trailerenthalten: Bytes 0-3: follow-amount for these Dateibytes 4-7: Laufwerksbuchstabe for these File (A=0, B=1, etc.) Bytes 8-15: Time, as File, in FILETIME-stature-Bytes 16-19 deleted watts: amount of through these File besetzten Bytes (one ganzes Vielfache the Traube-Size) under WinNT becomes the structure the Info in only of/ one regard changed: Each erased Dateiaufzeichnung is 2*MAX_PATH longer Bytes, because the20-byte-Trailer of completely qualified names the File and way in the Unicode followed becomes. The whole Info-a header-Versions-number reads too as 00000002 $. what I need, that Help so this is: under WinNT terminate The Info-File and the erased Files one Unterverzeichnis of RECYCLER (*hardship* WIEDERVERWANDT, you'll notice having), the a long and uncanny names carry. is this name always the same thing, or follows it something Kuddelmuddel-function? contains RECYCLER ever More as a this strangers sub-dirs? is the HPFS odd? daniel u. Thibault a.k.a. Urhixidur a.k.a. father Bohémond de Nicée[/quote:ec0837dda4]
Best wishes
Michael Wodrich

Programmieren, das spannendste Detektivspiel der Welt.

Hi Michael
me brummt the skull (a header)

Hi Horst - if I Time have, übersetze I it to you gladly...

Hello Andreas
thanks for your tender. so far I the now begriffen have, can The Datenmenge the in the wastebasket schlummernden Files not check and this is sorry, sorry, sorry

- Perhaps finds one but in a korrekten Translation still a Info. would be you means very grateful for your trouble

naturally can the check - too which Files there drin are.
The menace: its undokumentiert, d.h. it can itself with others Systemen walk on the manner, How the stored becomes, something Change - possible is But...

seek time in the PSDK or MSDN to SHQueryRecycleBinA and to the SHQUERYRBINFO
Structure. I hope the helps