Windows Forensics: analysis of Recycle bin artifacts

The Windows Recycle Bin contains files that have been deleted by the user, but not yet purged from the system: a valuable source of evidence for an examiner. Depending on the version of Windows, Recycle Bin evidences are stored in two different ways. On Windows XP, the files are stored in the “Recycler” folder under […]