How to use '$RECYCLE.BIN' to recover files?

[Brian Inglis]

On 2024-07-12 15:12, Mark Liam Brown via Cygwin wrote:
> On Fri, Jul 12, 2024 at 7:25 PM Brian Inglis via Cygwin wrote:
>> On 2024-07-12 10:33, Tom Legrady via Cygwin wrote:
>>> Using cygwin on Windows 11, I ran a command that was over-enthusiastic in
>>> deleting files. Now files I would like to have are in the $RECYCLE.BIN, with
>>> names like '$I0BEVIM.pdf'.
>>> How can I restore these files' original name and path?
>> See:
>>          https://en.wikipedia.org/wiki/Trash_(computing)#Microsoft_Windows
>>          https://superuser.com/a/1736690
>> for low level details for Vista onwards: original file or directory hard linked
>> in /proc/cygdrive/D/\$Recycle.Bin/S-1-5-21-*-*-*-UID/\$RXXXXXX.type and metadata
>> saved in /proc/cygdrive/D/\$Recycle.Bin/S-1-5-21-*-*-*-UID/\$IXXXXXX.type where
>> UID is often 1000 or 1001 with personal desktop local accounts, and you only
>> have access to your own, unless elevated as admin, e.g.
>> $ ls -glort /proc/cygdrive/d/\$Recycle.Bin/S-1-5-21-*-*-*-1001/
>> total 3
>> -rwx------+ 1 129 Apr  2  2020  desktop.ini
>> drwxr-xr-x  1   0 Dec 12  2021 '$RVW0RM1'
>> -rw-r--r--+ 1   0 Oct 22  2023 '$RQWOLZK.ini-save'
>> -rwx------+ 1 254 Oct 22  2023 '$IQWOLZK.ini-save'
>> -rwx------+ 1  82 Oct 22  2023 '$IVW0RM1'
>> $ xxd -c8 -g8 /proc/cygdrive/d/\$Recycle.Bin/S-1-5-21-*-*-*-1001/\$IVW0RM1
>> 00000000: 0200000000000000  ........    # header (le)
>> 00000008: 0000000000000000  ........    # file size (le)
>> 00000010: e04bc8060b05da01  .K......    # deleted time (le 100ns Windows)
>> 00000018: 1b00000044003a00  ....D.:.    # path length(le 4) path (4+ UCS-2)
>> 00000020: 5c00760061007200  \.v.a.r.
>> 00000028: 5c00630061006300  \.c.a.c.
>> 00000030: 680065005c007300  h.e.\.s.
>> 00000038: 6500740075007000  e.t.u.p.
>> 00000040: 5c00650074006300  \.e.t.c.
>> 00000048: 5c0070006b006900  \.p.k.i.
>> 00000050: 0000              ..

> I think the question was:
> Does Cygwin have utilities which can restore the files from a script?
> Or how can a user call powershell to do the job?

That was not what the OP asked - he asked how.

Asking in a Cygwin group implies he is looking for a Cygwin solution to a 
problem someone created with Cygwin utilities.

I doubt anyone has bothered, so some background info to do the job is referred 
to, and illustrated somewhat.

The easy Windows answer is open Explorer on your 'Recycle Bin' and select 
'Restore' after selecting all those files deleted by mistake.

-- 
Take care. Thanks, Brian Inglis              Calgary, Alberta, Canada

La perfection est atteinte                   Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter  not when there is no more to add
mais lorsqu'il n'y a plus rien à retirer     but when there is no more to cut
                                 -- Antoine de Saint-Exupéry