Windows Recycle Bin $I and $R files

Windows creates a separate Recycle Bin for each user. A reference to a Recycle Bin for a local drive should appear in all caps. E.g., "C:\$RECYCLE.BIN". A Recycle Bin for an external drive should be in lower case.

Inside a Recycle Bin you may find files which begin with either '$I' or '$R'. A file beginning with '$I' will contain data about a file that has been deleted. When examined in a hex editor, this kind of '$I' file will show the following information:

1. the first 8 alphanumeric characters list the header for the file.

2. alphanumeric characters 8 thru 15 indicate the file size.

3. alphanumeric characters 16 thru 23 shows the date and time the file was deleted.

4. alphanumeric characters 24 thru 27 indicate the length of the file name.

5. From the 28 position onwards, the file lists the file name and path.

A file beginning with $R will contain the actual content of a file.

In earlier versions of Windows (such as XP) a file named, 'INFO2' was used to track which files the Recycle Bin contained.