Rifiuti

Many important files within Microsoft Windows have structures that are undocumented. One of the principals of computer forensics is that all analysis methodologies must be well documented and repeatable, and they must have an acceptable margin of error. Currently, there are a lack of open source methods and tools that forensic analysts can rely upon to examine the data found in proprietary Microsoft files.

Many computer crime investigations require the reconstruction of a subject's Recycle Bin. Since this analysis technique is executed regularly, we researched the structure of the data found in the Recycle Bin repository files (INFO2 files). Rifiuti (the Italian word meaning "trash") was designed to examine the contents of the INFO2 file in the Recycle Bin.

Rifiuti will parse the information in an INFO2 file and output the results in a field elimited manner so that it may be imported into your favorite spreadsheet program.

Usage: rifiuti [options] -t Field Delimiter (TAB by default)

Example Usage: [kjones:rifiuti/rifiuti_20030410_1/bin] kjones% ./rifiuti INFO2 > INFO2.txt Open INFO2.txt as a TAB delimited file in MS Excel to further sort and filter your results.