Windows Recycle Bin Forensics

When you delete files from your local computer, they are temporarily stored in a location called the Recycle Bin and this gives you an opportunity to recover any files if for instance, these files were deleted by mistake. Until files are not deleted from the Recycle Bin you can restore them to their original locations. Recycle Bins are often examined during computer forensics and Ethan Fleisher from Champlain College is working on a project to determine key differences between the Windows 7 and Windows 8 operating system from a forensic standpoint in order to determine if there are any significant changes that will be either beneficial or detrimental to the forensic investigation process.

Ethan has spent many months researching the Microsoft Windows 8 OS with focus on revealing new artifacts and attempting to confirm previous methodologies and he has found out that Windows 8 recycle bin behaves just like the Windows 7 recycle bin.

Read Ethan’s full review here – http://cyberarms.wordpress.com/2012/08/13/windows-8-forensics-recycle-bin/

Watch this video to learn how to recover files from the Recycle Bin – http://windows.microsoft.com/en-us/windows7/recover-files-from-the-recycle-bin