Rifiuti2 analyses recycle bin files from Windows. Analysis of Windows recycle bin is usually carried out during Windows computer forensics. Rifiuti2 can extract file deletion time, original path and size of deleted files and whether the deleted files have been moved out from the recycle bin since they are trashed. Rifiuti2 is a rewrite of rifiuti, which is originally written for identical purpose. Then it was extended to cover more functionalities, such as: * Handles recycle bin up to Windows 10; * Handles ancient Windows like 95, NT4 and ME; * Supports all localized versions of Windows - both Unicode-based ones and legacy ones (using ANSI code page); * Supports output in XML format as well as original tab-delimited text. Rifiuti2 is designed to be portable and runs on command line environment. Two programs rifiuti and rifiuti-vista are chosen depending on relevant Windows recycle bin format.
sudo apt install rifiuti2 (134 KB)
Dependências: libc6, libglib2.0-0t64
Escolha um comando ao lado para ver a descrição e a ajuda completa.
rifiuti-vista
Windows recycle bin analysis tool
root@kali:~# rifiuti-vista -h
Usage:
rifiuti-vista [OPTION…] DIR_OR_FILE
Parse index files in C:\$Recycle.bin style folder and dump recycle bin data. Can also dump a single index file.
Help Options:
-h, --help Show help options
--help-all Show all help options
--help-format Show output formatting options
Application Options:
-o, --output=FILE Write output to FILE
-z, --localtime Present deletion time in time zone of local system (default is UTC)
-v, --version Print version information and exit
--live Inspect live system
Usage help: https://github.com/abelcheung/rifiuti2/wiki/Usage-and-Examples
Bug report: https://github.com/abelcheung/rifiuti2/issues
More info : https://abelcheung.github.io/rifiuti2/
rifiuti2
Windows recycle bin analysis tool
root@kali:~# rifiuti2 -h
Usage:
rifiuti2 [OPTION…] INFO2
Parse INFO2 file and dump recycle bin data.
Help Options:
-h, --help Show help options
--help-all Show all help options
--help-format Show output formatting options
Application Options:
-o, --output=FILE Write output to FILE
-z, --localtime Present deletion time in time zone of local system (default is UTC)
-v, --version Print version information and exit
-l, --legacy-filename=CODEPAGE Show legacy (8.3) path if available and specify its CODEPAGE
Usage help: https://github.com/abelcheung/rifiuti2/wiki/Usage-and-Examples
Bug report: https://github.com/abelcheung/rifiuti2/issues
More info : https://abelcheung.github.io/rifiuti2/