General

Take Out the Papers and the Trash

Posted on by Will Cox

The following procedure requires administrative privileges. The instructions are specific to NTFS filesystems; Windows operating systems using the FAT filesystem store user-specific waste in RECYCLED. All operations, unless otherwise specified, take place at the command prompt.

The Procedure

Acquire the Necessary Tools

To empty someone else’s Recycle Bin, you need to know that user account’s SID. To enumerate the SID, use PsGetSid, from the SysInternals PsTools collection.

Acquire the SID

 C:>psgetsid myAccount
  PsGetSid v1.42 - Translates SIDs to names and vice versa 
  Copyright (C) 1999-2004 Mark Russinovich Sysinternals - www.sysinternals.com  

 SID for myExampleDomainmyAccount:
 S-1-5-21-1550083382-1987000788-618671499-1009

Change to the Recycler Directory

cd c:RECYCLER

Inside the RECYCLER directory are a number of hidden, user-specific directories, each labeled with the user’s security identifier (SID)

 C:RECYCLER>dir /ah
 Volume in drive C has no label.
 Volume Serial Number is 8802-23D9
 
 Directory of C:RECYCLER
 
 03/03/2005  09:15p      <dir>          .
 03/03/2005  09:15p      <dir>          ..
 03/03/2005  12:13p      <dir>          S-1-5-21-2057499049-1289676208-1959431660-29476
 10/05/2005  11:06a      <dir>          S-1-5-21-2057499049-1289676208-1959431660-383710
               0 File(s)              0 bytes
               4 Dir(s)  21,677,989,888 bytes free

o the user-specific directory using the SID found with psgetsid. Or, if you are in search of disk space to recover, you may wish to use du to discover who has not taken out the trash recently.

Who Doesn’t Empty the Trash?

SysInternals provides a du, or disk usage, utility similar to du(1M) provided on *N?X systems.

 du.exe -v -l 1 .  
 
 Du v1.2 - report directory disk usage
 Copyright (C) 2005 Mark Russinovich
 Sysinternals - www.sysinternals.com
        167  D:RECYCLERS-1-5-21-1550083382-1987000788-618671499-1004
          0  D:RECYCLERS-1-5-21-1550083382-1987000788-618671499-1006
          0  D:RECYCLERS-1-5-21-1550083382-1987000788-618671499-1009
          0  D:RECYCLERS-1-5-21-1550083382-1987000788-618671499-1029
          0  D:RECYCLERS-1-5-21-1550083382-1987000788-618671499-1039
          0  D:RECYCLERS-1-5-21-1550083382-1987000788-618671499-1044
          0  D:RECYCLERS-1-5-21-1550083382-1987000788-618671499-1045
          0  D:RECYCLERS-1-5-21-1550083382-1987000788-618671499-500
          0  D:RECYCLERS-1-5-21-360203367-1976785433-925700815-1002
          0  D:RECYCLERS-1-5-21-360203367-1976785433-925700815-500
        167  D:RECYCLER
 
 Totals:
 Files:        18
 Directories:  10
 Size:         172,010 bytes
 Size on disk: 172,010 bytes

Exterminate with Extreme Prejudice

 cd D:RECYCLERS-1-5-21-1550083382-1987000788-618671499-1004
 del /q /s *.*

If you’re feeling particularly vindictive, you can force the deletion of read-only files.

 del /q /f /s *.*

Caveats

This procedure leaves two hidden files behind in each user directory: desktop.ini, and INFO2.

The former contains a CLSID used to configure the directory listing in Windows Explorer. The latter contains a list of where the deleted files were when they were deleted. It appears from the Microsoft Knowledge Base documentation that these files, and the user-specific RECYCLER directories, will be rebuilt as necessary. I have not tested this.

References

Will Cox