Module windows 

Read-only reader for the Windows Recycle Bin $I index file format.

When a file is sent to the Recycle Bin on Windows Vista and later, the shell writes two files into $Recycle.Bin\<SID>\:

• an $I… index file holding the deleted file’s metadata (original path, original size, deletion time), and
• an $R… content file holding the deleted file’s data.

The two are paired by the trailing identifier + extension after the $I / $R prefix ($IAB12CD.docx ⇄ $RAB12CD.docx).

This module parses the $I metadata and pairs $I/$R files by a directory scan. It produces no findings — the trash-forensic analyzer layers anomaly detection on top.

Format

The byte layout follows the libyal Windows Recycle.Bin file formats specification (see docs/validation.md for the citation):

Offset	Size	Field
0	8	Format version (1 = pre-Win10, 2 = Win10+), little-endian
8	8	Original file size, little-endian
16	8	Deletion time, Windows FILETIME (100 ns ticks since 1601-01-01 UTC)

For version 1 the original filename is a fixed 520-byte UTF-16LE field at offset 24 (260 wchar_t). For version 2 offset 24 holds a 4-byte little-endian filename length in characters (including the NUL terminator), followed by the variable-length UTF-16LE path at offset 28.

All integers are read through bounds-checked helpers: $I bytes are treated as attacker-controlled, so a truncated or hostile file yields an [Error], never a panic.

Structs

RecycleBinIndex

Decoded metadata from a single $I index file.

RecycleBinPair

A matched $I/$R pair (or a lone $I) discovered by a directory scan.

Enums

Error

Errors returned while parsing a $I index file.

IndexVersion

The format version recorded in a $I file’s 8-byte version field.

Functions

parse_index

Parse the raw bytes of a $I index file.

scan_pairs

Scan a directory for $I index files and pair each with its $R content file by the trailing identifier + extension.