The Recycle Bin exists as a metaphor for throwing files away, but it also allows user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin?

In Windows operating systems prior to Vista (e.g., Windows XP, 2000, and 2003), the INFO2 file serves as the index or database for the Recycle Bin. This hidden system file, located in the RECYCLER directory, maintains a record for every item sent to the Recycle Bin. Each record contains crucial metadata, including the original full path of the deleted file, its size, and the timestamp of its deletion. This information is essential for the operating system to manage the contents of the Recycle Bin and to facilitate the restoration of files to their original locations.

B. INFO1 file: This is not a standard file name used by the Windows Recycle Bin for indexing deleted files in any major version.
C. LOGINFO2 file: This is a fabricated file name; the Windows Recycle Bin does not use a file with this name for its operations.
D. LOGINFO1 file: This is also a fabricated file name and is not associated with the functionality of the Windows Recycle Bin.

1. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. In Chapter 13, "Windows File System Analysis," Section 13.4.2, "Recycle Bin," the structure of the RECYCLER directory on NTFS volumes is detailed, explicitly identifying the INFO2 file as the index file that contains records of deleted files, including their original names and deletion times (pp. 348-349).

2. Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet (3rd ed.). Academic Press. Chapter 14, "Windows and DOS Systems," discusses Windows artifacts. It describes the pre-Vista Recycle Bin structure, noting that "In Windows 2000/XP, a file named INFO2 in the Recycler directory contains the original filename, path, size, and time of deletion for each file in the Recycle Bin" (p. 465).

3. Department of Computer Science, University of New Orleans. (n.d.). CSC 4444/5444 Computer Forensics Lecture 11: Windows Forensics. [Courseware]. The lecture notes describe the evolution of the Windows Recycle Bin, stating, "In Windows XP, each logical drive had a RECYCLER folder... Inside this folder was an INFO2 file that kept track of the files in the recycle bin." (Slide 23).