Skip to content

Instantly share code, notes, and snippets.

@atcuno atcuno/gist:4228600
Created Dec 6, 2012

Embed
What would you like to do?
parseI.py
# Written By: Andrew Case / andrew [ @ ] memoryanalysis.net
# Script based off file structure documented at:
# http://www.forensicfocus.com/downloads/forensic-analysis-vista-recycle-bin.pdf
# prints CSV list of file size, delete time in local time, and full path on disk of deleted file
import sys, struct, datetime, os
def parse_i_file(i_file_path):
try:
filebuf = open(i_file_path, "rb").read()
except:
print "Unable to open given file: %s" % i_file_path
sys.exit(1)
(magic, file_size, raw_delete_time) = struct.unpack("<QQQ", filebuf[:24])
epoch_delete_time = 10**-7 * raw_delete_time - 11644473600
delete_time = datetime.datetime.fromtimestamp(epoch_delete_time).strftime('%Y-%m-%d %H:%M:%S')
fullpath = filebuf[24:]
idx = fullpath.find("\x00\x00")
if idx != -1:
fullpath = fullpath[:idx]
print "%d,%s,%s" % (file_size, delete_time, fullpath)
def usage():
print "python %s <path to directory of I files>" % sys.argv[0]
sys.exit(1)
def main():
if len(sys.argv) < 2:
usage()
recycledir = sys.argv[1]
for root, dirs, files in os.walk(recycledir):
for file in files:
if file[0:2] == "$I":
parse_i_file(os.path.join(recycledir, file))
if __name__ == "__main__":
main()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.