Skip to content

Instantly share code, notes, and snippets.

@atcuno atcuno/gist:4228600
Created Dec 6, 2012

What would you like to do?
# Written By: Andrew Case / andrew [ @ ]
# Script based off file structure documented at:
# prints CSV list of file size, delete time in local time, and full path on disk of deleted file
import sys, struct, datetime, os
def parse_i_file(i_file_path):
filebuf = open(i_file_path, "rb").read()
print "Unable to open given file: %s" % i_file_path
(magic, file_size, raw_delete_time) = struct.unpack("<QQQ", filebuf[:24])
epoch_delete_time = 10**-7 * raw_delete_time - 11644473600
delete_time = datetime.datetime.fromtimestamp(epoch_delete_time).strftime('%Y-%m-%d %H:%M:%S')
fullpath = filebuf[24:]
idx = fullpath.find("\x00\x00")
if idx != -1:
fullpath = fullpath[:idx]
print "%d,%s,%s" % (file_size, delete_time, fullpath)
def usage():
print "python %s <path to directory of I files>" % sys.argv[0]
def main():
if len(sys.argv) < 2:
recycledir = sys.argv[1]
for root, dirs, files in os.walk(recycledir):
for file in files:
if file[0:2] == "$I":
parse_i_file(os.path.join(recycledir, file))
if __name__ == "__main__":
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.