parseI.py

gistfile1.txt

# Written By: Andrew Case / andrew [ @ ] memoryanalysis.net
# Script based off file structure documented at:
# http://www.forensicfocus.com/downloads/forensic-analysis-vista-recycle-bin.pdf

# prints CSV list of file size, delete time in local time, and full path on disk of deleted file

import sys, struct, datetime, os

def parse_i_file(i_file_path):
    try:
        filebuf = open(i_file_path, "rb").read()
    except:
        print "Unable to open given file: %s" % i_file_path
        sys.exit(1)

    (magic, file_size, raw_delete_time) = struct.unpack("<QQQ", filebuf[:24])

    epoch_delete_time = 10**-7 * raw_delete_time - 11644473600
    delete_time = datetime.datetime.fromtimestamp(epoch_delete_time).strftime('%Y-%m-%d %H:%M:%S')

    fullpath = filebuf[24:]
    idx = fullpath.find("\x00\x00")
    if idx != -1:
        fullpath = fullpath[:idx]

    print "%d,%s,%s" % (file_size, delete_time, fullpath)

def usage():
    print "python %s <path to directory of I files>" % sys.argv[0]
    sys.exit(1)

def main():
    if len(sys.argv) < 2:
        usage()

    recycledir = sys.argv[1]

    for root, dirs, files in os.walk(recycledir):
        for file in files:
            if file[0:2] == "$I":
                parse_i_file(os.path.join(recycledir, file))

if __name__ == "__main__":
    main()