Skip to content

Instantly share code, notes, and snippets.

@glassdfir
Last active January 25, 2021 22:06
Show Gist options
  • Save glassdfir/f30957b314ec39a8aa319420a29ffc76 to your computer and use it in GitHub Desktop.
Save glassdfir/f30957b314ec39a8aa319420a29ffc76 to your computer and use it in GitHub Desktop.
Conditional_Jump('^(\\x01|\\x02)',true,'Error',10)
Find_/_Replace({'option':'Regex','string':'^(\\x02.{23})(....)'},'$1',false,false,false,false)
Subsection('^.{24}(.*)',true,true,false)
Decode_text('UTF16LE (1200)')
Find_/_Replace({'option':'Regex','string':'^(.*).'},'\\nDeleted File Path: $1',false,false,false,false)
Merge()
Subsection('^.{16}(.{8})',false,true,false)
Swap_endianness('Raw',8,true)
To_Hex('None')
Windows_Filetime_to_UNIX_Timestamp('Seconds (s)','Hex')
From_UNIX_Timestamp('Seconds (s)')
Find_/_Replace({'option':'Regex','string':'^(.* UTC)'},'\\nFile Deletion Time: $1',true,false,true,false)
Merge()
Subsection('^.{8}(.{8})',true,true,false)
To_Hex('None')
Swap_endianness('Hex',8,true)
From_Base(16)
Find_/_Replace({'option':'Regex','string':'^(.*)'},'\\nDeleted File Size: $1 bytes',true,false,true,true)
Merge()
Find_/_Replace({'option':'Regex','string':'^.{8}'},'******** WINDOWS RECYCLE BIN METADATA ********',true,false,false,false)
Jump('Do Nothing',10)
Label('Error')
Find_/_Replace({'option':'Regex','string':'^.*$'},'This doesn\'t look like a Recycle Bin file to me ',true,false,true,false)
Label('Do Nothing')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment