Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Read Windows Recycle Bin files on Mac


  • Please log in to reply
10 replies to this topic

#1 willywolf

willywolf

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:17 AM

Posted 21 January 2016 - 08:00 PM

Hi,

I've been forced for time reasons to use a flash drive of mine to deliver some files to a customer. Before I give it to anybody else , I use to empty it. But now I'm afraid some private files of mine might be stuck in the recycle bin. I know flash drives on Windows usually don't have a recycle bin, but I read some models do. I also read you can't access somebody else's recycle bin from a different machine, since Windows marks all the files with a specific user ID. But what if there were a recycle bin, and somebody used that flash drive on a Mac/Linux based machine? Would he be able to see the files, since the recyclebin is just another directory to MacOS? Thank you



BC AdBot (Login to Remove)

 


#2 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:17 AM

Posted 24 January 2016 - 01:06 PM

Can you give more details regarding "I use to empty it"? What do you do exactly to "empty it"?


Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#3 willywolf

willywolf
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:17 AM

Posted 24 January 2016 - 04:20 PM

I right click the file icons and choose 'Delete' in the popup menu


Edited by willywolf, 24 January 2016 - 04:20 PM.


#4 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:17 AM

Posted 24 January 2016 - 05:01 PM

So you still have the USB stick?

Can you use the command-line? (cmd.exe)


Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#5 willywolf

willywolf
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:17 AM

Posted 24 January 2016 - 05:13 PM

No, I don't have it currently



#6 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:17 AM

Posted 24 January 2016 - 05:15 PM

OK, but do you know how to use the command-line?


Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#7 willywolf

willywolf
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:17 AM

Posted 24 January 2016 - 05:17 PM

It's the old DOS interface, isn't it? What am I supposed to do with it?



#8 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:17 AM

Posted 24 January 2016 - 05:39 PM

Open a command-line (start cmd.exe) and then type the letter of your USB stick you inserted (for example F:).

Then type dir /a:sh

This will show you all the hidden and system files/folders.

Check if you have a name that says something like recycle.

If you do, then you have a recycle bin on your stick.

 

But in any case, even if you have a recycle bin and empty it, the files can still be easily recovered with appropriate tools (undelete tools).

If you want to make sure that the files can not be undeleted, I recommend you use sdelete from Microsoft Sysinternals.

It's also a command-line tool.


Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#9 willywolf

willywolf
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:17 AM

Posted 24 January 2016 - 05:55 PM

Undelete tools work only if the file has been deleted right before you give away your key. If it's been deleted some months before (it's my case), and other files were installed abnd removed in the meantime, then undeletion shouldn't be effective, since the old file blank bits have been already overwritten. A recycle bin on the current drive can also be detected opening  the Windows trash bin properties dialog and searching for your volume letter in the drive list. However, I don't have the key currently, nor do I think I'll be able to get it back. However, I've tried several usb keys on the notebook and none of them seems to have a recycle bin. Are there any flash drives with a recycle bin on Windows?



#10 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:17 AM

Posted 24 January 2016 - 06:12 PM

I've seen $RECYCLE.BIN on 64+ GB NTFS sticks.


Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#11 willywolf

willywolf
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:17 AM

Posted 24 January 2016 - 06:16 PM

I remember mine was about 32GB and FAT32






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users