@port139 Blog

基本的にはデジタル・フォレンジックの技術について取り扱っていますが、記載内容には高確率で誤りが含まれる可能性があります。

Windows 10 Storage sense and Recycle.bin

Note:I translated Japanese into English using Google Translate.
Thank you, Google.  

Summary:

  • I tested the Recycle.bin delete option of the Storage sense feature.
  • Files in Recycle.bin are deleted by task SilentCleanup??.
  • Sample JPEG file in Recycle.bin on volume C has been deleted.
    However, Files in Recycle.bin of volumes E and F were not deleted.

---

Recycle.bin is automatically cleaned up when you enable the Storage sense option of Windows 10. Enable the option in the test environment and confirm the execution of the task to delete the file.

f:id:hideakii:20181224121043p:plain

The delete option of recycle.bin specifies 1 day.

f:id:hideakii:20181224121306p:plain

The relevant registry keys are below.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\StoragePolicy

01 ⇒ Storage sense ON(=1)
2048 ⇒ Run Storage sense: Every day(=1)
04 ⇒ Delete temporary files that my apps aren't using
256 ⇒ 1day

f:id:hideakii:20181224121429p:plain

Move sample JPEG files to the recycle bin on the C, E, F volume.
Volumes C: and F: are NTFS and volume E: is ReFS.(These volumes are fixed disk.)

f:id:hideakii:20181224121624p:plain

You can not move files to the Recycle.Bin on removable disks.

f:id:hideakii:20181224121743p:plain

Two days later, I confirmed that the file on volume C: has been deleted.
Files on volumes E: and F: were not deleted.

f:id:hideakii:20181224121857p:plain

When was the sample JPEG file deleted?
Check the date and time that the sample JPEG file was deleted in USN Journal.

f:id:hideakii:20181224122000p:plain

In the event log, find the task executed when deleting the file. I found a time very close to the file deletion, but it does not match perfectly.
From the contents of the message, I guess that this task deleted the file.

f:id:hideakii:20181224122039p:plain

However, file deletion is recorded one second after completion of the task.

In the USN Journal, there were several records of files deleted at the same time. I am interested in what files SilentCleanup task deletes.

I need to verify further.

 

Verification environment: Windows 10 1803

Reference URL:

blogs.technet.microsoft.com

www.tenforums.com

f:id:hideakii:20181224120707j:plain