recyclebin¶
$ target-query <path/to/target> -f recyclebin
Module |
|
Output |
|
Module documentation
Linux GNOME Trash plugin.
Function documentation
Yield deleted files from GNOME Trash folders.
Recovers deleted files and artifacts from $HOME/.local/share/Trash.
Probably also works with other desktop interfaces as long as they follow the Trash specification from FreeDesktop.
Also parses media trash locations such as /media/$USER/$Label/.Trash-*, /mnt/$Label/.Trash-* and other
locations as defined in /etc/fstab.
- Resources:
Yields TrashRecord records with the following fields:
ts (datetime): timestamp when the file was deleted or for expunged files when it could not be permanently deleted
path (path): path where the file was located before it was deleted
filesize (filesize): size in bytes of the deleted file
deleted_path (path): path to the current location of the deleted file
source (path): path to the .trashinfo file
Module |
|
Output |
|
Module documentation
Recyclebin plugin.
Function documentation
Return files located in the recycle bin ($Recycle.Bin).
Yields RecycleBinRecords with fields:
hostname (string): The target hostname
domain (string): The target domain
ts (datetime): The time of deletion
path (uri): The file original location before deletion
filesize (filesize): Filesize of the deleted file
sid (string): SID of the user deleted the file, parsed from $I filepath
user (string): Username matching SID, lookup using Dissect user plugin
deleted_path (uri): Location of the deleted file after deletion $R file
source (uri): Location of $I meta file on disk