Forensic Analysis of Microsoft Windows Recycle
This paper will discuss the internal data structures of the INFO2 file useful when conducting forensic analysis of a suspect¡¯s computer systems. This research was conducted because the data proprietary Microsoft Windows files lack proper documentation needed by forensic analysts. Furthermore, there is a lack of publicly available open source tools that will reconstruct the INFO2 file. This research attempts to solve both of these problems. NOTE : research conducted in 2003.
