NAME

       rifiuti2 - A MS Windows recycle bin analysis tool

SYNOPSIS

       rifiuti [ -x ] [ -tnl8 ] [ -o outfile ] filename

       rifiuti-vista [ -x ] [ -n8 ] [ -o outfile ] file_or_directory

DESCRIPTION

       Rifiuti2  is  a  rewrite of rifiuti, a great tool from Foundstone folks for analyzing Windows Recycle Bin
       INFO2 file.  Analysis of Windows Recycle Bin is usually carried out during  Windows  computer  forensics.
       Rifiuti2  can extract file deletion time, original path and size of deleted files and whether the deleted
       files have been moved out from the recycle bin since they are trashed.  Rifiuti2 supports the INFO2  file
       format found in Windows up to Windows XP and the new file format found in Vista, and the program is fully
       internationalized.  If  you  need  to  analyse recycle bins of Windows Vista and Windows Server 2008, you
       should use the rifiuti-vista command, for other Windows platforms, you should use the rifiuti command.

       Quoting from original Foundstone page:

              Many computer crime investigations require the reconstruction of a subject's  Recycle  Bin.  Since
              this  analysis  technique  is executed regularly, we researched the structure of the data found in
              the Recycle Bin repository files (INFO2 files). Rifiuti, the Italian  word  meaning  "trash",  was
              developed  to  examine  the contents of the INFO2 file in the Recycle Bin. ... Rifiuti is built to
              work on multiple platforms and will execute on Windows (through Cygwin), Mac OS X, Linux, and *BSD
              platforms."

       Since the original rifiuti (last updated 2004) is restricted to  English  version  of  Windows  (fail  to
       analyze any non-latin character), thus this rewrite. But it does more:

         * Supports Windows in any other languages besides English
         * Supports Vista and 2008 (they don't use INFO2 file any more)
         * Enables localization (that is, translatable)
         * More rigorous error checking
         * Supports output in XML format

OPTIONS

       These are plain text output options:

       -t --delimiter=STRING
              String to use as delimiter (TAB by default)

       -n --no-heading
              Don't show header

       -l --legacy-filename
              Show legacy filename instead of unicode

       -8 --always-utf8
              Always show file names in UTF-8 encoding

              These are general application Options:

       -o --output=FILE
              Write output to FILE

       -x --xml
              Output in XML format (-t, -n, -l, -8 options will have no effect)

       --from-encoding=ENC
              The  assumed  file  name  character  set  when  no  unicode  file  name is present in INFO2 record
              (mandatory if INFO2 file is created by Win98, useless otherwise)

COPYRIGHT

       Part of the work of Rifiuti2 is derived from Rifiuti, both pieces of  software  are  licensed  under  the
       simplified BSD license.

AUTHOR

       The  main  author  of Rifiuti2 is Abel Cheung, and Anthony Wong helps in some packaging and documentation
       work (like this manpage).  The original author of Rifiuti is Keith J Jones.

0.5.0                                              2008-11-21                                        RIFIUTI2(1)