rbcmd

name	rbcmd
version	1.0.0
description	Parse and extract Windows Recycle Bin artifacts ($I files and INFO2) using Eric Zimmerman's RBCmd. Covers CLI flags, CSV output, and output field reference.
metadata	{"tool-name":"RBCmd","tool-vendor":"Eric Zimmerman"}

RBCmd Skill

RBCmd is Eric Zimmerman's command-line tool for parsing Windows Recycle Bin artifacts. It processes both modern $I files (Vista+) and legacy INFO2 files (XP and earlier), extracting deleted file metadata including original paths, file sizes, and deletion timestamps. Forensic interpretation of Recycle Bin data (deleted file recovery workflows, anti-forensics detection, etc.) belongs in a separate analysis skill.

Command Syntax

RBCmd.exe -f <file> [--csv <dir>] [other options]
RBCmd.exe -d <directory> ...

Single-letter options use a single dash (-). Multi-character options use double dashes (--).

Input (one required)

Flag	Description
-f	Single Recycle Bin file to process ($I file or INFO2)
-d	Directory to recursively process for Recycle Bin files

Output Formats

Flag	Description
--csv	Directory to write CSV output
--csvf	Custom filename for CSV output (overrides default)

It's recommended to specify at least one output format to write results to a file. Forensic output can be very large and may consume the context window. CSV is the most common choice for analysis with Timeline Explorer or Excel.

Options

Flag	Description	Default
-q	Suppress per-file output; show only filename being processed	FALSE
--dt	Custom date/time format string	yyyy-MM-dd HH:mm:ss
--debug	Show debug information	FALSE
--trace	Show trace information	FALSE

Common Output Fields (CSV)

Output columns depend on tool version.

Column	Description
FileSize	Size of the deleted file in bytes
FileName	Original full path of the deleted file
SourceName	Name of the source Recycle Bin file ($I file or INFO2)
DeletedOn	Timestamp when the file was deleted (UTC)
FileType	Recycle Bin file format version

Workflow Examples

Parse a single $I file to CSV

RBCmd.exe -f "C:\Cases\Evidence\$RECYCLE.BIN\S-1-5-21-...\$I3F0R2A.txt" --csv "C:\Cases\Output"

Parse a Recycle Bin directory

RBCmd.exe -d "C:\Cases\Evidence\$RECYCLE.BIN" --csv "C:\Cases\Output"

Parse with custom output filename

RBCmd.exe -d "C:\Cases\Evidence\$RECYCLE.BIN" --csv "C:\Cases\Output" --csvf RecycleBin_parsed.csv

Quick parse (suppress per-file details)

RBCmd.exe -d "C:\Cases\Evidence\$RECYCLE.BIN" --csv "C:\Cases\Output" -q

Parse from a mounted forensic image

RBCmd.exe -d "E:\$RECYCLE.BIN" --csv "C:\Cases\Output"