菜单
Parse and extract Windows Recycle Bin artifacts ($I files and INFO2) using Eric Zimmerman's RBCmd. Covers CLI flags, CSV output, and output field reference.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | rbcmd |
| version | 1.0.0 |
| description | Parse and extract Windows Recycle Bin artifacts ($I files and INFO2) using Eric Zimmerman's RBCmd. Covers CLI flags, CSV output, and output field reference. |
| metadata | {"tool-name":"RBCmd","tool-vendor":"Eric Zimmerman"} |
RBCmd is Eric Zimmerman's command-line tool for parsing Windows Recycle Bin artifacts. It processes both modern $I files (Vista+) and legacy INFO2 files (XP and earlier), extracting deleted file metadata including original paths, file sizes, and deletion timestamps. Forensic interpretation of Recycle Bin data (deleted file recovery workflows, anti-forensics detection, etc.) belongs in a separate analysis skill.
RBCmd.exe -f <file> [--csv <dir>] [other options]
RBCmd.exe -d <directory> ...
Single-letter options use a single dash (-). Multi-character options use double dashes (--).
| Flag | Description |
|---|---|
-f | Single Recycle Bin file to process ($I file or INFO2) |
-d | Directory to recursively process for Recycle Bin files |
| Flag | Description |
|---|---|
--csv | Directory to write CSV output |
--csvf | Custom filename for CSV output (overrides default) |
It's recommended to specify at least one output format to write results to a file. Forensic output can be very large and may consume the context window. CSV is the most common choice for analysis with Timeline Explorer or Excel.
| Flag | Description | Default |
|---|---|---|
-q | Suppress per-file output; show only filename being processed | FALSE |
--dt | Custom date/time format string | yyyy-MM-dd HH:mm:ss |
--debug | Show debug information | FALSE |
--trace | Show trace information | FALSE |
Output columns depend on tool version.
| Column | Description |
|---|---|
| FileSize | Size of the deleted file in bytes |
| FileName | Original full path of the deleted file |
| SourceName | Name of the source Recycle Bin file ($I file or INFO2) |
| DeletedOn | Timestamp when the file was deleted (UTC) |
| FileType | Recycle Bin file format version |
RBCmd.exe -f "C:\Cases\Evidence\$RECYCLE.BIN\S-1-5-21-...\$I3F0R2A.txt" --csv "C:\Cases\Output"
RBCmd.exe -d "C:\Cases\Evidence\$RECYCLE.BIN" --csv "C:\Cases\Output"
RBCmd.exe -d "C:\Cases\Evidence\$RECYCLE.BIN" --csv "C:\Cases\Output" --csvf RecycleBin_parsed.csv
RBCmd.exe -d "C:\Cases\Evidence\$RECYCLE.BIN" --csv "C:\Cases\Output" -q
RBCmd.exe -d "E:\$RECYCLE.BIN" --csv "C:\Cases\Output"
Parse and extract Windows Amcache.hve registry hive using Eric Zimmerman's AmcacheParser. Covers CLI flags, output formats (CSV), SHA-1 filtering, and output field reference for file entries, program entries, device data, and driver information.
Parse and extract Windows Application Compatibility Cache (ShimCache) from SYSTEM registry hive using Eric Zimmerman's AppCompatCacheParser. Covers CLI flags, CSV output, ControlSet selection, and output field reference.
Parse and extract Windows Event Log (.evtx) files using Eric Zimmerman's EvtxECmd. Covers CLI flags, output formats (CSV/JSON/XML), event filtering, Volume Shadow Copy support, and the map system.
Parse and extract Windows Jump List files (AutomaticDestinations and CustomDestinations) using Eric Zimmerman's JLECmd. Covers CLI flags, output formats (CSV/JSON/HTML), AppID mappings, and output field reference.
Parse and extract Windows shortcut (.lnk) files using Eric Zimmerman's LECmd. Covers CLI flags, output formats (CSV/JSON/XML/HTML), removable drive filtering, and output field reference.
Parse and extract NTFS artifacts ($MFT, $J USN Journal, $Boot, $SDS, $I30) using Eric Zimmerman's MFTECmd. Covers CLI flags, output formats (CSV/JSON/bodyfile), and output field reference.