Shulou(Shulou.com)06/02 Report--

How to get the contents of the recycle bin remotely in Python, I believe that many inexperienced people are helpless about this, so this article summarizes the causes and solutions of the problem, through this article I hope you can solve this problem.

Get Recycle Bin Content

Why are we going to get the recycle bin files? Because in many cases forensic investigation needs to obtain historical traces of remote targets, recycling bins are an important target. In Windows operating systems, Recycle Bin is a special folder dedicated to storing deleted files.

On Windows 98 systems that use FAT file systems, the Recycle Bin directory is usually C:\Recycled; on Windows NT2000, Windows XP, and supported NTFS operating systems, C:\Recycle; and on Windows Vista and Windows 7, the Recycle Bin directory is C:\$Recycle.Bin. As shown below, the Recycle Bin contains two files, located on the desktop and in the D disk directory.

The first step is to check whether the recycle bin directory exists.

Third, write code to get the directory where the Recycle Bin folder is located.

The fourth step is to use python to associate the SID of the user, and use the Windows registry to convert the SID to an accurate user name.

By checking Windows registry keys

HKEYLOCALMACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProfileImagePath

Write a function to convert each SID to a username. This function will open the registry and check the ProfileImagePath key, find its value, and find the username from it.

The fifth step is to obtain all the contents of the recycle bin. The complete code is as follows.

The output is shown below:

(2)Call SHFileOperation function to delete files to recycle bin.

A shell function named SHFileOperation is defined in Windows shellapi file, which can realize various file operations, such as copying, deleting, moving, etc. The function is very simple to use, it only has one parameter pointing to SHFILEOPSTRUCTURE structure.

Note that registry operations may encounter the "PermissionError: [WinError 5] access denied" problem, we need to set the Python.exe username full control, and open it in administrator mode to solve it.

After reading the above, do you know how to get the contents of the recycle bin remotely in Python? If you still want to learn more skills or want to know more related content, welcome to pay attention to the industry information channel, thank you for reading!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.