views:

23

answers:

1

Where on my computer would I be able to find the last date that the recycle bin was last emptied, would such an event be stored in the windows system logs? and if so where?

Thanks :)

+1  A: 

I doubt it would be recorded anywhere in the event logs, but there might be file system traces left.

UPDATE: using UnixTools I can confirm there are file system traces left. If you navigate to C:\$Recycle.Bin there will be a number of entries (even with the bin appearing empty). These entries appear to correspond to security IDs (SIDs) on the system. In my test the most recently modified one was the date and time I last emptied the recycle bin.

This means it probably can be retrieved programatically with the Windows API.

Konrad
er, probably only as long as you haven't added anything to the bin since it was emptied. You're talking about the last modified date right?
Martin Smith
Correct. If the recycle bin is completely empty then you can get the date/time it was emptied. Else you get the date/time the latest file was 'recycled'.
Konrad