There were two accounts on my Windows 7 computer, UserA and UserB. I had files in the Recycle Bin of UserB, then I deleted that account while logged in as UserA.
What happened to the files in UserB's Recycle Bin? How can I recover them?
Well, I don’t know for sure what happens when an account is deleted, but that’s an easy enough experiment to perform, if you have administrator access. How can you do that experiment? How can you recover the files? How can you access them as a user other than the owner?
In a Command Prompt,
cd \$Recycle.Bin and do
You’ll get something like this:
Directory of C:\$Recycle.Bin 02/15/2015 09:13 AM <DIR> . 02/15/2015 09:13 AM <DIR> .. 08/13/2014 03:49 PM <DIR> S-1-5-18 02/15/2015 09:13 AM <DIR> S-1-5-20 05/03/2015 01:52 PM <DIR> S-1-5-21-524270083-2407456217-743395210-1000 09/02/2015 10:56 AM <DIR> S-1-5-21-524270083-2407456217-743395210-1001 02/07/2015 04:17 PM <DIR> S-1-5-21-524270083-2407456217-743395210-1004 08/13/2014 12:46 PM <DIR> S-1-5-21-524270083-2407456217-743395210-500 0 File(s) 0 bytes 8 Dir(s) 123,456,789,042 bytes free
These are the Recycle Bins for all the users.
If you use an elevated Command Prompt,
dir/a/q will show you the owner of each folder.
On my system,
S-1-5-20is NETWORK SERVICE
S-1-5-21-…-500is the built-in Administrator account
S-1-5-21-…-1000is the administrator account that I created when I initialized the system
S-1-5-21-…-1001is the ordinary account for myself that I created immediately thereafter
S-1-5-21-…-1004is an account for somebody else, which I created a few weeks later.
I’ve never deleted an account on my machine, so I’m not sure,
but, according to the OP,
a user’s Recycle Bin folder doesn’t get deleted when the user is deleted
(and neither does the home directory). In this case,
dir/a/q will report
... as the owner for file(s) and folder(s).
You may be able to map the
S-1-5-21-…- strings to user names
by running Registry Editor (as administrator) and looking in
Try these steps:
HKEY_USERS\S-1-5-21-…\Volatile Environmentand look at the values of
The user-defined environment variables
will be in
but this probably won’t help much,
because the variables that specify pathnames
are likely to be defined in terms of
S-1-5-21-…-strings to user names is to run the command
wmic useraccount get name,sid— you don’t even need to be privileged (elevated) to do this. I got this output:
Name SID Administrator S-1-5-21-524270083-2407456217-743395210-500 Guest S-1-5-21-524270083-2407456217-743395210-501 HomeGroupUser$ S-1-5-21-524270083-2407456217-743395210-1003 scott-admin S-1-5-21-524270083-2407456217-743395210-1000 scott-friend S-1-5-21-524270083-2407456217-743395210-1004 scott-user S-1-5-21-524270083-2407456217-743395210-1001
As I said, I’ve never deleted an account on my machine, so I don’t know whether this will list deleted accounts.
P.S. In the above listing,
I changed the names of the
scott-… accounts for anonymity.
In actuality, the accounts were listed in alphabetic order (by name).
If you go into Windows Explorer,
uncheck the “Hide protected operating system files” option
in “Tools” → “Folder options …” → “View”,
and go to
\$Recycle.Bin, you’ll see something like this:
Note that the folder that is displayed as “Recycle Bin”
is actually the
S-1-5-21-…-1001 folder; i.e., my Recycle Bin.
(It gets displayed that way because of its
This folder also shows up as the Recycle Bin, on the Desktop.
Now that you know how to find another user’s Recycle Bin, you can simply
cdinto it, in an elevated Command Prompt, and copy files out. (You may need to use
xcopy, or at least something smarter than
copy.) Note: the files will not have their original names, but will have names like
$A7Q42J9.DOC. I don’t know how to recover the original names, but you may be able to do it by caveman forensics:
And, of course, if the deleted user’s Recycle Bin folder is gone, see How do I recover or “undelete” files that I accidentally deleted? and all its relatives. But now you know what you’re looking for.