<!-- Creator : groff version 1.22.3 -->
<!-- CreationDate: Thu May 9 02:07:51 2019 -->
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta name="generator" content="groff -Thtml, see www.gnu.org">
<meta http-equiv="Content-Type" content="text/html; charset=US-ASCII">
<meta name="Content-Style" content="text/css">
<style type="text/css">
p { margin-top: 0; margin-bottom: 0; vertical-align: top }
pre { margin-top: 0; margin-bottom: 0; vertical-align: top }
table { margin-top: 0; margin-bottom: 0; vertical-align: top }
h1 { text-align: center }
</style>
<title>RIFIUTI2 0.7.0</title>
<style type="text/css"> body { width: 800px; margin: 0px auto; } </style>
</head>
<body>
<h1 align="center">RIFIUTI2 0.7.0</h1>
<a href="#INSTALLATION ON WINDOWS">INSTALLATION ON WINDOWS</a><br>
<a href="#LATEST CHANGE">LATEST CHANGE</a><br>
<a href="#SYNOPSIS">SYNOPSIS</a><br>
<a href="#DESCRIPTION">DESCRIPTION</a><br>
<a href="#OPTIONS">OPTIONS</a><br>
<a href="#EXAMPLES">EXAMPLES</a><br>
<a href="#ENVIRONMENT VARIABLES">ENVIRONMENT VARIABLES</a><br>
<a href="#EXIT STATUS">EXIT STATUS</a><br>
<a href="#HISTORY">HISTORY</a><br>
<a href="#CAVEATS">CAVEATS</a><br>
<a href="#REPORTING BUGS">REPORTING BUGS</a><br>
<a href="#SEE ALSO">SEE ALSO</a><br>
<a href="#COPYRIGHT">COPYRIGHT</a><br>
<a href="#AUTHOR">AUTHOR</a><br>
<hr>
<p style="margin-top: 1em"><body text="black" bgcolor="#bbffee" link="blue" alink="blue" vlink="#302226"></p>
<h2>INSTALLATION ON WINDOWS
<a name="INSTALLATION ON WINDOWS"></a>
</h2>
<p style="margin-left:11%; margin-top: 1em"><b>Rifiuti2</b>
is designed to run as portable Windows <i>command line</i>
application, and no installation is required. Extract zip
file onto any folder of your choice and programs are ready
for use. Read sections below on how to use them.</p>
<p style="margin-left:11%; margin-top: 1em"><b>Translation</b>
<br>
By default output messages of rifiuti2 are in English. The
program shall be able to pick up translation automatically
if user has correct Region / Language setting. This setting
is under "Formats" tab of "Region and
Language" (name may vary for different versions of
Windows).</p>
<p style="margin-left:11%; margin-top: 1em">Optionally one
may use <tt>LANGUAGE</tt> environment variable to force
using certain translation. Supported language codes are the
same as existing subdirectory names under
<tt>rifiuti2−l10n</tt> folder. For example, assuming
folder <tt>rifiuti2−l10n\fr\</tt> exists, running
following in Windows console would enable French
translation:</p>
<p style="margin-left:22%;"><tt>set LANGUAGE=fr</tt></p>
<p style="margin-left:11%;">The file <tt>rifiuti.pot</tt>
in archive contains translation template for rifiuti2.
Rifiuti2 makes use of <b>gettext</b> for handling
translation. There are lots of tutorial on internet on how
to work with gettext translations; any completed translation
can be submitted to main author for inclusion in next
release.</p>
<h2>LATEST CHANGE
<a name="LATEST CHANGE"></a>
</h2>
<div style="margin-left:11%; margin-top: 1em">
<strong>Feature Addition</strong>
<ul>
<li>Support recycle bin from jurassic Windows: 95, NT4, ME (Issue #9)</li>
<li>Verified to work for recycle bin on network shared folder using
UNC path (such thing is rare but does exist)</li>
<li>Display timezone in tab-delimited output header</li>
<li>Guess Windows version based on recycle bin artifacts</li>
<li>Distributed Windows binaries:
<ul>
<li>Copes better with Windows ACL, detecting folder with
insufficient permissions</li>
<li>Attempts to detect Windows locale setting and automatically determine
translation to use</li>
</ul></li>
</ul>
<strong>Change</strong>
<ul>
<li>Now <strong>mandates UTF-8 locale except on Windows</strong>
<ul>
<li>File output is also in UTF-8 encoding under Windows</li>
<li><code>-8</code> option is rendered obsolete as a result</li>
</ul></li>
<li><strong>Distributed Windows binaries can only run on Vista or above</strong>
<ul>
<li>Windows XP/2003 support removed due to glib changes</li>
</ul></li>
<li>Won't overwrite destination file if it already exists</li>
<li><code>$Recycle.bin</code> version:
<ul>
<li>Not printing file size field if it is corrupt</li>
<li>Exit with error status whenever errors are found in any entry,
not just the last entry</li>
</ul></li>
<li><code>INFO2</code> version:
<ul>
<li>Restricts the choice of legacy path character encoding; generally,
all encodings not ASCII compatible are disallowed</li>
</ul></li>
<li>Building requirement changes
<ul>
<li>Remove GNUism for part of build toolchain (<code>make</code>, <code>awk</code>)</li>
<li>Use external GNU gettext instead of obsolete <code>glib-gettextize</code></li>
</ul></li>
</ul>
<strong>Bug fix</strong>
<ul>
<li>Fix unicode display on Windows console (Issue #12)</li>
<li>More robust handling of invalid or undecipherable characters,
displaying escaped hex or unicode sequences in such cases (Issue #5)</li>
</ul>
</div>
<p style="margin-left:11%; margin-top: 1em"><a href="https://github.com/abelcheung/rifiuti2/blob/master/NEWS.md">Changes for previous versions</a>
are available on Github.</p>
<h2>SYNOPSIS
<a name="SYNOPSIS"></a>
</h2>
<p style="margin-left:11%; margin-top: 1em"><b>rifiuti</b>
or <b>rifiuti-vista</b> [<b>−hv</b>]</p>
<p style="margin-left:11%; margin-top: 1em"><b>rifiuti</b>
[<b>−x</b> | [<b>−n</b>] [<b>−t</b>
<i>delim</i>]] [<b>−z</b>] [<b>−l</b>
<i>codepage</i>] [<b>−o</b> <i>outfile</i>]
<i>filename</i></p>
<p style="margin-left:11%; margin-top: 1em"><b>rifiuti-vista</b>
[<b>−x</b> | [<b>−n</b>] [<b>−t</b>
<i>delim</i>]] [<b>−z</b>] [<b>−o</b>
<i>outfile</i>] <i>file_or_directory</i></p>
<h2>DESCRIPTION
<a name="DESCRIPTION"></a>
</h2>
<p style="margin-left:11%; margin-top: 1em">Rifiuti2
analyse recycle bin files from Windows. Analysis of Windows
recycle bin is usually carried out during Windows computer
forensics. Rifiuti2 can extract file deletion time, original
path and size of deleted files and whether the deleted files
have been moved out from the recycle bin since they are
trashed.</p>
<p style="margin-left:11%; margin-top: 1em">Rifiuti2
supports a wide range of Windows versions, from Windows 95
to Windows 10. The command used for analysis depends on the
version of Windows producing the recycle bin (<b>not the
version of users’ system!</b>), which uses vastly
different format before and after Vista: <tt><br>
rifiuti-vista</tt></p>
<p style="margin-left:22%;">For Vista or later, which is
located in
<tt>\$Recycle.bin\</tt><i><SID></i><tt>\</tt>. Each
deleted file has its own accompanied index file remembering
the original path, file size and deletion time. If original
file is permanentsly deleted, so is the index file.</p>
<p style="margin-left:11%;"><tt>rifiuti</tt></p>
<p style="margin-left:22%;">For Windows 95 to XP/2003,
which uses a single index file named <tt>INFO2</tt> (98 or
above) or <tt>INFO</tt> (95 and NT4) under either
<tt>\RECYCLED\</tt> (FAT 16/32) or
<tt>\RECYCLER\</tt><i><SID></i><tt>\</tt> (NTFS). This
file keeps track record for deletion status and info for
<i>all</i> deleted items, including those permanently
removed or restored.</p>
<p style="margin-left:11%; margin-top: 1em">By default,
both programs dump tab-delimited fields on screen, which can
be viewed on screen or imported into spreadsheet program.
<b>−x</b> option instructs program to dump XML
formatted content instead.</p>
<p style="margin-left:11%; margin-top: 1em"><b>Since 0.7.0
version</b>, rifiuti2 output is in UTF-8 encoding only,
including the case of writing file under Windows.</p>
<p style="margin-left:11%; margin-top: 1em">Index field has
different meaning for pre-Vista and post-Vista versions.
INFO2 has an index number fo
数字取证之Autopsy的下载安装及学习使用
1星 需积分: 0 101 浏览量
2023-05-27
16:26:07
上传
评论
收藏 2.12MB ZIP 举报 
rifiuti2-0.7.0-win-x86_64.zip （5个子文件） 
rifiuti2-0.7.0-win-x86_64 
README.html 22KB
rifiuti.exe 1.83MB rifiuti2-l10n zh_HK LC_MESSAGES 
rifiuti2.mo 11KB rifiuti2.pot 10KB rifiuti-vista.exe 1.83MB资源评论
weixin_520293572023-08-21毛用没有 #标题与内容不符
weixin_436959102023-07-18#毫无价值
不会挖洞的北陌12023-10-11#标题与内容不符
