C language > Work in progress

Undelete files

<< < (2/2)

Grincheux:
I know it's a very old post, but if that can help someone, hereis a very interesting link :
http://zwclose7.createaforum.com/windows-application/deleting-files-with-ntdeletefile/
https://undocumented.ntinternals.net/
http://www.exploit-monday.com/2013/06/undocumented-ntquerysysteminformation.html
http://www.mediafire.com/file/gj2inoktf6v9qii/ntdll.zip/file

Good night

Vortex:
DOS used to provide the undelete command, why M$ decided to remove it?

jj2007:
Good question. I got curious and made a little test:


--- Code: ---include \masm32\MasmBasic\MasmBasic.inc
  Init
  ShEx "D:\$RECYCLE.BIN\S-1-5-21-2217455635-831285763-2584204927-1003\$R53967L.png"
EndOfCode
--- End code ---

ShEx (ShellExecute...) works fine, I see the png.

Path copied by pressing Alt C in FreeCommander XE. Two problems:
- Windows Explorer doesn't show me the recycle bin.
- FreeCommander shows me the recycle bin, but the path I can copy is much different from the original. However, there is a column "original path"...

So I can restore a deleted file, but it's rather manual ;D

TimoVJL:

Find the Recycle Bin
Windows 10

Navigation

[0] Message Index

[*] Previous page