recycle bin restoration and bypass artifact detector — free browser tool | fatcousin

drop mft csv and usn journal csv · detect files restored from the recycle bin · identify files sent to recycle bin then immediately restored (suspicious cycling) · surface recycle bin bypass using shift-delete · runs locally

mft / usn / $I csv

drop mft, usn journal, and $I listing csv

or click

Select file

USN: RENAME to/from $Recycle.Bin · MFT: $I/$R paths · RBCmd $I listing for original path recovery

drop mft csv, usn journal csv, and/or $I listing csv (multi-file)

ready