Skip to content

Phase 2 — Recycle Bin INFO2 / $I$R metadata parser (CFReDS gap G-003) #54

Description

@Juwon1405

Source

Opened from CFReDS Hacking Case integration (case-08).

Gap

No recycle bin metadata parser in v0.5.3.

Blocks

  • F-CFR-008 (4 executable files in recycle bin)

Proposal

@register_tool
def parse_recycle_bin(recycler_path: str) -> dict:
    """Parse INFO2 (XP) or $I/$R pairs (Vista+)."""

Estimate

1-2 days. Format documented in Microsoft KB and Forensic Wiki.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:mcpArea: dart-mcp (typed forensic surface)from-cfreds-benchmarkphase-2Phase 2 — Agentic detection engineeringpost-sansDefer until after SANS submission (Jun 15)status:todoNot yet started

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions