Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. $Recycle.Bin
  3. S-1-5-18
FolderRisk: Caution
  • Access denied

S-1-5-18 C:\$Recycle.Bin\S-1-5-18

Recycle Bin of the Local System account (SID S-1-5-18): files deleted by processes running as System.

Updated on By AltF4 Formation

What it’s for

Every volume has a hidden $Recycle.Bin folder with one subfolder per user SID. S-1-5-18 is the SID of the System account (Local System), the identity of services configured to log on that way and of the operating system itself. So this subfolder receives whatever processes running as System send to the Recycle Bin.

What it contains

  • Normally few or no files: items deleted by services or scheduled tasks running as System.
  • $I (original path, size, deletion time) and $R (data) pairs for each item, as in the other Recycle Bin subfolders.
  • Permissions that do not grant access to an interactive administrator, so File Explorer answers “Access denied”.

Risks and best practices

  • The Recycle Bin recreates this folder and the system relies on it, so do not take ownership to empty it by hand.
  • An abnormal volume here points to a service or scheduled task that deletes many files. Trace it back to the source rather than trying to clean up.

Useful commands

Fenêtre de terminal
# Account name behind the folder's SID
(New-Object Security.Principal.SecurityIdentifier 'S-1-5-18').Translate([Security.Principal.NTAccount])


# Recycle Bin subfolders and their attributes (administrator recommended)
Get-ChildItem 'C:\$Recycle.Bin' -Force -ErrorAction SilentlyContinue | Select-Object Name, Attributes


# Folder permissions (only System is allowed in)
icacls 'C:\$Recycle.Bin\S-1-5-18'

Report a mistake