User Recycle Bin (S-1-5-21-…) C:\$Recycle.Bin\S-1-5-21-…

One user's Recycle Bin on this volume, in a folder named after the user's SID; File Explorer shows the current session's bin. Each user can open only their own.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

On an NTFS volume, $Recycle.Bin holds one subfolder per account, named after its security identifier (SID). That is how the Recycle Bin keeps each user’s deletions apart, as the older RECYCLER folder did. SIDs of the form S-1-5-21-… denote local or domain accounts; the last number (RID) identifies the account, for example 500 for the built-in Administrator and 1000 or more for local accounts created afterwards.

In File Explorer the Recycle Bin is a virtual folder (FOLDERID_RecycleBinFolder). It presents the user with the items in their own subfolder, which Explorer never shows as is.

What it contains

For each deleted file, two files: $R<characters>.<extension> for the content and $I<characters>.<extension> for the metadata (original path, size, deletion date and time).
For a deleted folder, an $R… folder that keeps the tree.
Only what this account deleted on this volume.
Access limited to the owner and the system: an administrator must grant themselves access to read another account’s bin.

Risks and best practices

Restore through File Explorer. If you move an $R file by hand, its $I no longer matches anything.
Shift+Delete and command-line deletions bypass the Recycle Bin, so those files never end up here.
Empty the bin from File Explorer or with Clear-RecycleBin rather than deleting these folders, to keep the structure consistent.
In forensics, an $I file proves a deletion and keeps the original path. Copy them before emptying the bin of a suspect machine.
On a shared workstation, whatever the previous user deleted stays recoverable until their bin is emptied.

Useful commands

# Current account's SID, to find under C:\$Recycle.Bin
whoami /user

# As administrator: list bins by SID (access denied to other accounts without taking ownership)
Get-ChildItem 'C:\$Recycle.Bin' -Force -ErrorAction SilentlyContinue

# Simulate emptying the C: volume's recycle bin (remove -WhatIf to run)
Clear-RecycleBin -DriveLetter C -WhatIf

Report a mistake