The case of deleted files not being sent to Recycle Bin

Every time users delete a file in Windows shell, Windows, by default, moves those files to Recycle Bin. (You know why.) Upon deleting them, by default, Windows prompts for confirmation.

Recycle Bin - Delete Confirmation dialog box Figure 1: Recycle Bin – Delete Confirmation dialog box

I love to disable Delete Confirmation dialog box that Windows shows before sending files to Recycle Bin. It’s a personal preference, that’s all.

However, a while ago, I realized that one of the computers under my administration always had an empty Recycle Bin. I created a new empty text file and deleted it. Upon pressing the Delete button on keyboard, the file disappeared but didn’t enter Recycle Bin; Recycle Bin remained empty; no confirmation dialog box or error message appeared either.

Incidentally, I had also deleted a file from my personal USB flash memory which I had plugged into the system a few minutes ago. It occurred to me that when I deleted the file on the USB flash memory, I had received a confirmation dialog box warning me that the file is being permanently deleted. (Regardless of whether the Recycle Bin Delete Confirmation dialog box is disabled or not, Windows normally shows another confirmation dialog box every time a file is being permanently deleted.) However, this was not an anomalous behavior: In Windows XP, USB flash drives are excluded from Recycle Bin; files deleted from them are permanently deleted. But still it didn’t explain why files deleted from my hard disk weren’t in my Recycle Bin.

Permanent deletion - Delete Confirmation dialog box Figure 2: Permanent deletion – Delete Confirmation dialog box

I concluded that when I selected a file stored on my hard disk and pressed Delete button, one and only one of the following had happened:

  1. The file was permanently deleted but Windows failed to notify me
  2. The file was indeed moved to Recycle Bin but the Recycle Bin window was somehow corrupt and didn’t show the contents of the Recycle Bin.

To find out which is the case, I opened Windows PowerShell and navigated to C:\RECYCLER, the hidden folder into which Windows stores the contents of the Recycle Bin. I meant to inspect the contents of this folder and see whether my deleted files are already in there. Then, I issued get-childitem -force command, which lists the contents of the folder. The result came as a surprise: The folder was empty; completely empty.

Even when the Recycle Bin is empty, C:\RECYCLER shouldn’t be completely empty. C:\RECYCLER should always contain on or more folders, each of which pertain to one of the user accounts in the computer. (Every user account on each Windows XP computer has a personal Recycle Bin of its own, isolated from that of the others.) The names of these folders differ, depending on the computer, but they have the general form of S-1-5-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, where each ‘x’ is a digit. Even when the Recycle Bin is completely empty, these folders may contain one or two files. However, normally, deleting these files and folders – or even deleting RECYCLER itself – makes no problem for Windows: Windows will re-create necessary files and folder structures when user sends another file into the Recycle Bin. On this particular computer however, this was not the case: Windows didn’t re-recreate necessary files and folders. It simply failed.

To make sure that Windows indeed deleted the files, I re-activated Recycle Bin confirmation prompt and tried deleting a test dummy file. Upon pressing Delete button, Windows notified me that it could not send file to Recycle Bin and that the file was being permanently deleted.

By this time, I had correctly guessed the cause of the problem: Windows could not create or move any file into C:\RECYCLER because Windows shell software, running under my user account, didn’t have Write permission on C:\RECYCLER; I had unwittingly denied it the Write permission. By default, Windows Setup software sets the NTFS permissions on the root of C: drive in a manner that every user may create files and folders in C:\. These NTFS permissions ensure that these files are owned by the user who created it and that no one else has access to them except system administrators. A while back, I had modified these permissions to ensure that nobody has the right to create a folder in the root of drive C. I wanted the users to store their files in their personal profile folders which were set to be backed up on a recurring basis. Unwittingly, these permissions were so set that they were propagated on the child objects that did not have any explicit NTFS permission of their and obeyed those of their parent folder.

By default, everyone can write to root of the driveFigure 3: By default, everyone can write to root of the drive

RECYCLER folder inherits those permissionsFigure 4: RECYCLER folder inherits those permissions

I do not know how C:\RECYCLER had ended up devoid of all files but I suspect that either of my disk cleaning utilities (TuneUp Utilities or CCleaner) must have had done it. Nonetheless, this emptiness had served me as clue to the cause of the problem. Having discovered the cause, I fixed the problem by attaching explicit NTFS permissions on RECYCLER folder.

I still prefer to disable Recycle Bin notification. But now, I am a bit reluctant to do this on computers that are not mine. On my own computer, however, I’ll keep an eye for NTFS permissions of RECYCLER folders in Sysinternals AccessEnum during my routine monthly patrols. It’s going to be fine.

Advertisements

Posted on 10 July 2010, in Windows Administration. Bookmark the permalink. Leave a comment.

Leave a comment

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: