.TH RIFIUTI2 1 "2008-11-21" "0.5.0" "A MS Windows recycle bin analysis tool"

.SH NAME
rifiuti2 \- A MS Windows recycle bin analysis tool

.SH SYNOPSIS
.B rifiuti
.RB [ " \-x " ]
.RB [ " \-tnl8 " ]
[
.BI "\-o " outfile
]
.I filename

.B rifiuti-vista
.RB [ " \-x " ]
.RB [ " \-n8 " ]
[
.BI "\-o " outfile
]
.I file_or_directory

.SH DESCRIPTION
.I Rifiuti2
is a rewrite of 
.IR rifiuti ,
a great tool from Foundstone folks for
analyzing Windows Recycle Bin INFO2 file.  Analysis of Windows Recycle
Bin is usually carried out during Windows computer forensics.
.I Rifiuti2
can extract file deletion time, original path and size of deleted
files and whether the deleted files have been moved out from the
recycle bin since they are trashed.
.I Rifiuti2
supports the INFO2 file format found in Windows up to Windows XP and
the new file format found in Vista, and the program is fully
internationalized. If you need to analyse recycle bins of Windows
Vista and Windows Server 2008, you should use the
.I rifiuti-vista
command, for other Windows platforms, you should use the
.I rifiuti
command.

Quoting from original Foundstone page:

.RS
Many computer crime investigations require the reconstruction of a
subject's Recycle Bin. Since this analysis technique is executed
regularly, we researched the structure of the data found in the
Recycle Bin repository files (INFO2 files). Rifiuti, the Italian word
meaning "trash", was developed to examine the contents of the INFO2
file in the Recycle Bin. ... Rifiuti is built to work on multiple
platforms and will execute on Windows (through Cygwin), Mac OS X,
Linux, and *BSD platforms." 
.RE

Since the original
.I rifiuti
(last updated 2004) is restricted to English version
of Windows (fail to analyze any non-latin character), thus this
rewrite. But it does more:

  * Supports Windows in any other languages besides English
  * Supports Vista and 2008 (they don't use INFO2 file any more)
  * Enables localization (that is, translatable)
  * More rigorous error checking
  * Supports output in XML format 

.SH OPTIONS
These are plain text output options:
.TP
.B \-t --delimiter=STRING
String to use as delimiter (TAB by default)
.TP
.B \-n --no-heading
Don't show header
.TP
.B \-l --legacy-filename
Show legacy filename instead of unicode
.TP
.B \-8 --always-utf8
Always show file names in UTF-8 encoding

These are general application Options:
.TP
.B \-o --output=FILE
Write output to FILE
.TP
.B \-x --xml
Output in XML format (-t, -n, -l, -8 options will have no effect)
.TP
.B --from-encoding=ENC
The assumed file name character set when no unicode file name is present in INFO2 record (mandatory if INFO2 file is created by Win98, useless otherwise)

.SH COPYRIGHT
Part of the work of
.I Rifiuti2
is derived from
.IR Rifiuti ,
both pieces of software are licensed under the simplified BSD license.

.SH AUTHOR
The main author of
.I Rifiuti2
is Abel Cheung, and Anthony Wong helps in some packaging and documentation work (like this manpage).
The original author of
.I Rifiuti
is Keith J Jones.