What Was Deleted, From Where, and When RECYCLE
For every file sent to the Windows Recycle Bin, a small $I index file records where it came from, how big it was and when. Read them here, even after the deleted content is gone.
1. The index files
The $I files out of a Windows Recycle Bin. Drop as many as you like at once; each is read here and never written to.
C:\$Recycle.Bin\<user SID>, with hidden and system files shown. Nothing is uploaded.
No files open yet.
2. What was deleted
What this tells you, and what it does not
Each row is one $I record, read straight from its bytes: the original path, the size, and the deletion time on that machine's clock. It survives the deleted content being purged, so it answers what was there even when the file is gone. It does not recover the file, it cannot say who deleted it, and a file absent from the bin may have been purged or removed with Shift+Delete, which writes no $I at all. Hash the files with CHECKSUM and record where they came from with CHAIN before resting anything on them.