Where Deleted Files Really Go: Recycle Bin Internals

The move you never see

Press Delete in Explorer and the file is not destroyed — it is moved to $Recycle.Bin at the root of the same drive, into a subfolder named after your account's security identifier. That per-user folder is why you never see other accounts' deleted files in your bin, even on a shared PC. Each deleted item arrives as a pair: a $R file holding the content itself, and an $I twin holding the metadata — the original full path, the size, and the exact moment of deletion. Restore is just the reverse reading: Explorer opens the $I twin, moves the $R file back to the recorded path, recreating any missing parent folders along the way, and deletes the pair.

Why some deletions skip the bin

The bin is a courtesy with rules, and the rules explain every "it never asked me" surprise. All of them trace back to one design decision: the bin is per volume, and it is quota-bound.

• Files larger than the bin's quota for that drive — Windows permanently deletes them and says so in the confirmation dialog
• Removable drives and network shares — no bin of yours exists there, so every delete is final
• A full bin — once the quota is reached, the oldest deletions are evicted permanently to make room for new ones
• The Properties checkbox "Don't move files to the Recycle Bin" — occasionally flipped by "optimization" suites, with educational consequences
• Shift+Delete — the explicit bypass that sends the file straight to the freed-record state, no detour
• Deletions from inside apps — terminals, editors and mail clients run their own delete, and most never involve the bin

What "empty the bin" really does

Emptying drops the $I/$R pairs and marks the space free; the content itself stays on the disk until something else overwrites it, which is the entire business model of file-recovery tools. On an SSD the story shortens: TRIM tells the drive to erase freed blocks in the background, so the rescue window after emptying is measured in minutes rather than months. Two practical upshots fall out of the mechanics. The $I metadata makes the bin a forensic record as much as an undo feature — deletion timestamps and original paths sit there in plain sight for anyone who looks. And if you emptied the bin by mistake, stop writing to that drive immediately: every new file lowers the odds that a recovery tool will find intact content underneath.

Questions and Answers

Read next