你在Windows中删除一个文件，它会被扔进回收站，然后你再把它捞出来。在整个过程中到底发生了什么？

今天的问答环节是由SuperUser提供的，SuperUser是Stack Exchange的一个分支，是一个由社区驱动的问答网站分组。

问题

超级用户读者Jonath0n对回收站很好奇：

What does the Recycle Bin in Windows actually do? Is it just a glorified folder and a holding place for soon to be deleted files, or does it do something specific? Specifically, are files that are “moved” to the Recycle Bin actually moved on the hard disc, or are just the pointers to the files moved? I am a fairly experienced user, I just wanted a more depth explanation of the Recycle Bin.

那是怎么回事？回收站究竟是如何作为一种文件炼狱的？

答案

超级用户贡献者Tim Wij**an提供了一个幕后的高峰：

The reference is removed, a metadata file is kept in the Recycle Bin to know the original location.

In the early days, on Windows 95 and 98 this was located in \RECYCLED. On Windows 2000 and later it was renamed to \RECYCLER. Since Windows Vista it is now a special folder called \$Recycle.Bin.

Use Process Monitor to see the I/O under the hood, put a filter on Recycle.Bin and visit it. :)

For example, when I do this:

Note: The long folder name is a User SID. The last folder name is a hash based on the metadata.

I get a file that contains metadata information like this:

The reason that the file path has spaces in between is because it is stored in wide byte chars, to support special characters for certain languages as well as unicode and what else. The earlier symbols are binary and contain information like the file size and permissi***, as well as a pointer to the file data. In essence, it contains enough information to rec***truct the original reference…

It’s sad that the Windows Internals book doesn’t cover this, or else I would’ve had more reference. I haven’t found any articles that go into detail on this, neither by Microsoft or by third party people. They probably do exist but I found it easier to go and reverse engineer the main concept…

有什么要补充的解释吗？在评论中发出声音。想从其他精通技术的Stack Exchange用户那里了解更多答案吗？在这里查看完整的讨论主题。