// Windows Recycle Bin "PurgeInfo" Analysis by Daniel Marschall, ViaThinkSoft // Location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\BitBucket: PurgeInfo (Binary) // All fields are stored as Little Endian, e.g. 0x00000048 is saved as 48 00 00 00. // Checked with Windows 95b with 1 FAT32 drive. struct PurgeInfo { // Size of the struct DWORD dwSize; // 0 = Individual settings for every drive // 1 = Global settings for all drives BOOL bGlobalSettings; // Usage percentage (0x00=0% ... 0x64=100%) // Index 0 = Drive A // Index 25 = Drive Z // Index 26 = Network Home Drive (Drive '@') // Index 27 = Global WORD wPercentageDrive[28]; // "Nuke on Delete" bitfield // Bit 0 = Drive A // Bit 25 = Drive Z // Bit 26 = Network Home Drive (Drive '@') // Bit 27 = Global // Bit 28..31 probably unused DWORD dwNukeOnDelete; // "Dummy value" to have a different dwSize // example value: 0x00020D04 DWORD unknown; };