The steps for Recycle bin content analysis with magnet AXIOM are as follows:
- Once your forensic image is processed, go to AXIOM Examine's artifact types pane, and scroll down to OPERATING SYSTEM, as shown in the following figure:
Figure 7.6. Operating system artifacts list
- As you can see, there are quite a lot of different operating system artifacts listed, including the Recycle Bin. In our case, there is only one file there. You can see it in the following figure:
Figure 7.7. Recycle Bin contents
- So, we have a link file ...