Demo Videos

These demonstrations accompany the ADARE research paper. Each demo shows a complete experiment: creating a test file, deleting it through the GUI, and verifying that the expected forensic artifacts (trash bin entries, metadata) are produced.

Ubuntu 22.04 — File Deletion & Trash Bin Verification

This experiment creates a file in the user’s Documents folder, opens the Nautilus file manager, and moves the file to Trash via right-click context menu. ADARE then verifies that the file appears in ~/.local/share/Trash/files/ and that the .trashinfo metadata contains the correct original path and deletion timestamp.

Playbook:

playbook_ubuntu2204.yml
  1settings:
  2  idle: 2.0
  3  timeout: 600
  4  screenshot:
  5    format: "png"
  6    quality: 95
  7
  8variables:
  9  filename:
 10    type: string
 11    value: "testfile.txt"
 12    description: "Name of the file to be created and deleted"
 13
 14  filepath:
 15    type: path
 16    value: "{{ adare_user_documents }}/{{ filename }}"
 17    description: "Full path to the test file"
 18  
 19  trashbin_path:
 20    type: path  
 21    value: "{{ adare_user_home }}/.local/share/Trash"
 22    description: "Path to user's trash bin"
 23
 24  icon_filemanager_taskbar:
 25    type: string
 26    value: "nautilus_taskbar.png"
 27    description: "name of the file manager icon file"
 28
 29
 30
 31tests:
 32  - name: testfile_created
 33    description: 'Verify test file does exist before experiment'
 34    function: file_exists
 35    parameter:
 36      dst: '{{filepath}}'
 37  - name: testfile_deleted
 38    description: 'Verify test file was deleted successfully'
 39    function: file_does_not_exist
 40    parameter:
 41      dst: '{{filepath}}'
 42  - name: trashbin_check_file
 43    description: 'check if file exists in trashbin'
 44    function: file_exists
 45    parameter:
 46      dst: '{{trashbin_path}}/files/{{ filename }}'
 47  - name: trahsbin_check_info_file
 48    description: 'check if info file exists in trashbin'
 49    function: file_exists
 50    parameter:
 51      dst: '{{trashbin_path}}/info/{{ filename }}.trashinfo'
 52  - name: trashbin_check_info_date
 53    description: 'check if deletion date in info file is correct'
 54    function: file_content_equals
 55    parameter:
 56      dst: '{{trashbin_path}}/info/{{ filename }}.trashinfo'
 57      content: |
 58        [Trash Info]
 59        Path={{ filepath }}
 60        DeletionDate={{ deletion_timestamp | localtime | format('%Y-%m-%dT%H:%M:%S') | tolerance(5, -5) }}
 61
 62
 63actions:
 64  - command:
 65      name: "Create Test File"
 66      description: "create the to deleted file"
 67      command: "echo 'This is a test file.' > {{ filepath }}"
 68      shell: true
 69  - test: testfile_created
 70  - click:
 71      target:
 72        image: "{{ icon_filemanager_taskbar }}"
 73      description: "Open Ubuntu File Explorer"
 74  - idle:
 75      duration: 2.0
 76      description: "Wait additional time for File Explorer to open since some systems are slow"
 77  - click:
 78      target:
 79        text: "Documents"
 80        strategy:
 81          SweepStrategy:
 82            index: 2
 83      description: "Navigate to Documents folder"
 84  - click:
 85      type: "right"
 86      target:
 87        text: "{{ filename }}"
 88      description: "Right-click on the test file"
 89  - click:
 90      target:
 91        text: "Move to Trash"
 92      description: "Select 'Move to Trash' from context menu"
 93  - save_timestamp:
 94      description: "Save the timestamp of file deletion for later verification"
 95      variable: deletion_timestamp
 96  - idle:
 97      duration: 1.0
 98      description: "Wait for file deletion to complete"
 99  - test: testfile_deleted
100  - test: trashbin_check_file
101  - test: trahsbin_check_info_file
102  - test: trashbin_check_info_date
103

Key concepts demonstrated:

  • Variable templating with {{ adare_user_documents }} and {{ adare_user_home }}

  • Test functions file_exists, file_does_not_exist, and file_content_equals

  • Actions including command, click, idle, save_timestamp

  • Timestamp tolerance matching with | tolerance(5, -5)

Windows 11 — File Deletion & Recycle Bin Verification

This experiment follows the same pattern on Windows 11: a test file is created, selected in File Explorer, and deleted via the Delete key. ADARE then runs RBCmd.exe to parse the Recycle Bin $I files into CSV and verifies that the deleted file’s metadata (path, timestamp) appears correctly.

Playbook:

playbook_windows11.yml
 1# Variables that can be used throughout the playbook
 2settings:
 3  idle: 2.0
 4variables:
 5  username:
 6    type: string
 7    value: "adare"
 8    description: "Username for the target system"
 9  
10  filepath:
11    type: path
12    value: "C:/Users/{{username}}/Documents/testfile.txt"
13    description: "Full path to the test file"
14  
15  trashbin_csv:
16    type: path
17    value: "C:/Users/{{username}}/Documents/trashbin/*.csv"
18    description: "Path pattern for trashbin CSV files"
19
20# Test definitions
21tests:
22  - name: testfile_created
23    description: 'Verify test file exists before experiment'
24    function: file_exists
25    parameter:
26      dst: '{{filepath}}'
27  - name: testfile_deleted
28    description: 'Verify test file was deleted successfully'
29    function: file_does_not_exist
30    parameter:
31      dst: '{{filepath}}'
32  - name: trashbin_check
33    description: 'check if file metadata exists in CSV with correct timestamp'
34    function: csv.contains_line
35    parameter:
36      dst: '{{trashbin_csv}}'
37      entry:
38        - !re '.*'  # Any value in first column
39        - '$I'      # Recycle bin identifier
40        - 'C:\Users\{{username}}\Documents\testfile.txt' 
41        - !re '.*'  # Any value in fourth column 
42        - !timestamp
43          timestamp: '{{deletion_timestamp}}'
44          tolerance: 5
45          timezone: 'utc'
46          format: '%Y-%m-%d %H:%M:%S'
47
48# Main playbook actions
49actions:
50  - command:
51      name: "Create Test File"
52      description: "create the to deleted file"
53      command: "echo 'This is a test file.' > {{ filepath }}"
54      shell: true
55  - test: testfile_created
56  - click:
57      target:
58        image: "explorer.png"
59      description: "Open File Explorer"
60  - idle:
61      duration: 5.0
62      description: "Wait additional time for File Explorer to open since some systems are slow"
63  - click:
64      target:
65        text: "Documents"
66        strategy:
67          SweepStrategy:
68            index: 2
69      description: "Navigate to Documents folder"
70  - click:
71      target:
72        text: "testfile"
73      description: "Select the test file to delete it with shortcut"
74  - keyboard:
75      combination: ["delete"]
76      description: "Delete the test file using keyboard shortcut"
77  - save_timestamp:
78      description: "Save the timestamp of file deletion for later verification"
79      variable: deletion_timestamp
80  - idle:
81      duration: 5.0
82      description: "Wait for file deletion to complete"
83  - test: testfile_deleted
84  - block:
85      description: "Check if file metadata exists in trash bin"
86      actions:
87        - command:
88            name: "RBCmd"
89            description: "Run RBCmd.exe to check file metadata"
90            tool: RBCmd.exe
91            command: 'RBCmd.exe -d C:\$recycle.bin --csv C:/Users/{{username}}/Documents/trashbin'
92            timeout: 180
93        - test: trashbin_check

Key concepts demonstrated:

  • Variable templating with Windows-style paths

  • Test function csv.contains_line with regex and timestamp matchers

  • Actions including keyboard combination and block grouping

  • External forensic tool integration (RBCmd.exe) via the command action with tool parameter