VP - ReviewRecyclebin.py

# coding=utf-8
import os
import winreg


def extract_username(sid):
    net = r"SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"

    try:
        key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, net + '\\' + sid, 0,
                             winreg.KEY_WOW64_64KEY + winreg.KEY_ALL_ACCESS)
        (value, type) = winreg.QueryValueEx(key,
                                            'ProfileImagePath')  # direct address to keyValue. For looping use winreg.EnumValue
        return value
    except Exception as e:
        print(e)


def return_dir():
    dirs = ['C:\\Recycler\\', 'C:\\Recycled\\', 'C:\\$Recycle.Bin\\']
    for recycleDir in dirs:
        if os.path.isdir(recycleDir):
            directory_list = os.listdir(recycleDir)[1]  # Hacky solution. Is win10 regex architecture different?
            print("Directory found: " + directory_list)
            print("Username is: " + extract_username(directory_list))
            file_list = os.listdir(recycleDir + directory_list)
            for file in file_list:
                print(file)
            return recycleDir


def main():
    return_dir()


if __name__ == '__main__':
    main()