# Virtual Directory after Recent Activity

**URL:** <https://sleuthkit.discourse.group/t/virtual-directory-after-recent-activity/4029>\
**Category:** Autopsy Help\
**Created:** [November 14, 2023, 7:17pm UTC](https://sleuthkit.discourse.group/t/virtual-directory-after-recent-activity/4029 "2023-11-14T19:17:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![oscarjs](https://avatars.discourse-cdn.com/v4/letter/o/bbce88/32.png) [@oscarjs](https://sleuthkit.discourse.group/u/oscarjs)\
**Post date:** [November 14, 2023, 7:17pm UTC](https://sleuthkit.discourse.group/t/virtual-directory-after-recent-activity/4029/1 "2023-11-14T19:17:30Z")

</div>

After running the “recent activity” ingest module, a virtual folder (with a bold V) appeared in the documents folder of the user. The virtual directory corresponds to a real one folder that the user deleted and was in the recycle bin.

What is the reason of autopsy doing this?

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [November 14, 2023, 7:37pm UTC](https://sleuthkit.discourse.group/t/virtual-directory-after-recent-activity/4029/2 "2023-11-14T19:37:41Z")

</div>

When you run RA one of the things it will do is scan the RecycleBin and restore any files that have been deleted by the users to where they resided on the disk. This is to show where the file/directory existed before it was deleted. Does that help?

---

<div class="post-metadata">

**Author:** ![oscarjs](https://avatars.discourse-cdn.com/v4/letter/o/bbce88/32.png) [@oscarjs](https://sleuthkit.discourse.group/u/oscarjs)\
**Post date:** [November 14, 2023, 9:43pm UTC](https://sleuthkit.discourse.group/t/virtual-directory-after-recent-activity/4029/3 "2023-11-14T21:43:19Z")

</div>

Yes, thanks Mark, your answer helps.