How to tell where an item in the Trash came from?

Question

The Mac OS X 10.6 Trash shows an option "Put back" for files that were trashed after installing 10.6. However, it does not show where the file will be put back to.

So: using Finder, is there any way to tell where a trashed item came from?

(I know the original locations are stored in ~/.Trash/.DS_Store, so if I really need to know where a file came from, then I can figure it out using something like hexdump.)

score 5 · Answer 1 · answered Oct 24 '09 at 15:23

I saw this problem and was intrigued. I ended up writing a quick Foundation tool based on this function and wrapped it in an AppleScript application.

http://dl.getdropbox.com/u/896591/PathForTrashItem.zip

Stick it in your toolbar and it should tell you the path for the selected item. I make no promises. :)

It shouldn't ask you for your password. If it does, something is odd. You can still open the application with AppleScript Editor, if you want to look at the AppleScript source.

Two main issues:

The Finder appears to update the .DS_Store file periodically, so it might fail for items you recently added to the Trash.
It can only handle one item at a time.

kenorb · Accepted Answer · 2017-08-15T14:35:23.960

You can use dsstore_dump.pl tool which can read a store file's records in human-readable format.

It's part of the Mac-Finder-DSStore project written in perl by Wim L which provides routines for reading and writing the .DS_Store files generated by the OS X. See also: dsstore_dump.pl at GitHub and at my fork.

Sample usage:

$ perl dsstore_dump.pl ~/.Trash/.DS_Store

    &makeEntries("foo.png",
        ptbL => "Users/username/Desktop/",
        ptbN => "foo.png"
    ),

Installation of this tool is covered in README file.

You can also run above script using the following one-liner in your Terminal:

perl <(curl -s https://raw.githubusercontent.com/kenorb/binfiles/master/dsstore_dump.pl) ~/.Trash/.DS_Store

Related: How do I check where the file in .Trash was removed from?

score 2 · Answer 3 · answered Aug 27 '17 at 22:32

There is a great write up and some easier solutions posted at http://ponderthebits.com/2017/01/mac-dumpster-diving-identifying-deleted-file-references-in-the-trash-ds_store-files-part-1/

Including this Terminal one-liner to convert a .DS_Store file to (mostly) text:

xxd -p <path/to/.DS_Store> | sed 's/00//g' | tr -d '\n' | sed 's/\([0-9A-F]\{2\}\)/0x\1 /g' | xxd -r -p | strings | sed 's/ptb[LN]ustr//g'

How to tell where an item in the Trash came from?

3 Answers3