16

The Mac OS X 10.6 Trash shows an option "Put back" for files that were trashed after installing 10.6. However, it does not show where the file will be put back to.

So: using Finder, is there any way to tell where a trashed item came from?

(I know the original locations are stored in ~/.Trash/.DS_Store, so if I really need to know where a file came from, then I can figure it out using something like hexdump.)

9
  • Out of curiosity: why would you need that? If you know where it was, you can simply put it back, and if not, just drag it out of the trash onto the desktop and move it from there wherever you want it to be. Oct 23, 2009 at 10:55
  • 1
    For example if two different trashed documents/folders have the same name and I want to figure out which item to restore. Or if someone accidentally deletes some settings file, and then some time later I find that unknown item in the Trash. (Of course, system files cannot be deleted without providing an administrator password.) Or if I just see some strange files which make me very curious of where I got those. ;-)
    – Arjan
    Oct 23, 2009 at 11:04
  • To distinguish between 2 documents, you could use quicklook. Oct 23, 2009 at 11:08
  • 1
    As an aside: a nice hint on macosxhints.com: 10.6: Set time of deletion for files placed in the Trash, to make it easier to retrieve accidentally-deleted items from the trash at macosxhints.com/article.php?story=20100121075428946
    – Arjan
    Jan 31, 2010 at 9:12
  • 2

3 Answers 3

3

You can use dsstore_dump.pl tool which can read a store file's records in human-readable format.

It's part of the Mac-Finder-DSStore project written in perl by Wim L which provides routines for reading and writing the .DS_Store files generated by the OS X. See also: dsstore_dump.pl at GitHub and at my fork.

Sample usage:

$ perl dsstore_dump.pl ~/.Trash/.DS_Store

    &makeEntries("foo.png",
        ptbL => "Users/username/Desktop/",
        ptbN => "foo.png"
    ),

Installation of this tool is covered in README file.

You can also run above script using the following one-liner in your Terminal:

perl <(curl -s https://raw.githubusercontent.com/kenorb/binfiles/master/dsstore_dump.pl) ~/.Trash/.DS_Store 

Related: How do I check where the file in .Trash was removed from?

5
  • Does this still work for newer macs where the dsstore is a new binary format>?
    – Pacerier
    Aug 15, 2017 at 12:07
  • @Pacerier Yes, it does work. I've tested just now on macOS Sierra.
    – kenorb
    Aug 15, 2017 at 12:21
  • Cool. How do I actually download and use it ?
    – Pacerier
    Aug 15, 2017 at 13:03
  • @Pacerier I've included one-liner which you can copy and paste into your Terminal.
    – kenorb
    Aug 15, 2017 at 14:35
  • 1
    @kenorb Thanks for this, I tried to run, but I'm getting "Can't locate Mac/Finder/DSStore/BuddyAllocator.pm in @INC" -- and couldn't find README, and know nothing about perl. [Later...] Found the README at cpansearch.perl.org/src/WIML/Mac-Finder-DSStore-1.00/README ... but I don't understand it.
    – d0g
    Aug 27, 2017 at 21:59
5

I saw this problem and was intrigued. I ended up writing a quick Foundation tool based on this function and wrapped it in an AppleScript application.

http://dl.getdropbox.com/u/896591/PathForTrashItem.zip

Stick it in your toolbar and it should tell you the path for the selected item. I make no promises. :)

It shouldn't ask you for your password. If it does, something is odd. You can still open the application with AppleScript Editor, if you want to look at the AppleScript source.

Two main issues:

  • The Finder appears to update the .DS_Store file periodically, so it might fail for items you recently added to the Trash.
  • It can only handle one item at a time.
5
  • That beats hexdump for sure. :-) And that cocoadev.com/index.pl?ParseDSStoreFiles surely seems interesting as well. My Google-Fu failed me badly!
    – Arjan
    Oct 24, 2009 at 15:35
  • Upvoted this (only) answer because it was really what I was looking for. However, it seems the script (or rather the embedded tipath program) does not work for any of the files in my Trash folder.
    – mgd
    Apr 23, 2013 at 9:00
  • 1
    Link died. :( Got GitHub? Jun 27, 2017 at 8:45
  • @Benjamin, Does this still work for newer macs where the dsstore is a new binary format>?
    – Pacerier
    Aug 15, 2017 at 12:06
  • New function link but it appears to be from 2013. In MacOS Ventura 13.0.1 (22A400) even sudo cat ~/.Trash/.DS_Store fails with cat: /Users/UID/.Trash/.DS_Store: Operation not permitted. Jan 6, 2023 at 13:16
2

There is a great write up and some easier solutions posted at http://ponderthebits.com/2017/01/mac-dumpster-diving-identifying-deleted-file-references-in-the-trash-ds_store-files-part-1/

Including this Terminal one-liner to convert a .DS_Store file to (mostly) text:

xxd -p <path/to/.DS_Store> | sed 's/00//g' | tr -d '\n' | sed 's/\([0-9A-F]\{2\}\)/0x\1 /g' | xxd -r -p | strings | sed 's/ptb[LN]ustr//g'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .