The Mac OS X 10.6 Trash shows an option "Put back" for files that were trashed after installing 10.6. However, it does not show where the file will be put back to.

So: using Finder, is there any way to tell where a trashed item came from?

(I know the original locations are stored in ~/.Trash/.DS_Store, so if I really need to know where a file came from, then I can figure it out using something like hexdump.)

  • Out of curiosity: why would you need that? If you know where it was, you can simply put it back, and if not, just drag it out of the trash onto the desktop and move it from there wherever you want it to be. – brandstaetter Oct 23 '09 at 10:55
  • 1
    For example if two different trashed documents/folders have the same name and I want to figure out which item to restore. Or if someone accidentally deletes some settings file, and then some time later I find that unknown item in the Trash. (Of course, system files cannot be deleted without providing an administrator password.) Or if I just see some strange files which make me very curious of where I got those. ;-) – Arjan Oct 23 '09 at 11:04
  • To distinguish between 2 documents, you could use quicklook. – brandstaetter Oct 23 '09 at 11:08
  • 1
    As an aside: a nice hint on macosxhints.com: 10.6: Set time of deletion for files placed in the Trash, to make it easier to retrieve accidentally-deleted items from the trash at macosxhints.com/article.php?story=20100121075428946 – Arjan Jan 31 '10 at 9:12
  • 2

You can use dsstore_dump.pl tool which can read a store file's records in human-readable format.

It's part of the Mac-Finder-DSStore project written in perl by Wim L which provides routines for reading and writing the .DS_Store files generated by the OS X. See also: dsstore_dump.pl at GitHub and at my fork.

Sample usage:

$ perl dsstore_dump.pl ~/.Trash/.DS_Store

        ptbL => "Users/username/Desktop/",
        ptbN => "foo.png"

Installation of this tool is covered in README file.

You can also run above script using the following one-liner in your Terminal:

perl <(curl -s https://raw.githubusercontent.com/kenorb/binfiles/master/dsstore_dump.pl) ~/.Trash/.DS_Store 

Related: How do I check where the file in .Trash was removed from?

  • Does this still work for newer macs where the dsstore is a new binary format>? – Pacerier Aug 15 '17 at 12:07
  • @Pacerier Yes, it does work. I've tested just now on macOS Sierra. – kenorb Aug 15 '17 at 12:21
  • Cool. How do I actually download and use it ? – Pacerier Aug 15 '17 at 13:03
  • @Pacerier I've included one-liner which you can copy and paste into your Terminal. – kenorb Aug 15 '17 at 14:35
  • @kenorb Thanks for this, I tried to run, but I'm getting "Can't locate Mac/Finder/DSStore/BuddyAllocator.pm in @INC" -- and couldn't find README, and know nothing about perl. [Later...] Found the README at cpansearch.perl.org/src/WIML/Mac-Finder-DSStore-1.00/README ... but I don't understand it. – Dan Aug 27 '17 at 21:59

I saw this problem and was intrigued. I ended up writing a quick Foundation tool based on this function and wrapped it in an AppleScript application.


Stick it in your toolbar and it should tell you the path for the selected item. I make no promises. :)

It shouldn't ask you for your password. If it does, something is odd. You can still open the application with AppleScript Editor, if you want to look at the AppleScript source.

Two main issues:

  • The Finder appears to update the .DS_Store file periodically, so it might fail for items you recently added to the Trash.
  • It can only handle one item at a time.
  • That beats hexdump for sure. :-) And that cocoadev.com/index.pl?ParseDSStoreFiles surely seems interesting as well. My Google-Fu failed me badly! – Arjan Oct 24 '09 at 15:35
  • Upvoted this (only) answer because it was really what I was looking for. However, it seems the script (or rather the embedded tipath program) does not work for any of the files in my Trash folder. – mgd Apr 23 '13 at 9:00
  • 1
    Link died. :( Got GitHub? – Cees Timmerman Jun 27 '17 at 8:45
  • @Benjamin, Does this still work for newer macs where the dsstore is a new binary format>? – Pacerier Aug 15 '17 at 12:06

There is a great write up and some easier solutions posted at http://ponderthebits.com/2017/01/mac-dumpster-diving-identifying-deleted-file-references-in-the-trash-ds_store-files-part-1/

Including this Terminal one-liner to convert a .DS_Store file to (mostly) text:

xxd -p <path/to/.DS_Store> | sed 's/00//g' | tr -d '\n' | sed 's/\([0-9A-F]\{2\}\)/0x\1 /g' | xxd -r -p | strings | sed 's/ptb[LN]ustr//g'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.