16

The Mac OS X 10.6 Trash shows an option "Put back" for files that were trashed after installing 10.6. However, it does not show where the file will be put back to.

So: using Finder, is there any way to tell where a trashed item came from?

(I know the original locations are stored in ~/.Trash/.DS_Store, so if I really need to know where a file came from, then I can figure it out using something like hexdump.)

Arjan
  • 30,974
  • 14
  • 75
  • 112
  • Out of curiosity: why would you need that? If you know where it was, you can simply put it back, and if not, just drag it out of the trash onto the desktop and move it from there wherever you want it to be. – brandstaetter Oct 23 '09 at 10:55
  • 1
    For example if two *different* trashed documents/folders have the same name and I want to figure out which item to restore. Or if someone accidentally deletes some settings file, and then some time later I find that unknown item in the Trash. (Of course, system files cannot be deleted without providing an administrator password.) Or if I just see some strange files which make me very curious of where I got those. ;-) – Arjan Oct 23 '09 at 11:04
  • To distinguish between 2 documents, you could use quicklook. – brandstaetter Oct 23 '09 at 11:08
  • Sure, I know all the workarounds. ;-) But now that 10.6 introduced this "Put back", I was hoping for some control over that... – Arjan Oct 23 '09 at 11:38
  • You realize you're talking about the closed Apple ecosystem :) Perhaps we'll see that in 10.6.9 or 10.7 ;) – brandstaetter Oct 23 '09 at 12:12
  • Might be true. Some other things in the Trash are quite, err, odd as well and will see some updates, I assume. Like when selecting "Delete" from the Trash, one actually restores the item... – Arjan Oct 23 '09 at 12:25
  • 1
    As an aside: a nice hint on macosxhints.com: 10.6: Set time of deletion for files placed in the Trash, *to make it easier to retrieve accidentally-deleted items from the trash* at http://www.macosxhints.com/article.php?story=20100121075428946 – Arjan Jan 31 '10 at 09:12
  • @brandstaetter: why would you need this? deleting a file on an SD card moves it into hidden trash folder ON THE SD CARD. so then you have to go into the trash to permanently delete those files. But Mac also doesn't let you delete particular files from the Trash so it wouldn't actually help... – Kip Jan 31 '14 at 01:01
  • 2
    Related: [How to determine original location of file that is currently in the Trash?](http://apple.stackexchange.com/q/52357/22781) at Apple SE – kenorb May 04 '15 at 17:24

3 Answers3

5

I saw this problem and was intrigued. I ended up writing a quick Foundation tool based on this function and wrapped it in an AppleScript application.

http://dl.getdropbox.com/u/896591/PathForTrashItem.zip

Stick it in your toolbar and it should tell you the path for the selected item. I make no promises. :)

It shouldn't ask you for your password. If it does, something is odd. You can still open the application with AppleScript Editor, if you want to look at the AppleScript source.

Two main issues:

  • The Finder appears to update the .DS_Store file periodically, so it might fail for items you recently added to the Trash.
  • It can only handle one item at a time.
Benjamin Dobson
  • 1,041
  • 7
  • 14
  • That beats `hexdump` for sure. :-) And that http://www.cocoadev.com/index.pl?ParseDSStoreFiles surely seems interesting as well. My Google-Fu failed me badly! – Arjan Oct 24 '09 at 15:35
  • Upvoted this (only) answer because it was really what I was looking for. However, it seems the script (or rather the embedded `tipath` program) does not work for any of the files in my Trash folder. – mgd Apr 23 '13 at 09:00
  • 1
    Link died. :( Got GitHub? – Cees Timmerman Jun 27 '17 at 08:45
  • @Benjamin, Does this still work for newer macs where the dsstore is a new binary format>? – Pacerier Aug 15 '17 at 12:06
  • [New function link](https://github.com/cocoadev/cocoadev.github.io/blob/0b21b721ad0c3af40c26d4979b9fa5bdd6738384/ParseDSStoreFiles/index.md) but it appears to be from 2013. In MacOS Ventura 13.0.1 (22A400) even `sudo cat ~/.Trash/.DS_Store` fails with `cat: /Users/UID/.Trash/.DS_Store: Operation not permitted`. – Cees Timmerman Jan 06 '23 at 13:16
3

You can use dsstore_dump.pl tool which can read a store file's records in human-readable format.

It's part of the Mac-Finder-DSStore project written in perl by Wim L which provides routines for reading and writing the .DS_Store files generated by the OS X. See also: dsstore_dump.pl at GitHub and at my fork.

Sample usage:

$ perl dsstore_dump.pl ~/.Trash/.DS_Store

    &makeEntries("foo.png",
        ptbL => "Users/username/Desktop/",
        ptbN => "foo.png"
    ),

Installation of this tool is covered in README file.

You can also run above script using the following one-liner in your Terminal:

perl <(curl -s https://raw.githubusercontent.com/kenorb/binfiles/master/dsstore_dump.pl) ~/.Trash/.DS_Store

Related: How do I check where the file in .Trash was removed from?

kenorb
  • 24,736
  • 27
  • 129
  • 199
  • Does this still work for newer macs where the dsstore is a new binary format>? – Pacerier Aug 15 '17 at 12:07
  • @Pacerier Yes, it does work. I've tested just now on macOS Sierra. – kenorb Aug 15 '17 at 12:21
  • Cool. How do I actually download and use it ? – Pacerier Aug 15 '17 at 13:03
  • @Pacerier I've included one-liner which you can copy and paste into your Terminal. – kenorb Aug 15 '17 at 14:35
  • 1
    @kenorb Thanks for this, I tried to run, but I'm getting "Can't locate Mac/Finder/DSStore/BuddyAllocator.pm in @INC" -- and couldn't find README, and know nothing about perl. [Later...] Found the README at http://cpansearch.perl.org/src/WIML/Mac-Finder-DSStore-1.00/README ... but I don't understand it. – Dan Aug 27 '17 at 21:59
2

There is a great write up and some easier solutions posted at http://ponderthebits.com/2017/01/mac-dumpster-diving-identifying-deleted-file-references-in-the-trash-ds_store-files-part-1/

Including this Terminal one-liner to convert a .DS_Store file to (mostly) text: 

xxd -p <path/to/.DS_Store> | sed 's/00//g' | tr -d '\n' | sed 's/\([0-9A-F]\{2\}\)/0x\1 /g' | xxd -r -p | strings | sed 's/ptb[LN]ustr//g'
Dan
  • 2,240
  • 4
  • 36
  • 43