I've some files appearing in Trash folder. How do I check from where they were removed?

I've Tried 'Get Info', but it doesn't tell me from where it was removed. The only option I've is 'Put Back', but again, to where?

How do I check this on OS X 10.9?

  • There is a great write up and some easier solutions posted at ponderthebits.com/2017/01/… including this Terminal one-liner to convert a .DS_Store file to (mostly) text: xxd -p <path/to/.DS_Store> | sed 's/00//g' | tr -d '\n' | sed 's/\([0-9A-F]\{2\}\)/0x\1 /g' | xxd -r -p | strings | sed 's/ptb[LN]ustr//g'
    – d0g
    Commented Aug 27, 2017 at 22:30

2 Answers 2


Based on the previous information, the information about original location is stored within DS_Store file. In older version of OS X it was just a plain text and now binary format and it's undocumented by Apple, however there is a tool created by Wim L which can reads it.

Written in perl Mac::Finder::DSStore project provides routines for reading and writing the .DS_Store files generated by the OS X.

Using examples/dsstore_dump.pl would attempt to dump a store file's records in a more human-readable format.

Example usage:

$ perl dsstore_dump.pl ~/.Trash/.DS_Store

        ptbL => "Users/username/Desktop/",
        ptbN => "foo.png"

See: dsstore repo at hhhh.org and older repo at GitHub

  • So if its undocumented how does he do it?
    – Pacerier
    Commented Aug 15, 2017 at 12:56
  • @Pacerier By reverse engineering I guess. As per this commit message , it's 'based on Mark Mitrovai's work plus own investigation'.
    – kenorb
    Commented Aug 30, 2017 at 11:05

You can isolate things a little if you don't mind using terminal.

The trash in finder is an overlay of trash from each mounted volume and each user. Furthermore, you can see the filename of the file and search using spotlight to see if there are similar files or use spotlight to search in Time Machine to find where the file was before it was trashed.

The pragmatic way to solve this is to drag the file to your desktop and then open/inspect/file it accordingly. (Or to just let Finder put it back and then use spotlight to find it).

To use terminal:

ls -la ~/.Trash
sudo ls -la /.Trashes

If you're not familiar with sudo and that it can delete anything with no recovery, I'd recommend not using sudo and asking follow on questions to learn more about terminal.

  • You can no longer just open .DS_Store in a text editor (go ahead and try it if you want) since it's not a text file. The original path is still locked in that file, but there are easier ways to get your eventual problem solved than waiting for some tool to decode that file.
    – bmike
    Commented May 4, 2015 at 18:12
  • Actually, you can open it, it's just encoded so you can't understand it.
    – Cullub
    Commented Oct 26, 2015 at 22:06
  • 1
    @bmike, Is sudo ls -la /.Trashes a safe operation or will i lose data?
    – Pacerier
    Commented Aug 15, 2017 at 12:54
  • @Pacerier It's safe (ls = list directory).
    – kenorb
    Commented Aug 15, 2017 at 14:29

Not the answer you're looking for? Browse other questions tagged .