4

This question already has an answer here:

I've some files appearing in Trash folder. How do I check from where they were removed?

I've Tried 'Get Info', but it doesn't tell me from where it was removed. The only option I've is 'Put Back', but again, to where?

How do I check this on OS X 10.9?

|improve this question

marked as duplicate by Tetsujin, jherran, IconDaemon, user151019, klanomath Feb 18 '16 at 12:36

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • There is a great write up and some easier solutions posted at ponderthebits.com/2017/01/… including this Terminal one-liner to convert a .DS_Store file to (mostly) text: xxd -p <path/to/.DS_Store> | sed 's/00//g' | tr -d '\n' | sed 's/\([0-9A-F]\{2\}\)/0x\1 /g' | xxd -r -p | strings | sed 's/ptb[LN]ustr//g' – Dan Aug 27 '17 at 22:30
4

Based on the previous information, the information about original location is stored within DS_Store file. In older version of OS X it was just a plain text and now binary format and it's undocumented by Apple, however there is a tool created by Wim L which can reads it.

Written in perl Mac::Finder::DSStore project provides routines for reading and writing the .DS_Store files generated by the OS X.

Using examples/dsstore_dump.pl would attempt to dump a store file's records in a more human-readable format.

Example usage:

$ perl dsstore_dump.pl ~/.Trash/.DS_Store

    &makeEntries("foo.png",
        ptbL => "Users/username/Desktop/",
        ptbN => "foo.png"
    ),

See: dsstore repo at hhhh.org and older repo at GitHub

|improve this answer
  • So if its undocumented how does he do it? – Pacerier Aug 15 '17 at 12:56
  • @Pacerier By reverse engineering I guess. As per this commit message , it's 'based on Mark Mitrovai's work plus own investigation'. – kenorb Aug 30 '17 at 11:05
3

You can isolate things a little if you don't mind using terminal.

The trash in finder is an overlay of trash from each mounted volume and each user. Furthermore, you can see the filename of the file and search using spotlight to see if there are similar files or use spotlight to search in Time Machine to find where the file was before it was trashed.

The pragmatic way to solve this is to drag the file to your desktop and then open/inspect/file it accordingly. (Or to just let Finder put it back and then use spotlight to find it).

To use terminal:

ls -la ~/.Trash
sudo ls -la /.Trashes

If you're not familiar with sudo and that it can delete anything with no recovery, I'd recommend not using sudo and asking follow on questions to learn more about terminal.

|improve this answer
  • You can no longer just open .DS_Store in a text editor (go ahead and try it if you want) since it's not a text file. The original path is still locked in that file, but there are easier ways to get your eventual problem solved than waiting for some tool to decode that file. – bmike♦ May 4 '15 at 18:12
  • Actually, you can open it, it's just encoded so you can't understand it. – Cullub Oct 26 '15 at 22:06
  • 1
    @bmike, Is sudo ls -la /.Trashes a safe operation or will i lose data? – Pacerier Aug 15 '17 at 12:54
  • @Pacerier It's safe (ls = list directory). – kenorb Aug 15 '17 at 14:29

Not the answer you're looking for? Browse other questions tagged .