3

I've deleted some big folders yesterday while on a shoot, to free up some space to be able to shoot tethered into the Mac. The folders where from past shoots and I've marked the folders to know which I had backed up in several places - just to be able to be on shoots and delete if necessary.

But, yesterday things went quick and I'm not sure if one folder got mixed with the others. So today I'm looking for a way to just see which folder/items I deleted/emptied from the Trash.

Logs, Terminal commands etc.?

Every Google search gets me to recovery posts.

3 Answers 3

3

This following solution will not help you retrieve the filenames which were already removed from the trash, before implementing my solution. However you can use this solution to retrieve the filenames removed from the trash, in the future if you need to.

This AppleScript code works for me using the latest version of macOS Mojave.

You can attach a "Removing Items From" folder action to the /Users/YOUR SHORT NAME/.Trash folder that will write to file, the names of the files that were removed from the trash.

Create a new Script Editor document and insert this following AppleScript code.

on removing folder items from theFolder after losing removedItemNames
    writeToTheFile(removedItemNames)
end removing folder items from

on writeToTheFile(removedItemNames)
    set theFile to POSIX path of (((path to desktop as text) & "Removed From Trash.txt") as text)
    set text item delimiters to linefeed
    set theText to (removedItemNames as text)
    try
        set writeToFile to open for access theFile with write permission
        write theText & linefeed to writeToFile as text starting at eof
        close access theFile
    on error errMsg number errNum
        close access theFile
        set writeToFile to open for access theFile with write permission
        write theText & linefeed to writeToFile as text starting at eof
        close access theFile
    end try
end writeToTheFile

Next, save your new Script Editor document as "Removed From Trash Folder Action.scpt" to the folder... "/Users/YOUR SHORT NAME/Library/Workflows/Applications/Folder Actions/". Saving it to that location will add it to the list of scripts you can attach to folders in the Folder Actions Setup, which can be accessed when right clicking a folder in Finder, in the Services contextual menu.

enter image description here

Before you will be able to attach a folder action to the Trash folder, because the Trash folder is "hidden", you will first need to run this following AppleScript code to unhide all hidden files.

do shell script "defaults write com.apple.finder AppleShowAllFiles TRUE
killall Finder"

After all is said and done, if you want to re-hide all originally hidden files, just run this following AppleScript code to hide all hidden files.

do shell script "defaults write com.apple.finder AppleShowAllFiles FALSE
killall Finder"

Here is a look at the Folder Action creating the text file with the names of removed files from the trash

enter image description here

3
  • 2
    If running macOS Sierra or later, one does not need to use the defaults command to reveal the .Trash folder in one's Home folder. In Finder, simple press the keyboard shortcut Shift-Command-Period (⇧⌘.) to show/hide the .Trash folder. Commented Jul 2, 2019 at 19:43
  • 1
    BTW Why are you declaring global removedItemNames when it's not necessary to do so? Since in removing folder items from you pass it directly to writeToTheFile(removedItemNames) and it's used nowhere else, there is no declaration of any sort needed. Commented Jul 3, 2019 at 1:56
  • @user3439894 Declaring the global variable was necessary in the original, much longer version of the AppleScript code. After chewing off the fat through several revisions, it turns out that the final posted code, indeed no longer needs the global declaration. Good looking out!
    – wch1zpink
    Commented Jul 3, 2019 at 3:50
2

To the best of my knowledge macOS does NOT log what files were deleted so there is no way to see what was done.

Your best bet now is to stop using your Mac until you get this issue resolved.

Why? Because any time you use your Mac files are written to the drive. And when you delete something the location on the hard drive that the file(s) occupied is marked as free (rather than used/occupied). So anything you save to the disk subsequently could overwrite those files, including just opening a web page. As web pages are cached (or saved to) the drive.

If you have a backup of those files go get them from a backup. If you don't and the files are no longer in the trash get yourself some file recovery software, install it on another Mac and put the Mac in question into target disk mode (so you are not writing anything to the disk) and look for deleted files.

2

If you happen to be using Time Machine to backup your computer, you may compare your current state with one of your snapshots to list down the files that were deleted.

Backup the current state as snapshot first so we can do a snapshot-to-snapshot comparison with the path /Users/Joe appended:

tmutil compare "/Volumes/Backup/Backups.backupdb/Comp/2021-11-11-190343/Macintosh HD - Data/Users/Joe" "/Volumes/Backup/Backups.backupdb/Comp/2021-11-11-174640/Macintosh HD - Data/Users/Joe/" | grep -E ^-

The | grep -E ^- limits only to the files that were deleted in the left-hand-side (new) versus the RHS (old). The two params are the snapshot paths based on tmutil listbackups.

2
  • So this only compares changes that happened inside of /Users/Joe ? And I could use another path to check changes in a specific folder?
    – minseong
    Commented Jul 19 at 14:15
  • @minseong, yes, you can change to any path. Commented Jul 20 at 8:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .