40

Suppose some file "Any File.pdf" is in the Trash (aka ~/.Trash).

How can I determine its original location?

By "original location" I mean the folder where that file would be moved to if one were to apply the "Put Back" command to it (but without actually doing so)? (See figure below.)

(I had hoped that this information would be available through running "Get Info" on the file, but I did not find it there.)

Put Back

8

Data containing a file's original location before being placed in the Trash is keep in the .DS_Store file in the ~/.Trash folder.

Since the trash folder is hidden it can not normally be found using the finder application. The easiest way to find this file is by using the Terminal and entering the following commands.

$cd ~/.Trash
$open -e .DS_Store

This will open the file in TextEdit. From there you should be able to quickly search for the file by its name and its original path.

Its seems that files in .DS_Store follow the pattern of:

FILE_NAME ptbLustr ORIGINAL_PATH_TO_FILE

Note spaces are added just for readability.

  • 2
    Did you actually test that? .DS_Store contains a lot of binary data, I didn't find any file names at all. – nohillside Jun 4 '12 at 15:23
  • 1
    I did test this on my own machine before posting. I found references to files in my Trash and their original locations. – David Jun 4 '12 at 15:28
  • 1
    Ah, seems to depend on the language settings, it's all Unicode here. – nohillside Jun 4 '12 at 16:25
  • 6
    I believe this answer only works for OS X around/before 10.4 or 10.5 as .DS_Store is now a binary file and undocumented by Apple. – bmike May 4 '15 at 17:41
  • It does still work here in OS X 10.7.5. – Dictionarics Anonymous Mar 15 '16 at 18:22
1

The information about the original location is stored within DS_Store file. In older version of OS X it was stored in plain text, and now in binary format. These formats aren't documented by Apple, however, there is a tool created by Wim L which can read it.

The tool is written in Perl, Mac::Finder::DSStore project provides routines for reading and writing the .DS_Store files generated by the macOS.

As per initial commit, the above tool is based on Mark Mitrovai's work plus author own investigation.

Using examples/dsstore_dump.pl would attempt to dump a store file's records in a more human-readable format.

Example usage:

$ perl dsstore_dump.pl ~/.Trash/.DS_Store

    &makeEntries("foo.png",
        ptbL => "Users/username/Desktop/",
        ptbN => "foo.png"
    ),

See: dsstore repo at hhhh.org and older repo at GitHub.

0

There is a great write up and some easier solutions posted at http://ponderthebits.com/2017/01/mac-dumpster-diving-identifying-deleted-file-references-in-the-trash-ds_store-files-part-1/

Including this Terminal one-liner to convert a .DS_Store file to (mostly) text:

xxd -p <path/to/.DS_Store> | sed 's/00//g' | tr -d '\n' | sed 's/\([0-9A-F]\{2\}\)/0x\1 /g' | xxd -r -p | strings | sed 's/ptb[LN]ustr//g'
  • Rather than duplicating a prior answer, perhaps you could expand the command to specifically return the Put Back location, which would be more useful for this question individually? – grg Aug 27 '17 at 22:40
  • I'm "duplicating" my own answer, which I posted on 3 relevant threads which provided no solution that worked for me. Just trying to save other people the hour of searching I had to do. Sorry if I'm doing this wrong. – Dan Aug 27 '17 at 22:45
  • I understand that and you've not doing anything wrong, just thought it might be useful to tailor this one to something more specific for the particular question. Also, by providing the link in my previous comment, the other question now shows in the linked questions list on the right which might be useful to others. – grg Aug 27 '17 at 22:48
-3

'Put Back' the File, Use the search function to search for the file, When you find your file, Right-Click it and select "Open Enclosing Folder"

  • 2
    What if the same file name appears more than once on the file system? This approach will fail for that case. Better to read the meta data OS X is reading to determine the 'Put Back' location in the first place. – Ian C. May 29 '12 at 14:21
  • @IanC., But this hazytruth option seemsto be the only option now that dsstore is binary – Pacerier Aug 15 '17 at 12:02
  • Fuzzytruth i mean... – Pacerier Aug 15 '17 at 12:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .