How to tell where an item in the Trash came from?

The Mac OS X 10.6 Trash shows an option "Put back" for files that were trashed after installing 10.6. However, it does not show where the file will be put back to.

So: using Finder, is there any way to tell where a trashed item came from?

(I know the original locations are stored in ~/.Trash/.DS_Store, so if I really need to know where a file came from, then I can figure it out using something like hexdump.)

Arjan

Posted 2009-10-23T10:49:56.800

Reputation: 29 084

As an aside: a nice hint on macosxhints.com: 10.6: Set time of deletion for files placed in the Trash, to make it easier to retrieve accidentally-deleted items from the trash at http://www.macosxhints.com/article.php?story=20100121075428946

– Arjan – 2010-01-31T09:12:41.870

– kenorb – 2015-05-04T17:24:00.297

Out of curiosity: why would you need that? If you know where it was, you can simply put it back, and if not, just drag it out of the trash onto the desktop and move it from there wherever you want it to be. – brandstaetter – 2009-10-23T10:55:10.613

1For example if two different trashed documents/folders have the same name and I want to figure out which item to restore. Or if someone accidentally deletes some settings file, and then some time later I find that unknown item in the Trash. (Of course, system files cannot be deleted without providing an administrator password.) Or if I just see some strange files which make me very curious of where I got those. ;-) – Arjan – 2009-10-23T11:04:11.780

To distinguish between 2 documents, you could use quicklook. – brandstaetter – 2009-10-23T11:08:58.040

Sure, I know all the workarounds. ;-) But now that 10.6 introduced this "Put back", I was hoping for some control over that... – Arjan – 2009-10-23T11:38:40.837

You realize you're talking about the closed Apple ecosystem :) Perhaps we'll see that in 10.6.9 or 10.7 ;) – brandstaetter – 2009-10-23T12:12:26.790

Might be true. Some other things in the Trash are quite, err, odd as well and will see some updates, I assume. Like when selecting "Delete" from the Trash, one actually restores the item... – Arjan – 2009-10-23T12:25:13.580

@brandstaetter: why would you need this? deleting a file on an SD card moves it into hidden trash folder ON THE SD CARD. so then you have to go into the trash to permanently delete those files. But Mac also doesn't let you delete particular files from the Trash so it wouldn't actually help... – Kip – 2014-01-31T01:01:23.853

Answers

You can use dsstore_dump.pl tool which can read a store file's records in human-readable format.

It's part of the Mac-Finder-DSStore project written in perl by Wim L which provides routines for reading and writing the .DS_Store files generated by the OS X. See also: dsstore_dump.pl at GitHub and at my fork.

Sample usage:

$ perl dsstore_dump.pl ~/.Trash/.DS_Store

    &makeEntries("foo.png",
        ptbL => "Users/username/Desktop/",
        ptbN => "foo.png"
    ),

Installation of this tool is covered in README file.

You can also run above script using the following one-liner in your Terminal:

perl <(curl -s https://raw.githubusercontent.com/kenorb/binfiles/master/dsstore_dump.pl) ~/.Trash/.DS_Store

kenorb

Posted 2009-10-23T10:49:56.800

Reputation: 16 795

Does this still work for newer macs where the dsstore is a new binary format>? – Pacerier – 2017-08-15T12:07:43.923

@Pacerier Yes, it does work. I've tested just now on macOS Sierra. – kenorb – 2017-08-15T12:21:13.623

Cool. How do I actually download and use it ? – Pacerier – 2017-08-15T13:03:09.117

@Pacerier I've included one-liner which you can copy and paste into your Terminal. – kenorb – 2017-08-15T14:35:52.697

@kenorb Thanks for this, I tried to run, but I'm getting "Can't locate Mac/Finder/DSStore/BuddyAllocator.pm in @INC" -- and couldn't find README, and know nothing about perl. [Later...] Found the README at http://cpansearch.perl.org/src/WIML/Mac-Finder-DSStore-1.00/README ... but I don't understand it.

– Dan – 2017-08-27T21:59:10.273

I saw this problem and was intrigued. I ended up writing a quick Foundation tool based on this function and wrapped it in an AppleScript application.

http://dl.getdropbox.com/u/896591/PathForTrashItem.zip

Stick it in your toolbar and it should tell you the path for the selected item. I make no promises. :)

It shouldn't ask you for your password. If it does, something is odd. You can still open the application with AppleScript Editor, if you want to look at the AppleScript source.

Two main issues:

The Finder appears to update the .DS_Store file periodically, so it might fail for items you recently added to the Trash.
It can only handle one item at a time.

Benjamin Dobson

Posted 2009-10-23T10:49:56.800

Reputation: 1 021

1Link died. :( Got GitHub? – Cees Timmerman – 2017-06-27T08:45:14.307

@Benjamin, Does this still work for newer macs where the dsstore is a new binary format>? – Pacerier – 2017-08-15T12:06:55.637

That beats hexdump for sure. :-) And that http://www.cocoadev.com/index.pl?ParseDSStoreFiles surely seems interesting as well. My Google-Fu failed me badly!

– Arjan – 2009-10-24T15:35:48.160

Upvoted this (only) answer because it was really what I was looking for. However, it seems the script (or rather the embedded tipath program) does not work for any of the files in my Trash folder. – mgd – 2013-04-23T09:00:54.190

There is a great write up and some easier solutions posted at http://ponderthebits.com/2017/01/mac-dumpster-diving-identifying-deleted-file-references-in-the-trash-ds_store-files-part-1/

Including this Terminal one-liner to convert a .DS_Store file to (mostly) text:

xxd -p <path/to/.DS_Store> | sed 's/00//g' | tr -d '\n' | sed 's/\([0-9A-F]\{2\}\)/0x\1 /g' | xxd -r -p | strings | sed 's/ptb[LN]ustr//g'

Dan

Posted 2009-10-23T10:49:56.800

Reputation: 1 716