47

Suppose some file "Any File.pdf" is in the Trash (aka ~/.Trash).

How can I determine its original location?

By "original location" I mean the folder where that file would be moved to if one were to apply the "Put Back" command to it (but without actually doing so)? (See figure below.)

(I had hoped that this information would be available through running "Get Info" on the file, but I did not find it there.)

Put Back

grg
  • 201,078
kjo
  • 1,020
  • 2
  • 14
  • 21
  • 3
    As mentioned here (last comment) this information seems to be stored in the .DS_Store file in the trash-folder – iolsmit May 29 '12 at 14:04
  • 7
    Related: http://superuser.com/questions/59376/how-to-tell-where-an-item-in-the-trash-came-from – Ian C. May 29 '12 at 14:07
  • See soultion here https://discussions.apple.com/thread/5767821?tstart=0 but it doesn't work if the enclosing folder has been deleted ! – Pacerier Aug 15 '17 at 12:18

4 Answers4

11

Data containing a file's original location before being placed in the Trash is keep in the .DS_Store file in the ~/.Trash folder.

Since the trash folder is hidden it can not normally be found using the finder application. The easiest way to find this file is by using the Terminal and entering the following commands.

$cd ~/.Trash
$open -e .DS_Store

This will open the file in TextEdit. From there you should be able to quickly search for the file by its name and its original path.

Its seems that files in .DS_Store follow the pattern of:

FILE_NAME ptbLustr ORIGINAL_PATH_TO_FILE

Note spaces are added just for readability.

David
  • 234
  • 3
    Did you actually test that? .DS_Store contains a lot of binary data, I didn't find any file names at all. – nohillside Jun 04 '12 at 15:23
  • 1
    I did test this on my own machine before posting. I found references to files in my Trash and their original locations. – David Jun 04 '12 at 15:28
  • 1
    Ah, seems to depend on the language settings, it's all Unicode here. – nohillside Jun 04 '12 at 16:25
  • 7
    I believe this answer only works for OS X around/before 10.4 or 10.5 as .DS_Store is now a binary file and undocumented by Apple. – bmike May 04 '15 at 17:41
  • It does still work here in OS X 10.7.5. – Dictionarics Anonymous Mar 15 '16 at 18:22
  • still works on OSX 10.11.5. It works when I open it in TextEdit, but not Sublime Text – wyu Dec 13 '16 at 20:08
  • It is a binary file, but you can still see the strings that are stored in it, in most text editors. However, the search doesn't seem to work correctly on it when opened in TextEdit. I can see all my files there, but when I try to search for more than a single character at a time, it returns 0 results (even though if I search for those characters one at a time, it finds them all). This probably depends on the editor it's opened in, but TextWrangler is the same way. Unfortunately, without the search working, this method is pretty difficult to use. – Elezar Jan 31 '17 at 06:03
  • @David, Surely you're going to say waht ptbLustr means? – Pacerier Aug 15 '17 at 11:23
  • @Elezar, Yes that's the definition of a binary file. There are readable text strings in loads of binary files. If its not completely unicode readable its binary. – Pacerier Aug 15 '17 at 11:50
  • @Pacerier Yeah, but it seems pretty clear from other comments that not everyone is aware of that fact, so I was pointing it out. – Elezar Aug 15 '17 at 14:42
  • When I try these directions on macOS Catalina, I get the error 'The document ".DS_Store" could not be opened. You don't have permission.' – Jason R. Coombs Jan 05 '20 at 16:21
  • 3
    If you get the "You don't have permission" error, ensure that Terminal has access to the file system. – Jason R. Coombs Jan 05 '20 at 17:42
1

The information about the original location is stored within DS_Store file. In older version of OS X it was stored in plain text, and now in binary format. These formats aren't documented by Apple, however, there is a tool created by Wim L which can read it.

The tool is written in Perl, Mac::Finder::DSStore project provides routines for reading and writing the .DS_Store files generated by the macOS.

As per initial commit, the above tool is based on Mark Mitrovai's work plus author own investigation.

Using examples/dsstore_dump.pl would attempt to dump a store file's records in a more human-readable format.

Example usage:

$ perl dsstore_dump.pl ~/.Trash/.DS_Store

    &makeEntries("foo.png",
        ptbL => "Users/username/Desktop/",
        ptbN => "foo.png"
    ),

See: dsstore repo at hhhh.org and older repo at GitHub.

kenorb
  • 12,695
  • The repo server hhhh.org is returning Internal Server Error. This answer assumes fairly advanced programming knowledge and implies a lot of steps. Step-by-step instructions would be useful. – Jason R. Coombs Jan 05 '20 at 16:27
0

There is a great write up and some easier solutions posted at http://ponderthebits.com/2017/01/mac-dumpster-diving-identifying-deleted-file-references-in-the-trash-ds_store-files-part-1/

Including this Terminal one-liner to convert a .DS_Store file to (mostly) text: 

xxd -p <path/to/.DS_Store> | sed 's/00//g' | tr -d '\n' | sed 's/\([0-9A-F]\{2\}\)/0x\1 /g' | xxd -r -p | strings | sed 's/ptb[LN]ustr//g'
d0g
  • 3,902
  • Rather than duplicating a prior answer, perhaps you could expand the command to specifically return the Put Back location, which would be more useful for this question individually? – grg Aug 27 '17 at 22:40
  • I'm "duplicating" my own answer, which I posted on 3 relevant threads which provided no solution that worked for me. Just trying to save other people the hour of searching I had to do. Sorry if I'm doing this wrong. – d0g Aug 27 '17 at 22:45
  • I understand that and you've not doing anything wrong, just thought it might be useful to tailor this one to something more specific for the particular question. Also, by providing the link in my previous comment, the other question now shows in the linked questions list on the right which might be useful to others. – grg Aug 27 '17 at 22:48
  • result is hardly satisfactory. – Nir O. Jan 16 '21 at 11:27
-3

'Put Back' the File, Use the search function to search for the file, When you find your file, Right-Click it and select "Open Enclosing Folder"