How to determine original location of file that is currently in the Trash?

Question

Suppose some file "Any File.pdf" is in the Trash (aka ~/.Trash).

How can I determine its original location?

By "original location" I mean the folder where that file would be moved to if one were to apply the "Put Back" command to it (but without actually doing so)? (See figure below.)

(I had hoped that this information would be available through running "Get Info" on the file, but I did not find it there.)

Answer 1

Data containing a file's original location before being placed in the Trash is keep in the .DS_Store file in the ~/.Trash folder.

Since the trash folder is hidden it can not normally be found using the finder application. The easiest way to find this file is by using the Terminal and entering the following commands.

$cd ~/.Trash
$open -e .DS_Store

This will open the file in TextEdit. From there you should be able to quickly search for the file by its name and its original path.

Its seems that files in .DS_Store follow the pattern of:

FILE_NAME ptbLustr ORIGINAL_PATH_TO_FILE

Note spaces are added just for readability.

Answer 2

There is a great write up and some easier solutions posted at http://ponderthebits.com/2017/01/mac-dumpster-diving-identifying-deleted-file-references-in-the-trash-ds_store-files-part-1/

Including this Terminal one-liner to convert a .DS_Store file to (mostly) text:

xxd -p <path/to/.DS_Store> | sed 's/00//g' | tr -d '\n' | sed 's/\([0-9A-F]\{2\}\)/0x\1 /g' | xxd -r -p | strings | sed 's/ptb[LN]ustr//g'

Answer 3

The information about the original location is stored within DS_Store file. In older version of OS X it was stored in plain text, and now in binary format. These formats aren't documented by Apple, however, there is a tool created by Wim L which can read it.

The tool is written in Perl, Mac::Finder::DSStore project provides routines for reading and writing the .DS_Store files generated by the macOS.

As per initial commit, the above tool is based on Mark Mitrovai's work plus author own investigation.

Using examples/dsstore_dump.pl would attempt to dump a store file's records in a more human-readable format.

Example usage:

$ perl dsstore_dump.pl ~/.Trash/.DS_Store

    &makeEntries("foo.png",
        ptbL => "Users/username/Desktop/",
        ptbN => "foo.png"
    ),

^{See: dsstore repo at hhhh.org and older repo at GitHub.}

Answer 4

'Put Back' the File, Use the search function to search for the file, When you find your file, Right-Click it and select "Open Enclosing Folder"