How to tell where an item in the Trash came from?

I saw this problem and was intrigued. I ended up writing a quick Foundation tool based on this function and wrapped it in an AppleScript application.

http://dl.getdropbox.com/u/896591/PathForTrashItem.zip

Stick it in your toolbar and it should tell you the path for the selected item. I make no promises. :)

It shouldn't ask you for your password. If it does, something is odd. You can still open the application with AppleScript Editor, if you want to look at the AppleScript source.

Two main issues:

• The Finder appears to update the .DS_Store file periodically, so it might fail for items you recently added to the Trash.
• It can only handle one item at a time.

You can use dsstore_dump.pl tool which can read a store file's records in human-readable format.

It's part of the Mac-Finder-DSStore project written in perl by Wim L which provides routines for reading and writing the .DS_Store files generated by the OS X. See also: dsstore_dump.pl at GitHub and at my fork.

Sample usage:

$ perl dsstore_dump.pl ~/.Trash/.DS_Store

    &makeEntries("foo.png",
        ptbL => "Users/username/Desktop/",
        ptbN => "foo.png"
    ),

Installation of this tool is covered in README file.

You can also run above script using the following one-liner in your Terminal:

perl <(curl -s https://raw.githubusercontent.com/kenorb/binfiles/master/dsstore_dump.pl) ~/.Trash/.DS_Store 

Related: How do I check where the file in .Trash was removed from?

There is a great write up and some easier solutions posted at http://ponderthebits.com/2017/01/mac-dumpster-diving-identifying-deleted-file-references-in-the-trash-ds_store-files-part-1/

Including this Terminal one-liner to convert a .DS_Store file to (mostly) text:

xxd -p <path/to/.DS_Store> | sed 's/00//g' | tr -d '\n' | sed 's/\([0-9A-F]\{2\}\)/0x\1 /g' | xxd -r -p | strings | sed 's/ptb[LN]ustr//g'