Examine a .DS_Store file?

There is a great write up and some easier solutions posted at http://ponderthebits.com/2017/01/mac-dumpster-diving-identifying-deleted-file-references-in-the-trash-ds_store-files-part-1/

Including this Terminal one-liner to convert a .DS_Store file to (mostly) text:

xxd -p <path/to/.DS_Store> | sed 's/00//g' | tr -d '\n' | sed 's/\([0-9A-F]\{2\}\)/0x\1 /g' | xxd -r -p | strings | sed 's/ptb[LN]ustr//g'

You can use hexdump or xxd to inspect the file contents directly - it is a binary file.

I would start with a perl or Python package rather than reinvent the wheel.

• http://search.cpan.org/~wiml/Mac-Finder-DSStore/DSStoreFormat.pod
• https://pypi.python.org/pypi/ds_store