View a list of recent deleted items from Trash in macOS

I've deleted some big folders yesterday while on a shoot, to free up some space to be able to shoot tethered into the Mac. The folders where from past shoots and I've marked the folders to know which I had backed up in several places - just to be able to be on shoots and delete if necessary.

But, yesterday things went quick and I'm not sure if one folder got mixed with the others. So today I'm looking for a way to just see which folder/items I deleted/emptied from the Trash.

Logs, Terminal commands etc.?

Every Google search gets me to recovery posts.

Solution 1:

This following solution will not help you retrieve the filenames which were already removed from the trash, before implementing my solution. However you can use this solution to retrieve the filenames removed from the trash, in the future if you need to.

This AppleScript code works for me using the latest version of macOS Mojave.

You can attach a "Removing Items From" folder action to the /Users/YOUR SHORT NAME/.Trash folder that will write to file, the names of the files that were removed from the trash.

Create a new Script Editor document and insert this following AppleScript code.

on removing folder items from theFolder after losing removedItemNames
    writeToTheFile(removedItemNames)
end removing folder items from

on writeToTheFile(removedItemNames)
    set theFile to POSIX path of (((path to desktop as text) & "Removed From Trash.txt") as text)
    set text item delimiters to linefeed
    set theText to (removedItemNames as text)
    try
        set writeToFile to open for access theFile with write permission
        write theText & linefeed to writeToFile as text starting at eof
        close access theFile
    on error errMsg number errNum
        close access theFile
        set writeToFile to open for access theFile with write permission
        write theText & linefeed to writeToFile as text starting at eof
        close access theFile
    end try
end writeToTheFile

Next, save your new Script Editor document as "Removed From Trash Folder Action.scpt" to the folder... "/Users/YOUR SHORT NAME/Library/Workflows/Applications/Folder Actions/". Saving it to that location will add it to the list of scripts you can attach to folders in the Folder Actions Setup, which can be accessed when right clicking a folder in Finder, in the Services contextual menu.

Before you will be able to attach a folder action to the Trash folder, because the Trash folder is "hidden", you will first need to run this following AppleScript code to unhide all hidden files.

do shell script "defaults write com.apple.finder AppleShowAllFiles TRUE
killall Finder"

After all is said and done, if you want to re-hide all originally hidden files, just run this following AppleScript code to hide all hidden files.

do shell script "defaults write com.apple.finder AppleShowAllFiles FALSE
killall Finder"

Here is a look at the Folder Action creating the text file with the names of removed files from the trash

Solution 2:

To the best of my knowledge macOS does NOT log what files were deleted so there is no way to see what was done.

Your best bet now is to stop using your Mac until you get this issue resolved.

Why? Because any time you use your Mac files are written to the drive. And when you delete something the location on the hard drive that the file(s) occupied is marked as free (rather than used/occupied). So anything you save to the disk subsequently could overwrite those files, including just opening a web page. As web pages are cached (or saved to) the drive.

If you have a backup of those files go get them from a backup. If you don't and the files are no longer in the trash get yourself some file recovery software, install it on another Mac and put the Mac in question into target disk mode (so you are not writing anything to the disk) and look for deleted files.