The Trash has been one of the most enduring features of the Mac, and a prime example of how it has transformed our use of computers. A direct descendant of the Lisa’s Wastebasket from 1983, it marks the transformation from unforgiving deletion in the command line to direct manipulation that recognises how humans often have second thoughts. Implemented by Bill Atkinson and designed by Susan Kare, the Trash is actually a figment of the Finder’s imagination, as it doesn’t really exist. What appears to be a single folder, originally on the Desktop and now in the Dock, draws together the contents of several or many directories, some of which behave differently.

Local Trash

At the heart of the Trash is a hidden folder named .Trash at the top level of each user’s Home folder. Drag any file or folder from the Data volume to the Trash, and it’s moved from its original location to ~/.Trash. As that’s within the same volume, the item doesn’t actually go anywhere, of course. For documents and other items inside the same Home folder, that’s straightforward, but those in common areas such as the main Applications folder are moved to the current user’s ~/.Trash folder, and vanish from the files and folders seen by other user accounts.

Other volumes

When items in other volumes, typically those in external storage, are moved to the Trash, they don’t end up in ~/.Trash, but in a hidden folder at the root level of that volume, named .Trashes. Because this too is user-specific, where a .Trashes folder exists it contains a sub-folder for each user who has used it, named by user account ID. Normally, for the primary admin user that will be 501. The Finder’s illusion then merges the contents of /.Trashes/501 with ~/.Trash when displaying the Trash contents, and so on for all other mounted volumes with .Trashes folders.

For other users, with their individual ID numbers, this has a similar effect to that of common items in the Data folder. If the primary admin user, ID 501, puts a file on another volume into the Trash, they see it in their own Trash, but for other users it just vanishes. So the Trash contents are both per-user and per-volume, which can become complicated on Macs with multiple users and multiple volumes.

This can also lead to slow opening of the Trash, if one or more volumes with a .Trashes folder is slow to deliver its contents for the Finder to merge with contributions from other volumes.

Network shares

These are normally an exception, as the concept of Trash folders isn’t shared with external file systems, such as those of a NAS. Normal behaviour then reverts to the lowest common standard, and files and folders are simply deleted, rather than passing through any Trash system. macOS should warn you before that happens.

iCloud Drive

This has its own Trash folder at ~/Library/Mobile Documents/.Trash, which is also merged into the collection shown by the Finder in its Trash. However, there are several differences in behaviour that aren’t well known, and can catch you out.

Although items in local storage that are moved to the Trash don’t get deleted until the user empties the Trash (or that’s performed automatically), items in iCloud Drive that are in its .Trash folder are automatically deleted after 30 days, regardless of any Finder settings. However, deleted files in iCloud Drive can normally be recovered for a period of 30 days, using that feature in the iCloud.com website portal to that account.

Other trash folders don’t modify files when they’re moved to the Trash, but those in iCloud Drive gain two additional extended attributes:

• com.apple.clouddocs.private.trash-parent-bookmark#B contains a plain text path like com.apple.CloudDocs/E0C5C042-8F5B-4C4A-B29E-E4BE2188FBA3/e65bd898a60126eb75419a251c21587cc7b5a840 which appears to refer to the parent item in iCloud Drive.
• com.apple.fileprovider.trash-put-back#PN contains brief UTF-8 text such as n53 which appears to provide iCloud Drive with the information needed to support the Put Back feature of Trash.

Time Machine backups

The contents of ~/.Trash, per-volume .Trashes and iCloud Drive’s .Trash folders are excluded from Time Machine and most other backups. Although this makes sense, it can catch users by surprise when items have been deleted later. If you want to find those in your backups, you’ll need to look earlier to when they were still in regular folders, not the Trash. However, you may have more luck with snapshots if they’re available.

Snapshots

Although not normally backed up, the contents of a volume’s .Trash or .Trashes folders are invariably included in any snapshot made of that volume, from where they can be recovered later.

In Time Machine, the volume must be included in Time Machine’s backups, as it only makes snapshots of volumes that it backs up. Those are automatically deleted once they are 24 hours old, so catching a backup still containing files that were subsequently deleted requires prompt action. One good reference point is provided by the list of available snapshots for each volume in Disk Utility, when set to Show APFS Snapshots. The contextual menu then allows you to mount a snapshot and access its contents in the Finder.

Snapshots do have their own effects on the Trash that many find puzzling.

If there are no snapshots on a volume, when its Trash is emptied, those files and folders are removed from the file system, and the space occupied by their file data is returned for reuse. However, all those files captured in a snapshot are retained there as part of that snapshot, and their data is also retained, until that snapshot is deleted. It’s only when a file and its data are no longer part of any snapshot that they can be removed from the file system and their storage space can be returned. This doesn’t apply to files both created and deleted since a snapshot was made, though.

The end result is that measures of real free space won’t change when the Trash is emptied and its contents deleted when those are still referenced by a snapshot.

Real locations of Trashes

• ~/.Trash of the current user for the Data volume,
• /.Trashes/501 on volumes other than Data, for each user ID,
• ~/Library/Mobile Documents/.Trash for iCloud Drive.