trash

$ target-query <path/to/target> -f trash

Details

Module	dissect.target.plugins.os.unix.trash.GnomeTrashPlugin
Output	records

Module documentation

Linux GNOME Trash plugin.

Function documentation

Yield deleted files from GNOME Trash folders.

Recovers deleted files and artifacts from $HOME/.local/share/Trash. Probably also works with other desktop interfaces as long as they follow the Trash specification from FreeDesktop.

Also parses media trash locations such as /media/$USER/$Label/.Trash-*, /mnt/$Label/.Trash-* and other locations as defined in /etc/fstab.

Resources:

• https://specifications.freedesktop.org/trash-spec/latest/

• https://github.com/GNOME/glib/blob/main/gio/glocalfile.c

• https://specifications.freedesktop.org/basedir-spec/latest/

Yields TrashRecord records with the following fields:

ts           (datetime): timestamp when the file was deleted or for expunged files when it could not be permanently deleted
path         (path):     path where the file was located before it was deleted
filesize     (filesize): size in bytes of the deleted file
deleted_path (path):     path to the current location of the deleted file
source       (path):     path to the .trashinfo file