On 2025-07-07, David Wright <[email protected]> wrote: > On Sun 06 Jul 2025 at 19:51:01 (+0200), Hans wrote: >> > But the regular trash folder? My first guess is "the user did >> > that" (of course without noticing: "modern DEs" are complex enough >> > to make such a scenario plausible). My second guess would be some >> > bug in the desktop environment (or in some extension thereof). >> >> Yes, that is what I think, too. Although the user is over 70 years old, I do >> not believw, he did it. Especially as this was not the first time, it >> happened. >> >> More I believe, this happens due to some settings or some script in the >> background. >> >> All the files are not gone, all the files are in the trash (trash means: >> Trash >> folder on the desktop). I have disabled the possibility to delete files >> directly, all deleted files are moved into the trash. After recheck the user >> then can empty the trash (Windows-behaviour). > > Am I right in thinking that Trash folders typically keep a note of > when items were placed there? Apart from analysing which folders were > moved and which left behind, the timings of their arrival in the Trash > could be helpful, particularly if a script is the cause (when the > script runs might be discoverable).
I think ~/.local/share/Trash/info/ contains a .trashinfo file for each trashed file (path and deletion Date).
