“A question regarding .Trashes: Which deleted data is saved on the boot volume .Trashes? If a file was deleted from an external volume it goes to the .Trashes of the external volume and not to the .Trashes of the boot volume or not?“
Here’s the short answer: It goes to the .Trash folder on the external volume.
Now the details.
This is how Apple defines the different .Trash folders:
User .Trash – This is where deleted files & folders from the boot volume go. They will remain here until the user empties their Trash.
Mounted Volume (external) .Trash – External volumes have a .Trashes directory for files and folders deleted from it. Each user has their own .Trash directory so subdirectories may be here for different users and given names according to their user ID number.
User .Trash on the Dock is a total of all the deleted files on all plugged in drives on the system for the logged in user. Apple built it this way so OS X can detect deleted files on external devices and present them to the user – in their Trash – on different systems in case recovery/ put back is needed.
I did some tests for validation on 10.9 and this is what I found:
1. On the boot volume and in the user account (i.e. Desktop) deleted files goes into User’s .Trash (/Users/<accountname>/.Trash)
2. On External FAT Volumes (i.e. Flash drives) deleted files goes into .Trash on the USB (Volumes/USBFAT32/.Trashes/501) – a link to it will appear in the user’s .Trash folder (on Dock), presumably to allow the user to use the “put back” feature to restore the file. It does not appear in the System’s .Trash in the root.
3. On External HFS Volumes (i.e. Flash Drives) deleted files goes into .Trash on USB (/Volumes/USBHFS/.Trashes/501) – a link to it will appear in the user’s .Trash file that deleted it, again, presumably to allow the user to use the “put back” feature to restore the file.
Article by Mike Leclair, creator and developer of the Surviving Digital Forensics series and part of the SUMURI RECON for Mac OS X team.