Samsung Trash Provider App - Traces of deleted files never hurt

This post shows my result of my research on the Samsung Trash Provider App on Samsung Android devices.

Android Version Tested:
Android 16

Test device:
Samsung Galaxy S23

Database location:
[...]/com.samsung.android.providers.trash/databases/trash.db

What is this app about?

The Samsung Trash Provider App is not an app a user directly interact with. The app is used by other apps (e.g. MyFiles and Gallery App) to offer trash bin functionality. In earlier OneUI/Android versions this worked differently. There every single app had its own trash functionality implementation.

This means it is still possible, that trash data is also stored in the individual app.

What's in the databases?

In the database "trash.db" is one interesting table, it is called "trashes". With the following interesting columns.

• _data - Current file path
• original_path - The original File path
• _id - Some file id
• media_id - an additional id, empty for my data
• sec_media_id - id in the corresponding Samsung app, was filled for Gallery app and matched the idea there in my data
• is_cloud - for my data always 1 - but I did not have any cloud sync active - so meaning not known atm
• volume_name - The name of the volume the data is stored on
• title - In my data always the file name with file extensions
• _display_name - What is shown in the apps - identical to file name in my data
• _size - Size of file in bytes
• mime_type - Recognized MIME type of the file
• media_type - 1 = Image, 2 = Audio, 3 = Video, Pretty sure there are more types but I only have these in my data atm
• datetaken - if media was taken on the phone this value is set - didn't found another case were it was filled
• date_expires - the date/time this file will be deleted completely from trash
• date_deleted - the date/time the file was moved to trash
• user_id - which user account deleted it (0 = main user, 150 = secure folder context)
• extra - additional info from the source app, JSON based - can hold exif data (location, timestamp taken etc.)

Example SELECT query:

SELECT
    _id [File ID],
    _data [Trash File Path],
    original_path [Original File Path],
    title [File Titel],
    _display_name [File Name],
    _size [File Size],
    mime_type [MIME Type],
    delete_package_name [App Context],
    is_cloud [Cloud?],
    user_id [User ID],
    strftime('%Y-%m-%d %H:%M:%S.', "date_deleted"/1000, 'unixepoch') || ("date_deleted"%1000) [Deletion Timestamp],
    strftime('%Y-%m-%d %H:%M:%S.', "date_expires"/1000, 'unixepoch') || ("date_expires"%1000) [Expiration Timestamp],
    extra [Extra Info JSON]
FROM trashes
        

Location of the deleted files

The files are stored in the media part of the Android system under Android/.Trash

Full path can be e.g. /data/media/0/Android/.Trash/[...]

The pattern in this is as follows:

[appcontext]/[file_uid]/[old_file_path]/.!%#@$/[old_file_name]

Example:

/storage/emulated/0/Android/.Trash/com.sec.android.app.myfiles/f00f4be8-7dad-4996-aedb-6edc4b9f42d3/1763651528662/storage/emulated/0/Music/Telegram/.!%#@$/deleted_file.ogg

With this info, even if we do not have any database access, we can tell a bit about the file. From the example above:

• App Context - The files was deleted via the App Samsung My Files
• Old File Path - The original File path was /storage/emulated/0/Music/Telegram/
• Old File Name - The original File Name was deleted_file.ogg

This fits what I've done on my test phone.

Additionally Good to know

Based on the values for date_expires and date_deleted one can say that per default the files will stay 31 days in the trash and than will be deleted automatically.

But, in my test data - the entry in the database was kept in it - so file was gone, trace of it was still there.

I recovered one file (undeleted via GUI), the entry is immediately deleted from the database and the file is moved back to its original location.

Conclusion

1. The Samsung Trash Provider App stores info on deleted files. Also from other Apps like Samsung Gallery and MyFiles.

2. The files are kept for 31 days in the Trash

3. Even if we only have the files in the default trash folder location (e.g. /media/data/0/Android/.Trash/) we can say a few things about the files. E.g. in which app context it was deleted, what was the original path and the original file name

I've created an ALEAPP parser for this. It is part of an already open PR (#665) waiting to get pulled into the ALEAPP repo.