GVFS metadata file contains traces of TBB being deleted (Debian Linux)
A forensic analysis of the Tor Browser Bundle on Debian Linux (#8166 (closed)) showed that the file /home/runa/.local/share/gvfs-metadata/home-c0ca7993.log contains lines indicating that the Tor Browser Bundle was deleted: /.local/share/Trash/expunged/3864782161/Docs/Vidalia/CREDITS, /.local/share/Trash/expunged/3864782161/start-tor-browser, /.local/share/Trash/expunged/3864782161/App/tor, and so on.