It’s happened to us all: deleting a file, folder or entire disk, then realizing that you’ve made a mistake. You reach for your backup – and you don’t have a backup. What now?
There are several utilities available to help recover deleted files under Mac OS X. Your chances of success depend on how the file was deleted and what you’ve done since then. Unfortunately you will also lose your original filenames, though some reconstruction is possible.
Deleting, Erasing & Partitioning
On the Macintosh moving a file to the trash, then Emptying the Trash, deletes the item. When you delete a file or folder you remove the entry for that item from the disk directory. Immediately after deletion the data still remains on the disk where it was but the directory says “that space is vacant.” As long as you don’t write anything new to the disk, recovery is usually straightforward.
If you accidentally delete something you need, if at all possible stop using the affected disk immediately.
Another way to delete a file is to use Apple’s Disk Utility to Erase a drive. By default Disk Utility does a Quick Erase, which just deletes the disk directory and replaces it with a new empty copy. The underlying file structure on the volume is not changed, and any existing data remains in place until it gets overwritten.
Partitioning a disk removes all existing volumes on a device, then creates new ones with new disk directories. However like a Quick Erase, Partitioning doesn’t actually remove underlying data, it just marks the space as available. File recovery is usually possible on re-partitioned drives, though this will require a more thorough scan than with a standard erase.
A Secure Erase – typically a multi-pass process – writes new data to the disk and is deliberately destructive to old data. The utilities described here will not work if a Secure Erase is performed on your disk, recovery will require a forensic data recovery service.
All Undelete utilities require use of a separate recovery disk to which are copied recovered files. The recovery disk needs adequate free space for the expected amount of data. A hard disk, flash drive, another Mac in Target Disk Mode, or even an iPod, can be used to store recovered files.
There are a number of utilities available for this task, the two I’ve relied upon most are SubRosaSoft FileSalvage and Prosoft Data Rescue. Both are often worth having around in crisis situations, sometimes a few files will be found by one but not the other.
You are usually given the choice of a different levels of scanning, from Quick Scans for recently erased files, to Full Salvage operations for erased or damaged drives. If you know the kinds of files you are looking for, that can speed things up. It’s usually worth trying the quickest options first, then increase the scan levels as needed if you don’t find what you need.
Recovery programs typically work in two passes, first scanning the drive to see what it can find, then recovering the data. This can take minutes, hours or days depending on the size of the drive, number of files to recover, and condition of the media; a damaged or slow disk can substantially slow down the process.
Scanning the drive takes about the same time with both programs. FileSalvage display the tally of found files in real-time, Data Rescue utilizes a post-scan parsing. The result is typically a huge number of recovered files sorted by file type – Documents, Audio, Movies, Pictures – but no filenames!
It’s nice to get a thousand Microsoft Word documents back, but not very helpful when they’re named D3464.doc, D3465.doc, etc.. Similar results happen for all file types: .xls, .pdf, .jpg, .tif, .mov, et.al. We’re really only halfway there…
Recovering Lost Filenames
Why are filenames lost when recovering data? After a particularly challenging recovery job I posed this question to both ProSoft and SubRosaSoft tech support. Here are the responses I received from each company:
ProSoft: It’s most likely a problem resulting from the reformat which wiped out the old file catalog. A lot depends upon the type of file and the program which created it. Some programs embed metadata (in the case of MP3’s, they are called ID3 tags, in the case of camera images, it’s called EXIF data) which may contain the name of the file, but that does not hold true for each and every file type.
SubRosaSoft: The file names will not be included as they are not actually stored in the file but rather in the system’s catalog/ b-trees. As soon as the file is deleted, the information will be removed and the space recycled and overwritten. FileSalvage will recover your files to the folder of your choice but the specific folders they were in and placement will not be the same.
This outcome can be anything from a minor inconvenience to a major headache, depending on how many files you have. Other than opening and renaming each file individually, what are the options?
One nice bonus with FileSalvage: after recovering files the program asks if you would like to attempt to rebuild filenames. This yields mixed results but is worth trying; the resulting filenames are not the originals but rather get recreated from data within files that FileSalvage can read. Text and word processing files typically get named with first few words in the file. It’s not perfect, but this feature alone has made FileSalvage the first tool I use for this job.
While filenames are not preserved, metadata within files is preserved. This is a big help for movies, videos and music files. You can import the affected files into iTunes via File –> Add to Library… iTunes will scan the embedded metadata and add the items to your library with correct information, even if the files themselves are generic.
Importing images into iPhoto (or other photo manager) can similarly help with pictures. The import process can take some time, but when finished you can view everything in a scalable grid, view any embedded metadata, and get rid of unwanted cruft. You’d be amazed at how many tiny images from web cache files and help documents exist on a standard hard drive.
For remaining documents containing text (Word, Excel, PDF, etc.), Spotlight will eventually re-index the content, then you can try finding things via a text search. Which is OK, though far from ideal.
Bottom line: help is available when you need it, but keep those backups current!