How To Undelete Files in Mac OS X [MacRx]

Are You Sure?

It’s happened to us all: deleting a file, folder or entire disk, then realizing that you’ve made a mistake.  You reach for your backup – and you don’t have a backup.  What now?

There are several utilities available to help recover deleted files under Mac OS X.  Your chances of success depend on how the file was deleted and what you’ve done since then.  Unfortunately you will also lose your original filenames, though some reconstruction is possible.

Deleting, Erasing & Partitioning

On the Macintosh moving a file to the trash, then Emptying the Trash, deletes the item.  When you delete a file or folder you remove the entry for that item from the disk directory. Immediately after deletion the data still remains on the disk where it was but the directory says “that space is vacant.” As long as you don’t write anything new to the disk, recovery is usually straightforward.

If you accidentally delete something you need, if at all possible stop using the affected disk immediately.

Another way to delete a file is to use Apple’s Disk Utility to Erase a drive.  By default Disk Utility does a Quick Erase, which just deletes the disk directory and replaces it with a new empty copy. The underlying file structure on the volume is not changed, and any existing data remains in place until it gets overwritten.

Partitioning a disk removes all existing volumes on a device, then creates new ones with new disk directories. However like a Quick Erase, Partitioning doesn’t actually remove underlying data, it just marks the space as available.  File recovery is usually possible on re-partitioned drives, though this will require a more thorough scan than with a standard erase.

A Secure Erase – typically a multi-pass process – writes new data to the disk and is deliberately destructive to old data.  The utilities described here will not work if a Secure Erase is performed on your disk, recovery will require a forensic data recovery service.

Undeleting Files

All Undelete utilities require use of a separate recovery disk to which are copied recovered files. The recovery disk needs adequate free space for the expected amount of data.  A hard disk, flash drive, another Mac in Target Disk Mode, or even an iPod, can be used to store recovered files.

There are a number of utilities available for this task, the two I’ve relied upon most are SubRosaSoft FileSalvage and Prosoft Data Rescue.  Both are often worth having around in crisis situations, sometimes a few files will be found by one but not the other.

FileSalvageYou are usually given the choice of a different levels of scanning, from Quick Scans for recently erased files, to Full Salvage operations for erased or damaged drives.  If you know the kinds of files you are looking for, that can speed things up.  It’s usually worth trying the quickest options first, then increase the scan levels as needed if you don’t find what you need.

ProSoft Data Rescue

Recovery programs typically work in two passes, first scanning the drive to see what it can find, then recovering the data.  This can take minutes, hours or days depending on the size of the drive, number of files to recover, and condition of the media; a damaged or slow disk can substantially slow down the process.

Scanning the drive takes about the same time with both programs.  FileSalvage display the tally of found files in real-time,  Data Rescue utilizes a post-scan parsing.  The result is typically a huge number of recovered files sorted by file type – Documents, Audio, Movies, Pictures – but no filenames!

It’s nice to get a thousand Microsoft Word documents back, but not very helpful when they’re named D3464.doc, D3465.doc, etc..  Similar results happen for all file types: .xls, .pdf, .jpg, .tif, .mov, et.al.  We’re really only halfway there…

Recovering Lost Filenames

Why are filenames lost when recovering data?  After a particularly challenging recovery job I posed this question to both ProSoft and SubRosaSoft tech support. Here are the responses I received from each company:

ProSoft: It’s most likely a problem resulting from the reformat which wiped out the old file catalog. A lot depends upon the type of file and the program which created it. Some programs embed metadata (in the case of MP3’s, they are called ID3 tags, in the case of camera images, it’s called EXIF data) which may contain the name of the file, but that does not hold true for each and every file type.

SubRosaSoft: The file names will not be included as they are not actually stored in the file but rather in the system’s catalog/ b-trees. As soon as the file is deleted, the information will be removed and the space recycled and overwritten. FileSalvage will recover your files to the folder of your choice but the specific folders they were in and placement will not be the same.

This outcome can be anything from a minor inconvenience to a major headache, depending on how many files you have.  Other than opening and renaming each file individually, what are the options?

One nice bonus with FileSalvage:  after recovering files the program asks if you would like to attempt to rebuild filenames.  This yields mixed results but is worth trying; the resulting filenames are not the originals but rather get recreated from data within files that FileSalvage can read.  Text and word processing files typically get named with first few words in the file.  It’s not perfect, but this feature alone has made FileSalvage the first tool I use for this job.

While filenames are not preserved, metadata within files is preserved. This is a big help for movies, videos and music files.  You can import the affected files into iTunes via File –> Add to Library…  iTunes will scan the embedded metadata and add the items to your library with correct information, even if the files themselves are generic.

Importing images into iPhoto (or other photo manager) can similarly help with pictures.  The import process can take some time, but when finished you can view everything in a scalable grid, view any embedded metadata, and get rid of unwanted cruft. You’d be amazed at how many tiny images from web cache files and help documents exist on a standard hard drive.

For remaining documents containing text (Word, Excel, PDF, etc.), Spotlight will eventually re-index the content, then you can try finding things via a text search.  Which is OK, though far from ideal.

Bottom line:  help is available when you need it, but keep those backups current!

Related
  • sara

    Data loss on Mac system can occur due to virus attack, formatting or re-formatting Mac volumes, accidental deletion, power surge, etc. You can recover deleted file from Mac using Mac file recovery software’s. One of Mac file recovery software is Remo Recover (Mac) – Basic Edition that will recover all your deleted files by just few simple clicks. It uses advanced algorithm for recovering lost and deleted files from hard drive.
    http://www.recover-deletedfiles.net/mac.html

  • mark88

    Last month , i . I mistakenly deleted my photo last week. I got a photo recovery software to  get back them. You can download it from: http://www.any-data-recovery.com/product/photorecoveryformac.htm

  • jennifer246

    Hi,
    The above described blog is very nice and the software used to recover deleted files from Mac is awesome. However, you can also try Macintosh data recover tool which can even
    recover trashed items on Mac
    OS X. Just click here to get the software and use it to restore all your deleted or lost files from Mac.
    Regards,
    Jennifer

  • Lezza

    All the above suggested softwares and tools are really great. You can also go for Free Mac Data Recovery software to undelete files on Mac OS X. This is great recovery software and recover and restore all deleted files only with few clicks of mouse. For more info, visit:
    http://www.freemacrecovery.net/recover-deleted-data-from-memory-card-on-mac-os
    http://freemacrecovery.blogspot.com/2013/02/how-to-restore-deleted-photos-from-mac.html

  • markwilliams

    Simply go for a Mac photo recovery software. There is a good Mac photo recovery software that work for the Mac OS. Try the demo version http://www.mac-photorecovery.com/ of the software. Demo version of the software provides the preview of the lost files. It will help you a lot.

  • romiyolouis

    Data loss scenario is one of the common issues generally faced by all Mac users one a time in their life but now if you faced any data loss scenario then, you can easily restore your undelete files from Mac desktop and laptop without backup with the help of Mac data recovery software.

    Read More : http://www.deletedfilerecoverymac.org/macrecovery-from-desktopandlaptop.php

  • PaulSmith

    You can use FREE data recovery software for Mac OS X – Disk Drill
    http://www.cleverfiles.com

  • Maxxwell

    How to recover deleted files Mac?
    http://www.recoverdeletedfilesmac.org/

  • hardnisuy

    If you are facing data loss situation on Mac due to any restone like accidental deletion, Hard disk corruption or another big cause, you can simply restore your data from Mac effectively by using Mac Data Recovery Software that will help to easily recover damaged, corrupted, deleted or lost Mac data in its original file format.
    Read more: http://www.recovery-ipad.com/

  • Backmana

    You can’t do it with any command or utility that comes with Mac OS X. However, there are third-party utilties that may be able to recover files that have been deleted. For example, I use TechTool Pro (by Micromat), and I can see there is a Data Recovery tool. I have not used this part of TechTool Pro. Here’s another one (which I have not used either)

    http://x.co/3Kzud

    NOTE: The data from files that are erased are still there on the hard drive, but the hard drive space they occupied is made available for new files. Therefore, as long as new files are not written over the space that was used by the old files, data recovery tools may be able to recover the old files. So it is important to use the disk with those deleted files as little as possible, to minimize new data being written to it.

  • davidheath

    It is possible for recovering lost files even the trash has been emptied, but you must make sure that after file loss happened you did not put anything new into the path where your lost files were stored before. Any problems you can check details here to see if it can help you: http://www.uflysoft.com/data-recovery-mac

  • DougAEvans

    You can use FREE data recovery software for Mac OS X – Disk Drill
    http://www.cleverfiles.com

    the way to recover deleted files Mac

About the author

Adam RosenAdam Rosen is an Apple certified IT consultant specializing in Macintosh systems new and old. He lives in Boston with two cats and too many possessions. In addition to membership in the Cult of Mac, Adam has written for Low End Mac and is curator of the Vintage Mac Museum. He also enjoys a good libation.

(sorry, you need Javascript to see this e-mail address)| Read more posts by .

Posted in How-To, MacRx, Top stories | Tagged: , , , , |