Recover deleted files in OS X?

May 18, 2005 2:27 PM

Is it at all possible to recover deleted files from OS X? What if they were deleted 6 months ago?

I have read that it is absolutely impossible with OS X, because UNIX rewrites immediately. (For the record, I have only a vague idea of what I just said.) But then talking to Apple Support, they said otherwise, though the guy really didn't sound very sure and couldn't point me in any direction.

To complicate -- the files were deleted 6 months ago. Any idea if there's anything I can do?

My wife just discovered she accidently deleted all her school files from the past two years -- she thought she had backed them up to disc (6 mos ago) before she deleted them. Oops.

posted by rough to computers & internet (10 comments total)

Well, first let me explain how the filesystem works, and how file recovery works.

Files are stored on the hard drive at spesific locations, and those locations are stored in the file allocation table (or whatever it's called on OSX). When you erase a file, the entry in the allocation table is removed, and the operating system now thinks that the space where the file used to be is "free" space, but all the data is still there.

The problem is that if you (or an automated program) saves anything on the hard drive, the OS might pick that spot to plop it down. If you've ever defragd your hard drive (does OS X do this automaticaly?) then you're data is almost certanly gone.

You might have had a chance if you'd done this immediately, but after six months I'd say it's highly unlikely that you're data is still there.
posted by delmoi at 2:44 PM on May 18, 2005

The odds are pretty much slim to non-existent--basically, when you first "delete" a file, most OSes will actually leave the file data on the drive, but just mark the space as "available".

You have to remember, though, in a modern file system, that documents aren't stored as long, contiguous stretches of data. Any given file is physically scattered in a million little pieces across the drive's surface, and the drive uses a very big table to keep track of all the pieces, and retrieve them in order when you need them.

Once you say "I don't need this file any more", it just starts using up those old slots on the drive as it needs them. As a total hypothetical example, in a day, 10% of the old data may be eaten up in random chunks, 50% might be gone by the end of the week, and it all might be gone by the end of the month.

The actual rate is _totally_ dependent on the size of your drive, the size of your files, the amount of other free space, etc., It could all be gone in a day. The basic point is that even once 5-10% of the data is overwritten, the files are pretty much useless. The odds of reconstructing anything useful after a couple of days, let alone 6 months, is just about nil.
posted by LairBob at 2:49 PM on May 18, 2005

I hate to add to the bad news, but here's another problem.

During any installations, OS X performs defragmentation-like operations during the "Optimizing System Performance" Step.

So if you've installed any software since those files were deleted, the other files on your system were very likely consolidated/defragmented into the space those files occupied on your disk.
posted by Crosius at 3:10 PM on May 18, 2005

"During any installations, OS X performs defragmentation-like operations during the "Optimizing System Performance" Step."

I'd like to point out that this is untrue. No filesystem maintenance is performed during this phase of installation. See man update_prebinding for what actually happens.

In any case, after six months, if the system has been regularly used in the interval, there's next to no chance of data recovery. The chance of success is so slim as to be essentially nonexistent.
posted by majick at 3:48 PM on May 18, 2005

"Optimizing System Performance" saves hints that tell applications how to access system libraries so that it doesn't have to be calculated when you run them. That said, Mac OS X does automatically defragment files smaller than 20MB whenever you access one.

In answer to the original question, you'd be lucky to recover a deleted file after six hours of using your computer.
posted by cillit bang at 5:01 PM on May 18, 2005

Thanks for the correction, majick.
I dig that I learn something every day on Metafilter.
posted by Crosius at 7:00 PM on May 18, 2005

fwiw I have a friend who accidentally deleted on OSX his only draft of an important document (a phd "qualifying exam", which in our department is a substantial research paper that when defended, allows you to become an official doctoral candidate). He tried to do data recovery (both by some program he downloaded, and by mounting the drive remotely via firewire and trying to find pieces of the file manually) a day later. He had no luck with this at all - as far as he could tell, no trace remained of the file. He ended up retyping the whole thing from a hard copy. So after six months, I think the odds are very very low.
posted by advil at 9:45 PM on May 18, 2005

OS X has done some automatic file defragmentation since 10.3: ". . . the short answer is that fragmented files less than 20MB large on journaled HFS+ disks are defragmented automatically in Panther when they are opened, whether for reading or for writing."
posted by D.C. at 4:42 AM on May 19, 2005

Thank you all. I was guessing it was hopeless, but of course, told my wife that I thought there was still a chance.

Now.... who wants to tell her?
posted by rough at 6:39 AM on May 19, 2005

Although recovering deleted files is hit or miss on a modern operating system, it is the case that the HFS+ filesystem used by the Mac does make some effort to keep deleted files recoverable. For example, the filesystem maintains a "pointer" to the next block to be allocated, which is typically in a nice big chunk of free space. This way the next blocks allocated are less likely to be the ones that used to contain your file. But on a multi-user OS like Mac OS X, where the system itself is continually creating, writing to, and deleting files, this makes less of a difference than it used to make on the older OSs.
posted by kindall at 10:06 AM on May 19, 2005