How to recover deleted messages in Apple Mail

August 2, 2006 9:33 PM

I have foolishly deleted my entire Apple Mail inbox and unwittingly deleted its trash before realizing this fact. Can anyone help me recover four years of personal and school correspondence?

So, I was away on vacation and returned to find my school mailbox filled with quite a bit of spam and other undesired messages. In the process of deleting these messages, I must have hit "select all-delete" instead of "shift-delete" or something alone those lines, because instead of deleting the relatively small selection of mail I had intended, my entire inbox has disappeared. The files were deleted through Apple's Mail utility, which is running in OS 10.3.9 Panther. To make matters worse, these messages are nowhere to be found in the trash bin of the Mail utility or the general system trash, which have both been emptied since then.
It is my understanding that not everything that is deleted from a computer disappears instantly, so I'm wondering if there are any (preferably inexpensive) steps I can take to recover these messages. It has been approximately 10 hours since this occurred, though I just discovered it now.
A big thank you in advance for everyone that takes the time to read and reply to this message.

posted by after_hours to computers & internet (6 comments total)

I had good results with Data Rescue II. It recovered a high precentage of accidentally deleted stuff.
posted by BorgLove at 9:47 PM on August 2, 2006

I should add, it categorized the stuff it recovered by types of data; mail was one of the types.
posted by BorgLove at 9:48 PM on August 2, 2006

I think the first thing to do is stop using your computer, to the extent that it's possible. The files will probably be recoverable until another file is saved in that part of the hard disk, so you should avoid doing anything that might cause that to happen (this would include temporary files, swap files, etc). Then it's a matter of using some kind of "undelete" retrieval software. Unfortunately, I can't recommend anything in particular. Hopefully someone else can.
posted by robcorr at 9:57 PM on August 2, 2006

Your understanding is correct: When you delete something from a hard drive, the computer usually doesn't erase it, rather it just marks that space as available for writing new data. So the old stuff is still there.

First of all, avoid using the machine as much as possible. (I know, you're probably using it to read this message right now.) Almost everything you could do with the computer would involve writing to the hard drive to some extent, even if you're not actively creating and saving documents, and writing to the hard drive means writing over the old data you want back.

The best scenario would be to get your hands on a second Mac, connect it to your Mac with a FireWire cable and boot your Mac into "FireWire Target Disk Mode" by holding down the T key when you boot your Mac. This effectively turns your Mac into an external hard drive for the second Mac, and makes sure that the OS doesn't overwrite any data while you're trying to retrieve it.

Now, download, install, and run some file recovery software on the second Mac -- just point the utility at your Mac's hard drive. There are a lot of applications out there that will do this. Unfortunately, they're all a bit pricey; after all, recovering deleted data is something lots of people are quite willing to pay for! The best one I know of is Data Rescue II. There may be free alternatives out there, but I've never heard of them.
posted by jjg at 9:59 PM on August 2, 2006

Thank you to everyone who has responded so far. I shut down the machine (an iBook) earlier and am currently viewing and responding from a Mac Mini. Data Rescue II looks like a good resource, and, as jjg mentioned, there doesn't appear to be a good free alternative, so I imagine that is what I'll go with unless anyone has any other suggestions. Thanks again!
posted by after_hours at 10:34 PM on August 2, 2006

You're in luck to a certain extent because the Mac disk format HFS+ has features designed to prevent fragmentation, one of which involves maintaining a pointer to where the next block will be allocated rather than just using the first free block it can find. This has the side effect that the OS usually doesn't overwrite blocks from deleted files right away even if you've saved new files, which is nice if you're trying to undelete stuff.
posted by kindall at 10:42 AM on August 3, 2006