Recovering Deleted Files

If you have a Mac, you want to know this... If you ever accidentally delete your files (yes, I mean delete even from "Trash"), this can help you recover them.

I found this out the hard way. I accidentally deleted a bunch of my directories today. I was using the terminal (and the rm command) so my deleted files were not in "Trash" – they were permanently gone. I then dug through 6 different data recovery tools. One after the other, they failed to recover anything useful. I gave up and decided to try avoid this problem by setting up automatic daily backups to S3. During this, I also decided to get my dusty hard drive and see if I could recover any of the deleted files. The main problem was that I had not done a Time Machine backup in over 6 months (in fact, I had not connected my hard drive to my Mac during this time). When I was going through the snapshots, I found one from 3 AM today... I checked it and found that all my deleted folders are there! As mentioned, my hard drive was not connected to my mac for over 6 months. So how did Time Machine have a backup of my data from earlier today. For context, I do not have my files synced with iCloud and my hard drive does not work wirelessly. The only explanation I can think of is that Time Machine was able to act as a data recovery software and recover all the files I had deleted a few hours ago. This is merely my speculation – use at your own risk!

Ultimate guides for Mac users that accidentally delete files:

  1. Don't! If you are a developer, use trash-cli instead of rm
  1. Have backups... You can use iCloud, a Hard Drive, or even setup automatic daily backups on S3 using Duplicati.
  1. To recover:
    1. Look at your "Trash" and see if you can find the deleted file there
    1. If you have iCloud synced or other backups, recover it using that
  1. If you didn't follow 1-2, then
    1. Make sure you don't write/move/copy/delete anything more from your hard disk – this will avoid rewriting the existing data in your disk
    1. Plug in your hard disk and open the Time Machine app
    1. Start a backup through time machine (fastest way I found to do this w/o having to wait for automatic backups was to add Time Machine to my Menu Bar (this can be done through System Preferences) and then from the Menu Bar choosing Time Machine and clicking “Back Up Now“
    1. Open your Time Machine App and try to find snapshots from earlier in the day (i.e. when the files were deleted)
    1. This worked for me, even though the last time I had connected my hard drive to my mac was months ago). Despite it working for me, it doesn’t necessarily mean it will work for you, too! Maybe I just got lucky : )