You have deleted one or more files that you really shouldn’t have, and you don’t have a backup of that data, so you’re freaking out. Everyone’s been there at some point. If that is what has led you here, my advice to you is simple: stop reading right now! Yes, I’m totally serious. Shut down your computer immediately, and do not turn it on again until you have resolved the problem. Find a different computer, iPad, smartphone, anything with a web browser – go to your local public library if necessary – and read the rest of this article. If you keep using the computer, you reduce the chance of being able to recover what you need! I’ll be here when you get back.
Okay, back now? Time for a bit of explanation. When a file is deleted normally, that file’s data is not actually wiped off the hard drive. There is something called the “directory” on your hard drive that acts kind of like a phone book. It tells the computer where every file lives on that hard drive. When you delete a file, the computer simply removes that information from the directory. The file’s data is technically left in place, but the space it occupied is no longer marked as being in use, so it may be reused and “overwritten” at any time.
Consider the illustration at the right. Shown is a representation of a small part of the data stored on a hard drive. First in the “before” picture (top left) is an existing file, in green. Next, colored gray, is some space considered to be empty, with essentially random contents. Finally, colored red, is a very important document, containing the only copy of the combination for a safe, that was accidentally deleted. Because that file has been deleted, the system actually considers that space to be free, but the data is still there on the hard drive. In the “after” picture, the user added a couple items to the to-do list. The result: the larger to-do file has now overwritten part of the safe combination file. Even if a data recovery tool were to locate the remaining fragment of that file, the important data has been irreversibly destroyed.
You might argue that you’ll be careful not to do anything like editing a file. However, behind the scenes, your computer is a busy place. There are dozens of invisible processes always running, doing things that you’re not aware of. Like downloading updates, writing log files, modifying virtual memory swap files, and so on. This is normal. However, when you have accidentally deleted data, this is a bad thing. You never know when one of those processes might write a file on top of the data you so desperately want to retrieve! So, the longer your computer runs after you discover the problem, the worse your chances are for recovering the data. Thus, the admonition to shut down the computer.
Once you are safe from unintentional overwriting, you need to get some recovery software. Three options on the Mac are Data Rescue, File Salvage and Stellar Phoenix. All three can be ordered on physical media, in which case you’ll get a bootable emergency disk, or as download copies. Either way, you will need some other kind of media – a flash drive or hard drive, for example – on which to store the recovered files. NEVER put recovered files on the drive they’re being recovered from, even if the software lets you do that!
If the file you deleted was stored on a drive other than the system drive, then you don’t need the emergency disk. Just download the recovery software and start the recovery process, since you don’t have to worry about the files being overwritten by system processes. On the other hand, if you deleted the file from your system drive and if your need for the deleted file is so urgent that you cannot wait for the bootable emergency disk, you can create a second bootable hard drive, start up from that drive and download the software. The first part of this is to get an external hard drive and connect it to your computer. That’s the easy part.
Next, you need to boot into a Mac OS X installer. What system depends on what version of Mac OS X you have installed. If you have Lion (Mac OS X 10.7), you should turn on your computer and immediately hold down the option (alt) key. Hold it down until you are presented with a screen where you can choose a system to start up from. One of those options should be Recovery HD. Select that. If you have any older version of Mac OS X, or if you upgraded to Lion but see no Recovery HD option, you will need to find the gray Mac OS X install disk that came with your computer. Insert that and start up with the C key held down. (You can let go when you see the Apple logo.) Either way, at that point you will use the installer to install a fresh system on the external hard drive. (Be very cautious not to select the drive from which you have lost data.)
Another alternative would be to copy your existing system onto the new hard drive. That can be done in Disk Utility, accessed either from Lion’s recovery mode or, in an older system’s installer, from the Utilities menu. Select your system drive and click the Restore tab in Disk Utility, then drag the brand new drive onto the Destination field, and hit the Restore button. The new drive will be erased and filled with a copy of everything on your internal drive. The catch here is being able to identify the newer drive later, since it will have the same name as the old one. This can be tricky for the inexperienced, and you don’t want to mistakenly start up from the drive you’re trying to recover the file from!
Once all this is done, restart the computer and hold down the option key. Select the new drive to start up from it, and once the computer is running, get online and download your recovery software. Use it to attempt to recover the file(s) you deleted.
Once you have recovered what can be recovered, you should vow to never allow yourself to get into this mess again. Be sure to back up regularly. If you purchased an external hard drive as part of the recovery process, let that be the beginning of your backup. See my Mac Backup Guide for more assistance.
Tags: data recovery, Mac OS X