Visit Jeremy's Blog.
Go Back > Forums > Other *NIX Forums > Other *NIX
User Name
Other *NIX This forum is for the discussion of any UNIX platform that does not have its own forum. Examples would include HP-UX, IRIX, Darwin, Tru64 and OS X.


  Search this Thread
Old 01-04-2007, 01:52 PM   #1
Registered: Apr 2006
Posts: 59

Rep: Reputation: 15
urgent! how to recover files from os x?


i opened a term on my fiancees box at 4.30am and typed

rm /tmp *

instead of

rm /tmp/*

and i was in her home directory. this incurred a loss of ~270mb of personal data--pics and documents, for an artist and a student this is not good

i have a linux box and a win box on the network, and was wondering if any linux/*nix tools could recover the data for me.

its an ibook, ppc g4, one hard drive, cdburner.
the hard disk was full (~2mb free) before the delete.
also the notebook is "sleeping", i didn't know if turning it off would mean a dangerous remount on poweron like ext2/3.

i don't have more notebook drives, portable hard drives, ipods, etc.

i am asking the linux community because some smart people hang out here :-)

what can i do??


ps my unix knowledge is rather scant, will "rm /tmp" see that as an attempt to remove the directory /tmp or is the command i entered the equivalent of "rm /tmp/* *" ?? i am trying to figure out if the whole 270mb i deleted actually came from the home folder..
Old 01-04-2007, 02:04 PM   #2
LQ Guru
Registered: Aug 2003
Distribution: CentOS, OS X
Posts: 5,131

Rep: Reputation: Disabled
rm /tmp
will remove the file tmp under root, which is actually a special file most know as a directory. In english, it means removing the /tmp directory. However it will probably fail, since rm won't by default remove directories; instead, rm -f or equivalent should be used, and if the directory is empty, probably a recursive rm -rf.
rm /tmp/*
will remove everything inside /tmp rather than the directory itself (but not subdirectories; for them use -R option).

Powering off is not a good idea I guess. You might try to run some file recovery software over the network if you can, if you cannot install it on the Mac; most "big" programs are expensive, but there are some free ones (oddly many of them can show you if there is some data that can be recovered, but don't actually do the job unless you buy the whole product, which is kinda bitchy if you ask me) and one of them could actually save the data. It might depend on the filesystem too.

Some of the gurus around here might have handy tricks in their back pocket, hopefully, because using the recovery software doesn't usually help (my own experience). I recall some "undelete" methods from the past, but I've never actually done anything more than read about them.

Last edited by b0uncer; 01-04-2007 at 02:05 PM.
Old 01-04-2007, 02:30 PM   #3
Registered: Apr 2006
Posts: 59

Original Poster
Rep: Reputation: 15
so it is correct to understand if i entered, "rm /tmp *" then the 270mb deleted were all from ~/ ?

btw whats this about? the man page for rm said "see undelete(2)" but "man undelete", "man 2 undelete", "apropos undelete" all give nothing.

i saw it and jumped, but even tho its mac perhaps expecting a "undelete ~/*" to do something was expecting too much :-)

i need advice on recovery sw tho, i would be comfortable using a boot cd if i could determine the drive would remain unmounted on reboot, i don't think installing a utility is an option, as the only remaining space on the disk is from the deleted files. i don't even want to use safari, the cache is on..

.. i am hoping swap is a separate partition and not file that may fragment..

this might sound ridiculous but is there any way to image just the unused portions of the disk using dd and then go through it manually with a hex editor to look for word docs, jpgs, etc? i think everything important is .doc and .jpg

Last edited by stairwayoflight; 01-04-2007 at 02:31 PM.
Old 01-04-2007, 03:36 PM   #4
Registered: Apr 2006
Posts: 59

Original Poster
Rep: Reputation: 15
thanks for your help.. i see it right now i need to make a copy of the image.

..2nd i would like to make a 2nd image file with all the allocated data from the filesystem removed, so i am only searching unallocated space for the deleted files, not the whole 40gb!!

so to do a dd to get the image of the drive i need to mount the kernel device namespace like so:

# mount -t devfs devfs /tmp/dev

then i could do

# dd if=/dev/hda of=output harddrive (usb whatever)

then i can use md5 to verify the images are the same right? (i have only used md5 on files, not drives/images) i can figure that out, i hope device names are the same as linux.. :-)

o God i hope this works
Old 01-04-2007, 04:48 PM   #5
Senior Member
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
A quick check of reveals Boomerang as a likely candidate. The downside is that it costs $180, but it could very well be worth it and it's a lot cheaper than taking it to a data recovery shop.
Old 01-06-2007, 03:43 PM   #6
Registered: Apr 2006
Posts: 59

Original Poster
Rep: Reputation: 15
backing up filesystem


i managed to backup the filesystem using netcat and dd as per:

(of course the disk was bsd naming, /dev/disk0 not /dev/sda etc.)

now i have a cloned copy of the hard drive on a 40g living on my linux box. no i did not do it from a rescue disc, the system may be in an inconsistent state, but i didn't want to give the filesystem a chance to do "housekeeping" on itself and potentially screw up some of the lost data.

any os x hackers out there know have a script or something to look for lost files? something to put together potentially fragmented files from the disc, and mask out files in the FAT (or whatever its called in hfs+) ?

if i build a kernel with HFS+ support, are there any tools that work with linux to find files?

if this is beyond reason, (and i bet it is) i will settle for a somewhat cheap os x recovery software, but there are so many..

i am guessing since the system wasn't damaged, my best option is

1) drive enclosure for 40g copy
2) install recovery software on ibook
3) recover software over usb
4) burn recovered files to cd or use nfs/samba/.. ideally i would like to write as little data as possible to the os x drive, just the recovery tool install (or nothing if i can use a rescue cd and write recovered files to nfs or something)

to clarify, i believe all the files that were lost were popular multimedia formats (video, mp3/apple formats, plaintext, .doc, .jpeg) but the important files were probably all .doc and .jpeg.

if anybody out there can help me i'm pretty poor but i would be willing to help out with some document writing/editing (although i haven't used good english here). ie. tools/scripts/wizardry that will work from mac or knoppix (or windows i suppose)..

thank you all for all the help so far :-)
Old 01-07-2007, 02:23 PM   #7
Registered: Jan 2005
Location: Somewhere in the Central Timezone
Distribution: Suse 10.0
Posts: 128

Rep: Reputation: 15
I have never tried this, but found it thru a quick google search.

PS. I deleted my entire windows partition on accident last year, so good luck; it won't be easy but it is possible in most cases to recover (unfortunately, not in mine)
Old 01-07-2007, 08:53 PM   #8
Senior Member
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
BTW most recovery tools require that you have 2x the drive size in free space to recover it, so if you have a 40GB drive you'd need 80GB to attempt a recovery using tools like TCT.
Old 01-07-2007, 10:40 PM   #9
Senior Member
Registered: Jan 2004
Location: Roughly 29.467N / 81.206W
Distribution: OpenBSD, Debian, FreeBSD
Posts: 1,450

Rep: Reputation: 48
Note: Just so you know, undelete(2) is a system call... not a program. And, sadly, it wouldn't work for you:

     The undelete() function attempts to recover the deleted file named by
     path.  Currently, this works only when the named object is a whiteout in
     a union filesystem.  The system call removes the whiteout causing any
     objects in a lower layer of the union stack to become visible once more.

     Eventually, the undelete functionality may be expanded to other filesys-
     tems able to recover deleted files such as the log-structured filesystem.
Since this wasn't a union filesystem... it wouldn't help. Ugh, how to solve this... it's nasty. Basically, you need to keep at least one pristine image and always work on another... and then go through it bit-by-bit to rework everything. That's heavily file-system dependent and tedious. If you can find a ready-made tool which will attempt it... that's great.

One place I would start is finding the format of directory files in HFS+ (personally, I don't know what that is) and look through what is left in her ~ directory. It won't be everything (likely) because the directory was probably shortened when you deleted everything. But you should see some filenames left in there and may be able to decode some information important to recovering them.

The fact that this damage is limited to one directory (only her ~ and nothing above or below it) helps a lot actually. If she kept all her important documents in folders (which she should -- unless she creates things on the command line) then she may have lost very little of importance. Most stuff in OS X is created in directories under ~ ... e.g. ~/Desktop ~/Movies etc.

If you're sure you have a good image, you may want to boot the computer and actually see what she has lost. Anything in a folder other than ~ will still be there.

Edit: If the pictures were in iPhoto... they're most likely still there. The documents, I am not so sure about.

And I'm not going to to preach about the importance of backups... honestly, I won't.

Last edited by frob23; 01-07-2007 at 10:46 PM.
Old 01-09-2007, 12:39 AM   #10
Registered: Apr 2006
Posts: 59

Original Poster
Rep: Reputation: 15

hi, thanks for all the help so far..

i have done a 2nd dd backup to a new drive i bought from bestbuy for $95 can. not bad, 'cept i had to activate it in windows, don't know why.. but its fine now. 160g, external, usb.

someone loaned me discwarrior, an os x disc utility boot cd. no it didn't work. it just said 10.2 or later, so i guess its for ppc. it simply booted to a light blue screen of death with a flat dark blue rectangle of death towards the lower right. it was very pretty.

someone on the mac forum reccommended a utility for $50, perhaps i'll try that.

..frob23, how would you 'look' for the directory? i know the 'high-level' way (~/) but how do you find it on the disc? are there standard *nix utils to locate the disc position of a file? i read hfs+ is more tricky to locate files than ext2/3, being that the whole disk is a binary tree. searches are supposed to be fast but it can take 19 reads to find a file. other than that i don't know much.. equivalent of debugfs that i could find. seems ext3 is the place to be!

i'll try another utility or two and post back if i get any results.

Old 02-03-2007, 12:41 AM   #11
Registered: Jun 2006
Location: Boaz,Alabama
Distribution: Ubuntu 10.10 / Windows 7 Pro 64-Bit / Snow Leopard 10.6.4 64-Bit
Posts: 152

Rep: Reputation: 30
photorec should work, it ignores the entire fs to find files, and works with HFS+. also, it's free! Knoppix includes it, just boot from it, loop-back mount the image and run sudo photorec or sudo photorec_static (i forget which) and run through the steps. for more go to
Hope this helps!
Old 06-10-2007, 03:35 PM   #12
Registered: Apr 2006
Posts: 59

Original Poster
Rep: Reputation: 15

Unfortunately, I didn't manage to recover any of the deleted files. Ideally, if I had lots of money and time, I would find warez/torrents for recovery software, try out different programs, and keep and pay for the one that worked the best. I didn't have enough of either, and I'd prefer not to steal software.

But I did find out a few interesting things. One is that HFS+ has a nifty feature that has something like an "alias" for all recognized document types, that allows the files to be found from the user's home directory, no matter where they are on the disk.

Its so amazing, my error (~/ $ sudo rm /tmp *) actually found and deleted all the photos, documents, etc. on the disk. Basically all content that my fiancee created and downloaded. Nice.

[edited to correct above command--added user prompt and sudo.]

Last edited by stairwayoflight; 06-11-2007 at 07:46 PM.
Old 06-10-2007, 06:55 PM   #13
Registered: Feb 2004
Location: Outside Paris
Distribution: Solaris 11.4, Oracle Linux, Mint, Ubuntu/WSL
Posts: 9,781

Rep: Reputation: 481Reputation: 481Reputation: 481Reputation: 481Reputation: 481
Too late for you but HFS+ is rumored to be replaced by OpenSolaris ZFS in the next Mac OS/X release.

That filesystem has a really cool snapshot feature that would have allowed you to recover most if not all of these files should regular snapshots have been scheduled.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
HELP: How to recover rm -rf files? fhleung Linux - Newbie 3 05-10-2006 11:43 AM
How do I recover deleted files? Hector404 Linux - General 5 12-27-2005 01:35 AM
Recover Files Pablop Linux - Newbie 3 10-19-2005 05:45 PM
Recover deleted files? subaruwrx Linux - Newbie 8 06-04-2004 08:47 AM
Recover deleted files markdw Linux - General 1 12-07-2001 04:08 PM > Forums > Other *NIX Forums > Other *NIX

All times are GMT -5. The time now is 06:26 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration