Mac Data Recovery: How to recover deleted files in Mac OS X
Note: In macOS version 10.4 “Mojave” and above it is necessary to temporarily disable SIP (System Integrity Protection). This will allow the application to read the raw device node, something that is required for any data recovery software to run.
Everybody loses files that they want to recover at some point, and because of that mac file recovery software is now highly sophisticated. It is now so advanced that things we would have considered impossible a few years ago look easy. You can just select a disk and click Scan and suddenly start to see thousands of deleted files that you can recover appear before your eyes. Mac Data Recovery Guru is the only software that will generate thumbnails of the recoverable deleted files that you can view, so you can instantly what can be recovered, for free. After ensuring that you can recover the desired files by seeing them you can then choose to purchase the software.
Mac Data Recovery until recently
Deleted file recovery used to be done by reading the filesystem of the disk. If it were a Mac OS disk for example, then the HFS+ filesystem would be interpreted by the software, and an analysis would be made to try to determine what data was previously present before the deletion was performed. In this way, each different filesystem would be developed for and interpreted in its own individual way, and each filesystem would have its own success rates and caveats. The success or failure of the file recovery attempt was also generally based on the state of the filesystem at the time. If the filesystem had been heavily modified after the file deletion had taken place, then there would be less chances of being able to undo that deletion. Likewise if the filesystem was heavily corrupted or if it had been formatted, that would often mean that no file recovery would be possible. If the disk had been formatted, then nothing would be recoverable.
It did have some advantages; the folder layout and filenames would sometimes be preserved. Sometimes it would result that getting files back was a quick and painless process. So while it was not so reliable, when it did work it could be very convenient.
This method is generally not possible these days, because filesystems have become more complex, and also because when it comes to deleted file recovery people demand functionality above all else.
How to recover deleted files on your Mac in modern times
Now data recovery has become about pattern recognition of individual file types. This has the advantage of making the recovery more robust and consistent because it is no longer dependent on the filesystem, so it makes no difference if a disk has been formatted or not. Now the only requirement for a deleted file to be recoverable is for it to be present, irrespective of the filesystem. It also makes it filesystem independent. It works on hard disks, USB flash sticks, USB hard disks, Intel Optane storage, & SSD’s, SD Cards, Apple’s APFS disk format, digital cameras, Android phones & tablets, or anything else that can be plugged into a Mac. OS X does not even necessarily have to be able to mount the device, and that way it can work on devices which do not show up in the Finder. For data recovery of digital cameras it is sometimes preferable to put the camera’s SD card into an SD card reader rather than plugging the camera in with a USB cable, but it depends on the camera.
In general It will work on anything that appears in Disk Utility. (Technically speaking: The only requirement is that OS X provides a POSIX node, for example /dev/rdisk3). And since it is fault-tolerant (which gives it the capability of scanning around bad sectors), it can even be used to recover data from faulty media, which is sometimes useful even if the files have not been deleted, because it will successfully read and extract the files irrespectively.
The fault tolerance has been so heavily engineered and tested, that some customers have reported scanning drives with the “click of death” (where you can hear the drive making a clicking sound as it is mechanically failing), and it has taken up to several weeks to finish scanning and recovering the drive, but that it succeeded in recovering the majority of the files.
A few years ago Mac Data Recovery Guru added the feature of being able to scan used space (ie, files) as well as deleted space. So now if you have a disk image that will not mount, or some other file or folder with data inside it that you would like to extract the contents of, it is possible. This also opens up some forensics capabilities of the software as it extracts and decodes everything. If you run it over your browser history, for example, it’ll extract all the text and images from it as well as other file types. This is also useful for digital forensics.
The way deleted file recovery software works these days is by reading every byte on the volume, and as it reads through it searches every byte on the disk for common patterns in each individual file type that it supports (or for patterns in general, for example it can recover all ASCII text found anywhere on a drive). If it encounters the start of a recognizable file it will record the location of that, and then search for whatever middle parts of the file that it can, and search for the end of it to finish it. Once it has a good idea of what the entirety of the file is, it will provide a real thumbnail preview of that file, and display it as an option to be recovered.
This happens in parallel, with interpretations of the same data segments on the disk being interpreted and displayed as different files, and this can occur thousands of times per second. Multiple file outputs for the same data segment on the disk is necessary to have to get good results, because often files will be embedded inside each other, with each interpretation of the data as a file being equally valid, but distinct. (For example, jpegs embedded inside a PDF will be offered as individual jpegs, but that will not interfere with the PDF also being displayed and recoverable as a file itself, with the embedded jpegs included.)
While the premise of this form of file recovery is simple and making a prototype is easy, outputting good results from such a chaotic environment is when it becomes a science and an art form and require years of refinement and development. No less than 6 years of full-time research and development has been put into Mac Data Recovery Guru. And that’s not moving slowly.
In this paradigm of data recovery each file is its own universe. Some files such as jpegs have a beginning, a middle and an end. This is quite a simple file type in that sense. Others are very different. An MP3 for example, is a nebulous entity. While scanning through the bytes on a disk, MP3 frames can be found wholly or partly anywhere on a disk, and if you’re the file recovery program it can be hard to know whether you are within an MP3 or not. But it’s the file recovery software’s job to find the fragments, determine if they are clumped together as a single sound file or multiple, and even parse out the ID3 information in order to correctly preserve it so that the album artwork and song name are correctly displayed after the files are recovered. If you try the software you will see that somehow it does this, and remarkably, does so perfectly.
The most challenging aspect of this approach is that the names that the files were arbitrarily named on the filesystem are often lost, because that is stored in the filesystem itself. We do our best to overcome this limitation by displaying live thumbnail previews of all the deleted files (not an easy feat!), and allowing quick recovery of entire file types in order to later search through them with the OS X Finder and Spotlight.
Recover deleted files on your Mac: First thing to do
Assess how much risk you are at. If you have just deleted a single small document, chances are very good that you’ll get it back even if you’re very casual about everything. Performing steps one and two listed below are optional in this case, and probably wont really make a difference. If you lose many files, or one very big file, this is when it is more appropriate to start acting like you’re in a forensics situation, and following steps one and two below would be highly recommended.
Mac File Recovery – Step one (Optional):
Stop using the disk of that Mac as soon as possible. If it is the start up disk, then stop using that Mac at all. If your computer is downloading or copying anything onto the disk, stop that process. Close your email clients and any programs that may write to the disk, but do not take any unnecessary actions either. Do the minimum to the computer to put it into a position where it will write as little to the disk as possible in the near future. It is not necessary to shut it down.
Mac File Recovery – Step Two (Optional):
Download Mac Data Recovery software. Again, it is preferable to download it to a disk that is not that which you will be recovering data from, because downloading the data recovery program itself is writing to the disk. If the data recovery program is small in size (say less than 5MB), this is not such an issue, because writing say 5MB to a disk with thousands of MB of space on it stands a very low risk of writing over the exact piece of data that you want to recover. Mac Data Recovery Guru is very small in size, so there is little concern if you are downloading this program.
Mac File Recovery – Step Three:
Run the data recovery program. Preferably have a second disk, USB drive or key, or SD card ready to recover the files you want back to (if you are recovering a single small file, chances are this won’t strictly be necessary). You will get a warning from the software if you are recovering the file to the same disk you are recovering it from.
Note: In general data recovery is not possible on SSD drives which support TRIM. This includes most of the Apple MacBook Pro’s sold since around 2012. No data recovery or forensics software in the world can help with the recovery of this data, including Mac Data Recovery Guru.
(Side note: As strict as the suggested steps shown above may be, we recommend them because technically this is the optimal way of ensuring that you have the very best possibility of recovering the data that you want back. Interestingly however, if you download the data recovery software and have a look at the deleted files it shows you, you will most likely see that it lists hundreds of thousands of deleted files, even from years ago. People are generally amazed as they browse through the deleted files it shows them, seeing files which they would never have thought would still be present on their system. Go ahead and take a look even if just for curiosity’s sake, or to get an appreciation of the power of digital forensics technology. It’s easy and free, and may really surprise you.)
If you are using Mac Data Recovery Guru, It is often better to allow the scan to completely finish, select the folders of the file types you want back (hold down the command key to select multiple folders), then hit Recover to recover entire folders of file types you want back, and then search through for specific files using Spotlight or the Finder. This can be quicker and easier than searching through the files using the data recovery software itself. The demo is useful to ensure that the files that you want back are recoverable and visible within the program beforehand.
If what you are searching for is text It is worth taking a look inside the folder called “Raw Text (plain)”. This contains all of the text from the entire system – it even does fancy things like UUDecoding emails, and unzipping zip files on the fly as it scans – to ensure that it gets every byte of text that exists. If you need something from this folder, just recover the entire folder, and then use Spotlight in the Finder to search for keywords.
If there are a lot of files found, but you don’t find the one you are looking for Then one thing you might try is recovering similar files – for example you may be looking for a .doc file but it’s not there but some .docx files are found, then you can manually change the extension from .docx back to .doc and see if that contains your desired file. The reason for this is that in some (relatively rare) circumstances a file may be recovered, but its type may be incorrectly classified.
When you are finished with Mac Data Recovery Guru and have your files back You can easily uninstall it by dragging it to the trash. The application is entirely self-contained and this will remove everything. In practice many people like to keep it around though. It’s not just useful for data recovery, you can use it to view and extract all the data on any device, and in any file.
Now, the first step is to download Mac Data Recovery Guru to see what it can see on your disk.