Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I've deleted a system file from my Mac and need to get it back.

System files can include:

  • hidden files in the root of / - especially unix files in /private
  • /System files
  • /Library files
  • /Applications files that ship with the core OS

System files are not any app, user files or files that can be regenerated by a known sequence such as cache files, Spotlight index files, etc…


Canonical question and answer for this comment by bmike♦.

share|improve this question

7 Answers 7

up vote 5 down vote accepted
+50

If you don't mind or are sure your Recovery HD is patched to match the OS on your main system, you can snag a file and see if it works without needing to do a full reinstall of the OS and without needing a restart or an internet connection / saved installer.

Use the Recovery partition

Many1 system files are also included on the Recovery partition and can be copied over.

  1. Mount the Recovery HD

    diskutil mount Recovery\ HD
    
  2. Mount the BaseSystem.dmg

    hdiutil mount /Volumes/Recovery\ HD/com.apple.recovery.boot/BaseSystem.dmg
    
  3. Copy the file

    FILE="/usr/bin/codesign"
    sudo cp -p /Volumes/OS\ X\ Base\ System/${FILE} ${FILE}
    

This process can be combined into a single-line command if you have to run it frequently…

FILE="/usr/bin/codesign"; diskutil mount Recovery\ HD && hdiutil mount /Volumes/Recovery\ HD/com.apple.recovery.boot/BaseSystem.dmg && sudo cp -p /Volumes/OS\ X\ Base\ System/${FILE} ${FILE}

Even if you have deleted the cp binary (which could happen), there is /usr/bin/ditto, /usr/bin/tar and several other commands that can stand in for cp.

Reinstall OS X

If you've got the ability to reinstall OS X through the Recovery HD, Internet Recovery or an OS X install media then reinstalling OS X will 'repair' your install and copy any missing/broken system files back to your system.


I recommend that you do a permissions repair using Disk Utility after copying a file manually and then rebooting. If the fix works, now would be an excellent time for another backup snapshot.

1 Not all system files are on the Recovery HD, but many are. If the copying command doesn't work, check that the file exists on the Recovery HD.

share|improve this answer
2  
When copying from Recovery OS: caution! It's commonplace for the version of Recovery OS to not match the version of OS X. For example: an installation of OS X 10.9 that is updated to 10.9.2 will be limited to Recovery OS 10.9 (with the SSL vulnerability, and so on). –  Graham Perrin Mar 11 at 5:27
2  
@GrahamPerrin Has some wise words - I edited a warning in, and most people that are comfortable with terminal can evaluate the risks of copying down-level files from a recovery HD that may not be patched totally. It's still worth keeping in mind that saving time of a reinstall might have repercussions if you use this trick often or for a critical part of the system - reliability or security wise. –  bmike Mar 11 at 20:40

Apple's Official answer would be to reinstall your system since accession system files from Time Machine can be risky and tricky.

  1. The system might be missing a file needed to assist in the recovery process and undefined / unpredictable results need more of an expert at the helm than using Time Machine to restore a photo or an app.
  2. System files can be hidden and you'll need to know how to navigate to those folders by command shortcut as you restore the files from your Time Machine backup.
  3. System files can have special permissions so you may need to fix them after restoring.
  4. You may need to reboot after restoring and if you restore improperly, the system may fail to boot again.
  5. Restoring from an old backup could undo patches or security updates and make your system harder to update. Having a recent backup can eliminate this potential problem.

Now ha the risks are on the table, here is how to proceed. If you use Time Machine, connect to your backup disk, then open Finder window open to where the missing file was last seen. You may need to use Command-Shift-G to go to system folders - if so, just be prepared to use that shortcut once you enter Time Machine as it has a habit to show a user folder when it starts.

Use the Time Machine menu in the menu bar select Enter Time Machine. Navigate back to a date the file existed, select the file, then click Restore (lower right button).

It will copy the file or folder back into your running system. At this point, make a backup and consider rebooting to allow the system to notice that the missing files are now restored.

share|improve this answer

If you have a recent Mac then it has a recovery partition.

Power on your Mac and hold down Command+R until the Apple logo appears. This will cause your Mac to boot using the recovery partition.

Once you are in the recovery partition, you can then reinstall the operating system.

This Apple technical note, OS X: About OS X Recovery, gives more details.

You can reinstall the OS and leave your files intact. Apple removed the erase/install option so you don't have to worry about the Recovery Installer erasing your files. You now have to explicitly launch the Disk Utility tool to erase or reformat/repartition a drive when booted from recovery OS.

share|improve this answer

There is a a solution that requires an Internet connection.

OS X Recovery

Mac models introduced after Mac OS X 10.7, Lion, include the ability to start up directly from an Internet-based version of the OS X Recovery system.

OS X automatically uses this feature when the Recovery System on the hard disk isn't available (such as when your hard disk encounters an issue, or when your hard disk has been replaced or erased). OS X Internet Recovery lets you start your Mac directly from Apple's servers. Starting up from this system performs a quick test of your memory and hard drive to check for hardware issues.

So I suggest you plug in your ethernet cable, since the wifi is probably not going to work, and choose the option to boot from the internet if the list of options come up and you've got the right version.

Restoring iLife applications after Internet Restore of OS X

If your computer came with OS X Lion or later and you erase your hard disk and install OS X, you can download iPhoto, iMovie, and GarageBand from the Mac App Store.

  • After installation, start (up) from OS X.
  • Double-click the App Store icon in the dock.
  • Enter your Apple ID and password.
  • Click Purchases. If you haven't previously accepted your bundled iLife applications within the Mac App Store, you should see your iLife applications appear in the Accept portion of the screen.
  • Click Accept. You may be asked for your Apple ID and password once again. Your iLife applications now move to the Purchased section. These applications are part of the software that came with your computer. Your account will not be charged for them.

  • Click Install to complete installation of your applications.

share|improve this answer
    
Let's find a canonical question to host the iLife reinstall portion of this. It doesn't really fit the use case of deleting a single system file or the /bin directory... –  bmike Feb 3 at 18:55

If you are sure your Recovery HD is patched to match the OS on your main system, you can snag a file and see if it works without needing to do a full reinstall of the OS.

Hold -R during startup until you see a window similar to this:

enter image description here

These are your options:

  1. Choose Utilities>Terminal:

    enter image description here

    Your OS X disk will be mounted in /Volumes/<your disk name>. For example, on my Mac it was mounted in /Volumes/Mavericks:

    df
    Filesystem     1K-blocks      Used Available Use% Mounted on
    /dev/disk0s2   249219484 145891460 103072024  59% /Volumes/Mavericks
    

    Now copy /bin to your OS X disk:

    cp -a /bin /Volumes/<your disk name>
    

    Note that the contents of /bin will be outdated, as the recovery disk is not updated with the rest of the OS, so restore /bin from Time Machine after successfully starting your Mac and logging in.

share|improve this answer
1  
all answers should be as detailed like this one :) +1 –  Buscar웃 Feb 3 at 9:02
    
Disk Utility Repair Disk feature will scan and fix potential problems with the file system. It has no effect whatsoever on restoring lost data of any kind. Your answer is terrific, but unfortunately wrong. The asker will have to restore OS X (they can use Internet Recovery as you outlined in the beginning of your answer). –  cksum Feb 3 at 9:49
    
@cksum Thanks for pointing that out, I thought it would be worth a try so I listed it as the last of three options. As for your assertion that the OP needs to restore OS X, I don't think that'll be necessary. The first option I provide should do it, I tested it. –  jaume Feb 3 at 10:04
2  
Copying the contents of /bin is not ideal as it may not carry over the ACLs and proper permissions (Repairing permissions with Disk Utility may fix some of these). It may also not hold the proper versions (as some may have been updated). Can you assure these are controlled for? Also, it may seem like a sledgehammer for a fly approach, but simply reinstalling OS X is likely the most ideal solution. The least likely to lead to any more problems. –  cksum Feb 3 at 10:09
    
@cksum Disk Utility will fix permissions but I agree with your other point, I mounted the Recovery HD, checked the versions included in com.apple.recovery.boot/BaseSystem.dmg and yes, some binaries are outdated, bash among them. I edited my answer to reflect that, and removed the third option after testing that Disk Utility doesn't indeed restore files, as you said in your previous comment. –  jaume Feb 3 at 10:44

Copy the file from another system or a trusted1 person's machine

If you have a second machine with a comparable build of OS X installed on it, you can copy the file from it. Make sure that you haven't made changes to the file that you're copying if you want a fresh copy. This is especially important for copying files from someone else's machine as the changes may not be desirable.

Feel free to ask for the checksum of a file in chat (don't forget to give an OS X version) to compare it to if you wish to make sure that the file has not been modified accidentally (or purposefully).

Don't forget to do a permissions repair after copying the file over to make sure that the permissions have been set correctly on the file.

1 It's probably not best to trust random strangers on the internet for crucial system files.

share|improve this answer

Pacifist with OS X install media

If you've got an OS X install media and Pacifist, you can browse the install media and grab the file.

If you have Pacifist but no install media, it will prompt you to download the installer.

share|improve this answer
1  
If you have install media, wouldn't it be easer to just run the installer and let it fix everything? I suppose it depends on how isolated the system damage was and how confident you we that only the files you think are missing are incorrect. –  bmike Mar 13 at 14:49
    
@bmike Maybe, but for users that have deeply customised their system, it's a pain to redo everything that it overwrites (understandably, it doesn't understand the difference between a broken file and a file that has been modified on purpose). This method means that specific files/folders can be targeted to be restored rather than all system files. –  grgarside Mar 13 at 14:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.