How can I get back a system file after deleting it from my Mac?

Question

I've deleted a system file from my Mac and need to get it back.

System files can include:

• hidden files in the root of / - especially unix files in /private
• /System files
• /Library files
• /Applications files that ship with the core OS

System files are not any app, user files or files that can be regenerated by a known sequence such as cache files, Spotlight index files, etc…

---

^{Canonical question and answer for this comment by bmike♦.}

Answer 1

If you have a recent Mac then it has a recovery partition.

Power on your Mac and hold down Command+R until the Apple logo appears. This will cause your Mac to boot using the recovery partition.

Once you are in the recovery partition, you can then reinstall the operating system.

This Apple technical note, OS X: About OS X Recovery, gives more details.

You can reinstall the OS and leave your files intact. Apple removed the erase/install option so you don't have to worry about the Recovery Installer erasing your files. You now have to explicitly launch the Disk Utility tool to erase or reformat/repartition a drive when booted from recovery OS.

Answer 2

If you don't mind or are sure your Recovery HD is patched to match the OS on your main system, you can snag a file and see if it works without needing to do a full reinstall of the OS and without needing a restart or an internet connection / saved installer.

Use the Recovery partition

Many¹ system files are also included on the Recovery partition and can be copied over.

1. Mount the Recovery HD

   diskutil mount Recovery\ HD
   

2. Mount the BaseSystem.dmg

   hdiutil mount /Volumes/Recovery\ HD/com.apple.recovery.boot/BaseSystem.dmg
   

3. Copy the file

   FILE="/usr/bin/codesign"
   sudo cp -p /Volumes/OS\ X\ Base\ System/${FILE} ${FILE}
   

This process can be combined into a single-line command if you have to run it frequently…

FILE="/usr/bin/codesign"; diskutil mount Recovery\ HD && hdiutil mount /Volumes/Recovery\ HD/com.apple.recovery.boot/BaseSystem.dmg && sudo cp -p /Volumes/OS\ X\ Base\ System/${FILE} ${FILE}

Even if you have deleted the cp binary (which could happen), there is /usr/bin/ditto, /usr/bin/tar and several other commands that can stand in for cp.

Reinstall OS X

If you've got the ability to reinstall OS X through the Recovery HD, Internet Recovery or an OS X install media then reinstalling OS X will 'repair' your install and copy any missing/broken system files back to your system.

---

I recommend that you do a permissions repair using Disk Utility after copying a file manually and then rebooting. If the fix works, now would be an excellent time for another backup snapshot.

^{1 Not all system files are on the Recovery HD, but many are. If the copying command doesn't work, check that the file exists on the Recovery HD.}

Answer 3

If you are sure your Recovery HD is patched to match the OS on your main system, you can snag a file and see if it works without needing to do a full reinstall of the OS.

Hold ⌘-R during startup until you see a window similar to this:

These are your options:

1. Choose Utilities>Terminal:

   

   Your OS X disk will be mounted in /Volumes/<your disk name>. For example, on my Mac it was mounted in /Volumes/Mavericks:

   df
   Filesystem     1K-blocks      Used Available Use% Mounted on
   /dev/disk0s2   249219484 145891460 103072024  59% /Volumes/Mavericks
   

   Now copy /bin to your OS X disk:

   cp -a /bin /Volumes/<your disk name>
   

   Note that the contents of /bin will be outdated, as the recovery disk is not updated with the rest of the OS, so restore /bin from Time Machine after successfully starting your Mac and logging in.

Answer 4

There is a a solution that requires an Internet connection.

OS X Recovery

Mac models introduced after Mac OS X 10.7, Lion, include the ability to start up directly from an Internet-based version of the OS X Recovery system.

OS X automatically uses this feature when the Recovery System on the hard disk isn't available (such as when your hard disk encounters an issue, or when your hard disk has been replaced or erased). OS X Internet Recovery lets you start your Mac directly from Apple's servers. Starting up from this system performs a quick test of your memory and hard drive to check for hardware issues.

So I suggest you plug in your ethernet cable, since the wifi is probably not going to work, and choose the option to boot from the internet if the list of options come up and you've got the right version.

Restoring iLife applications after Internet Restore of OS X

If your computer came with OS X Lion or later and you erase your hard disk and install OS X, you can download iPhoto, iMovie, and GarageBand from the Mac App Store.

• After installation, start (up) from OS X.
• Double-click the App Store icon in the dock.
• Enter your Apple ID and password.
• Click Purchases. If you haven't previously accepted your bundled iLife applications within the Mac App Store, you should see your iLife applications appear in the Accept portion of the screen.

• Click Accept. You may be asked for your Apple ID and password once again. Your iLife applications now move to the Purchased section. These applications are part of the software that came with your computer. Your account will not be charged for them.

• Click Install to complete installation of your applications.

Answer 5

Apple's Official answer would be to reinstall your system since accession system files from Time Machine can be risky and tricky.

1. The system might be missing a file needed to assist in the recovery process and undefined / unpredictable results need more of an expert at the helm than using Time Machine to restore a photo or an app.
2. System files can be hidden and you'll need to know how to navigate to those folders by command shortcut as you restore the files from your Time Machine backup.
3. System files can have special permissions so you may need to fix them after restoring.
4. You may need to reboot after restoring and if you restore improperly, the system may fail to boot again.
5. Restoring from an old backup could undo patches or security updates and make your system harder to update. Having a recent backup can eliminate this potential problem.

---

Now ha the risks are on the table, here is how to proceed. If you use Time Machine, connect to your backup disk, then open Finder window open to where the missing file was last seen. You may need to use Command-Shift-G to go to system folders - if so, just be prepared to use that shortcut once you enter Time Machine as it has a habit to show a user folder when it starts.

Use the Time Machine menu in the menu bar select Enter Time Machine. Navigate back to a date the file existed, select the file, then click Restore (lower right button).

It will copy the file or folder back into your running system. At this point, make a backup and consider rebooting to allow the system to notice that the missing files are now restored.

Answer 6

Copy the file from another system or a trusted¹ person's machine

If you have a second machine with a comparable build of OS X installed on it, you can copy the file from it. Make sure that you haven't made changes to the file that you're copying if you want a fresh copy. This is especially important for copying files from someone else's machine as the changes may not be desirable.

Feel free to ask for the checksum of a file in chat (don't forget to give an OS X version) to compare it to if you wish to make sure that the file has not been modified accidentally (or purposefully).

Don't forget to do a permissions repair after copying the file over to make sure that the permissions have been set correctly on the file.

^{1 It's probably not best to trust random strangers on the internet for crucial system files.}

Answer 7

Pacifist with OS X install media

If you've got an OS X install media and Pacifist, you can browse the install media and grab the file.

If you have Pacifist but no install media, it will prompt you to download the installer.