1

I was playing around with OSX find and GNU find from findutils (v 4.4.2) package for learning purposes. GNU find has a -delete option, which is self-explanatory. What isn't, however, is that "Use of -delete automatically turns on the -depth option", which means it will recursively remove the current working directory content without a warning.

The problem is I accidentally executed such a command on my system, instead of remote shell session.

I tried to research the internals behind -delete but all I could come up with was official GNU findutils docs.

As I realised what happened, I turned off the system to prevent possible overwriting of sectors. Then, I took a "standard recovery approach" using

  • EaseUS Data Recovery Wizard for Mac
  • Prosoft Data Rescue 3
  • Disk Drill
  • Mac Data Recovery Guru

but to no results. The removed directory was actually a git repository with many small files. As close-to-zero disk operation was made since the deletion, I doubt all of them could get overwritten. It's not a disastrous situation because I'm obviously pull the repository content from remote. Still, I loose unpublished local branches and files under .gitignore.

Are there any OSX mechanisms I could use to get these files back?

Improve this question
2
  • Did a Time Machine backup run at some point before and close to the deletion? It might contain the files you're after.
    – Saaru Lindestøkke
    Commented Oct 13, 2015 at 19:05
  • No, Time Machine is disabled.
    – cellardoor_ncx
    Commented Oct 13, 2015 at 20:21

1 Answer 1

Reset to default
1

OS X maintains deleted files in the local time machine storage area if you have enabled (or the system has enabled) a local store.

tmutil snapshot

If you can make a snapshot, you can enter Time Machine and recover these files. If you get an error like **Local snapshots are not enabled. ** then you don't have the ability to recover the files from the OS level. Since there is no other undelete mechanism in the filesystem, you have a good survey of recovery tools (I use Data Rescue pretty much exclusively) and your only third option would be to locate a viable backup of the system or the files in question.

I make a habit of enabling the local store and forcing a snapshot before doing anything as root or anything I might regret from the terminal. Having made mistakes like this over the years, I've learned to have that "premonition" to check backup and double check the syntax. In general, I try to make a list of files to delete and save it to a file so I have a pause and a second script that does the removal rather than piping them together. It's not going to help, but it's my experience and way to mitigate when I can't ensure a good backup.

sudo tmutil enablelocal
sleep 8 && tmutil snapshot
Improve this answer
3
  • Thank you for the tips. Of course, I do backup critical parts of the system. However, with git repos being distributed by nature - it's excluded. Time Machine was never enabled on the system though.
    – cellardoor_ncx
    Commented Oct 13, 2015 at 20:21
  • @cellardoor_ncx I always feel bad when writing - use your backup, when it's clear from the level of technical detail in the question that this isn't an option. Since the mobile backups can get enabled automatically, it's a wonderful discovery when it saves your bacon and you didn't count on it.
    – bmike ♦
    Commented Oct 13, 2015 at 20:25
  • @cellardoor_ncx And now you know why that was a very bad idea. Not to mention... what do you know about the backup policy of the remote for the future?
    – Marc Wilson
    Commented Oct 9, 2021 at 21:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .