There is an old Unix trick for attempting to recover a deleted file where you run

$ sudo grep -C100 string-known-to-be-in-file /dev/sda1

which takes a very long time, but can at least recover a portion of what you lost. But this doesn't seem to work on my Mac, which simply says

grep: /dev/disk1s1: Operation not permitted

Is there a way to get the grep command to work for me?

Note: I lost an important file via unlink (aka rm) but I am hoping the blocks are still on my disk and I can recover some of them. The lost file is raw text (not a Word doc or any other binary format) so it should be grepable. My Mac has an SSD, so I'm hoping wear-leveling gives me a shot at getting some/all of my file back. The full story of how the file was lost is here.

  • Just a guess here but it may be that directory is protected by SIP (System Integrity Protection). Boot into recovery mode, run terminal and run csrutil disable and reboot. That command may now work. – Steve Chambers Sep 20 '18 at 14:10

You must log in to answer this question.

Browse other questions tagged .