There is an old Unix trick for attempting to recover a deleted file where you run
$ sudo grep -C100 string-known-to-be-in-file /dev/sda1
which takes a very long time, but can at least recover a portion of what you lost. But this doesn't seem to work on my Mac, which simply says
grep: /dev/disk1s1: Operation not permitted
Is there a way to get the grep command to work for me?
Note: I lost an important file via
rm) but I am hoping the blocks are still on my disk and I can recover some of them. The lost file is raw text (not a Word doc or any other binary format) so it should be
grepable. My Mac has an SSD, so I'm hoping wear-leveling gives me a shot at getting some/all of my file back. The full story of how the file was lost is here.