6

Is there any way to restore files removed with rm -rf on an APFS formatted SSD?

4
  • 3
    It’s unlikely el to be successful, but you can try Disk Drill or Disk Warrior recovery tools
    – Allan
    Commented Apr 18, 2020 at 21:28
  • 7
    Restore from a Time Machine backup. (Assuming you have one.) Commented Apr 18, 2020 at 22:18
  • 2
    Do you have APFS snapshots or TimeMachine ever set up once? (Or are you asking us to answer that triage question as an answer?)
    – bmike
    Commented Apr 19, 2020 at 3:13
  • 1
    You can try running tmutil listlocalsnapshots / to see if you have any local APFS snapshots. Any consumption of disk space could cause the system to be starved for disk space, and start deleting old snapsshots, so stop what you're mmediately stop using your computer, and reboot into recovery mode to restore it.
    – Alexander
    Commented Apr 19, 2020 at 14:36

2 Answers 2

9

No. It's very unlikely you're going to recover anything.

The reason being is that when you delete something from an SSD, the way it's deleted makes it virtually impossible to recover. Basically, when you delete something, it tells the drive to mark the sectors as deleted just like in a traditional hard drive. However, when subsequently asked to read back the data, the drive will respond back with either zeros or garbage.

Note: It's not impossible that you’re unable to recover any data; you will need to send it to a lab or to the manufacturer who can get around the mechanisms that secures the data. However, this is usually very cost prohibitive unless it's for forensics and provided that the sector hasn't been overwritten already. Unlike magnetic media, it only takes a single write to send the preexisting data into oblivion.

5
  • 3
    Also, SSD+APFS means you have snapshots and ghost data due to copy on write. So if you can get a snapshot, even when TimeMachine isn’t expected to be in play, this makes recovery trivial. But it also makes trolling free space much less likely to succeed (and more labor intensive) versus magnetic storage and HFS.
    – bmike
    Commented Apr 19, 2020 at 3:12
  • Are the snapshots created automatically? Is there a way to view snapshots? Ie from command line?
    – ccpizza
    Commented Apr 19, 2020 at 5:55
  • 2
    just like in a traditional hard drive - no, TRIM commands on an SSD have no equivalent on a traditional HD. It's an optional additional thing that a filesystem can do after the normal process of updating its metadata (on other blocks of the disk) to remove any references to this block as being in-use and add it to the FS's free list. (The filesystem has to keep track of its own in-use / free blocks separately from the SSD firmware block remapping layer. Filesystems work even inside disk image files with no underlying disk hardware, and magnetic HDDs don't support TRIM.) Commented Apr 19, 2020 at 6:16
  • 2
    But yes, if your FS issues a TRIM command on the fly for the sectors of a file, your data is gone. It sounds like you're saying MacOS's APFS driver does that (by default?). (Linux can do online TRIM, or you can set up a fstrim cron job to TRIM all the free space once a week or something.) Commented Apr 19, 2020 at 6:19
  • 2
    It only takes a single write to send preexisting data into oblivion on modern spinning hard drives, too (which use PMR). This has been true for almost 15 years. Commented Apr 19, 2020 at 13:40
5

There is no way to easily recover the files deleted by rm. You will ned a 3rd part app to do so. There is an app called Stellar, EaseUS, or Disk Drill. The first two are pricey but Disk Drill offers a level of recovery for free.

4
  • 6
    Do these work well on SSD and APFS?
    – bmike
    Commented Apr 19, 2020 at 3:09
  • 1
    Encryption is unlocked when you run disk drill. If you didn’t have the disk unlokced (where then encryption was bypassed with a key) nothing would have restored @ccpizza - sorry that it wasn’t a good recovery
    – bmike
    Commented Apr 19, 2020 at 12:34
  • 2
    @ccpizza "done more often than with old school HDDs." You shouldn't factor the availability of data recovery services into a backup strategy. They're a "nice to have" if you're in need, but in no way dependable. If anything, you should back up HDDs more, because failures are just so much more common. I would strongly recommend setting up time machine
    – Alexander
    Commented Apr 19, 2020 at 14:38
  • 2
    Note to self: I payed $90 for this and it reminded me what files I deleted but failed to recover the body of any of them. Commented Jan 4, 2021 at 13:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .