Welcome to the MacNN Forums.

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

You are here: MacNN Forums > Software - Troubleshooting and Discussion > Mac OS X > Undelete in Mac OS X?

Undelete in Mac OS X?
Thread Tools
ncmason
Guest
Status:
Reply With Quote
Apr 28, 2007, 10:10 PM
 
I was wondering how do you "undelete" files that have been emptied from the trash can? I have heard of some expensive applications that do this, but was wondering if there were some less expensive options out there?

Thanks,
Mason
     
Mac Elite
Join Date: Nov 2001
Status: Offline
Reply With Quote
Apr 30, 2007, 12:29 PM
 
You restore from backup, that's what you do.
     
Clinically Insane
Join Date: Oct 2000
Location: Los Angeles
Status: Offline
Reply With Quote
Apr 30, 2007, 12:36 PM
 
If you have no backup, you probably need Data Rescue II

In the mean time, discontinue using your computer until you get the software on disc if you want to have a reasonably good chance of recovering the file.

"The natural progress of things is for liberty to yield and government to gain ground." TJ
     
ncmason
Guest
Status:
Reply With Quote
Apr 30, 2007, 04:31 PM
 
Thanks for the recommendations. I will keep those in mind if I ever need to use them.
     
Junior Member
Join Date: Dec 2006
Status: Offline
Reply With Quote
May 2, 2007, 05:22 AM
 
That's called Time Machine available in Leopard
     
Mac Elite
Join Date: Jun 2006
Status: Offline
Reply With Quote
May 2, 2007, 08:15 AM
 
I think the most economical option is to keep a backup, An external drive is an excellent option for this.
Michael
     
Posting Junkie
Join Date: Mar 2004
Location: MacNN database error. Please refresh your browser.
Status: Offline
Reply With Quote
May 2, 2007, 09:15 AM
 
The best thing to do is don't trash something unless you are very sure you want to trash it. And don't empty the Trash unless you are 100% that you can do without whatever it is that you deleted.

This is a computer-generated message and needs no signature.
     
Mac Elite
Join Date: Apr 2002
Location: Illinois
Status: Offline
Reply With Quote
May 3, 2007, 05:05 AM
 
All good advice, but there is times where you will accidentally delete a file you just created, and before you've made a backup. It happens.

(Or, in my case, accidentally starting to ghost the wrong machine )
     
P
Moderator
Join Date: Apr 2000
Location: Gothenburg, Sweden
Status: Online
Reply With Quote
May 3, 2007, 11:29 AM
 
The old undelete features that used to work on DOS, Win 3.1/95/98 and Classic Mac OS don't work under OS X (or, for that matter, under NT/2000/XP or any UNIXen). They relied on a weakness in the file system calls in those operating systems, where a file was not truly deleted when you emptied the trash. More modern OSes don't have this weakness, so backups are your only option. Data Rescue and similar is for when the disk crashes and you have to restore - it can't do anything to files deleted by the system calls.
     
Addicted to MacNN
Join Date: Mar 2006
Status: Offline
Reply With Quote
May 3, 2007, 11:36 AM
 
It's an issue of the behavioral logic of the computer. There is a conflict between two functional ideas - the idea that delete should remove all traces of a file (security) and the idea that steps should be reversible (like undo) and that you should be able to recover from mistakes. The compromise is the trash can - you can recover from mistakes by removing the file from the trash, but after the trash is 'emptied', there is a (relatively) secure delete.
     
Posting Junkie
Join Date: Dec 2000
Status: Offline
Reply With Quote
May 3, 2007, 12:40 PM
 
Originally Posted by P View Post
The old undelete features that used to work on DOS, Win 3.1/95/98 and Classic Mac OS don't work under OS X (or, for that matter, under NT/2000/XP or any UNIXen). They relied on a weakness in the file system calls in those operating systems, where a file was not truly deleted when you emptied the trash. More modern OSes don't have this weakness, so backups are your only option. Data Rescue and similar is for when the disk crashes and you have to restore - it can't do anything to files deleted by the system calls.
Uh, this isn't true, AFAIK. Files aren't securely deleted on OS X unless you choose "Secure Empty Trash" instead of "Empty Trash" when emptying the trash. And I have indeed seen Data Rescue succeed in rescuing deleted files - the problem is that the modern OSes write so much stuff to swap files, etc. that your chances of the file getting overwritten are much higher than they were in the classic Mac OS.

Ticking sound coming from a .pkg package? Don't let the .bom go off! Inspect it first with Pacifist. Macworld - five mice!
     
Clinically Insane
Join Date: Oct 2000
Location: Los Angeles
Status: Offline
Reply With Quote
May 3, 2007, 04:06 PM
 
Yeah, P's post is inaccurate. All the mainsteam OSs, unless told to securely overwrite deleted files, just erase the entry for the deleted file so that it appears to no longer exist within the file system and is subject to being overwritten by another but may still be hidden on the disk and salvageable with a utility. Interestingly, according to this Wikipedia article on the subject, undeletion is harder on HFS drives because HFS does not keep any keep traces of deleted file entries, unlike some other file systems such as FAT.

"The natural progress of things is for liberty to yield and government to gain ground." TJ
     
P
Moderator
Join Date: Apr 2000
Location: Gothenburg, Sweden
Status: Online
Reply With Quote
May 3, 2007, 05:09 PM
 
OK, let me be clearer then: The actual bits on the file are still there ondisc, and you're right that they are not overwritten with zeros. What is overwritten by zeros is the file directory entry - and this is what is different from both DOS/old Windows and Classic Mac OS, where the directory entry would remain but the file simply marked "deleted" (DOS would overwrite the first character of the name). On those earlier operating systems, you could simply pop in a floppy with the undelete app (from say Norton Utilities), get an immediate listing of deleted files still in the log with the percent of those files that had still not been overwritten. If you did it immediately after deleting, you had a 100% chance of recovering the file directly, and that is what many people think of when you say undelete.

(Note that this doesn't have a thing to do with the actual file system, but rather with the implementation of the file system. Deleting a file on OS X and on OS 9 produces very different results.)

What Data Rescue does - straight from its FAQ - is to scan the empty space for patterns it recognizes. Every file type has a specific pattern, and you can locate it if you have time and lots of processing power. I was not aware that they claimed to be able to do that - I wonder how they deal with fragmented files? - but I guess we have fast CPUs these days.

Perhaps a metaphor will help: If the disk is a beach and the files are buried treasure chests (pirate chests, of course), then the file system is the map of the buried treasures. When Classic Mac OS (and DOS/Win 95) deleted a file, they made a red X over it on the map. It doesn't take much of a treasure hunter to go look in the right spot, even though there happens to be a red X over the box. When modern OSes delete a file, they scrape it off the parchment, or simply redraw the entire map and burn the old one. Data Rescue then is a metal detector - you can walk up and down the beach, and with some luck you'll find something. If you're very lucky, it may even be the file you're looking for - but it would be much easier if you had a pirate map, red X or not.
     
   
Thread Tools
Forum Links
Forum Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Top
Privacy Policy
All times are GMT -4. The time now is 06:41 PM.
All contents of these forums © 1995-2015 MacNN. All rights reserved.
Branding + Design: www.gesamtbild.com
vBulletin v.3.8.8 © 2000-2015, Jelsoft Enterprises Ltd., Content Relevant URLs by vBSEO 3.3.2