[pbjudge]

I understand that normally when you throw something into the trash, it is in reality on taken off the directory and that it usually still exists somewhere on the hard drive - at least until that space is needed for new data.

Is there anyway to search deleted files in OSX?

Basically, I deleted a mail a couple of weeks ago and now it turns out that particular email can save my job (long story...).

Can anybody give me information or advise on how to see if it still may be in the drive somewhere...

My job is on the line here, so please, any suggestions would be greatly appreciated.

- Patrick

[Tsilou B.]

The mail was saved together with all other mails in an mbox file. When you delete the mail, it won't take long till it is overwritten.
If you are extremely lucky and it's still somewhere on your disk, you should try the following command in a Terminal:

sudo grep -i -b -a --context=10 "aspecialword" /dev/disk0 | hexdump -C

replace aspecialword with a word that was contained in the email and that won't be in many other files. If you know no such word, you could try the sender's or receiver's email address (assuming you haven't got tens of emails from/to that person).

/dev/disk0 is the first hard disk (all partitions). If you have stored your mail on an external disk and you don't know the disk number, post here again.

It will take some hours to search the entire hard drive, but if you have a little chance to save your job that way, it's probably worth it. When it finds something, it will output the context. If you find your email that way, but it is not complete, don't close the Terminal window and post here again.

Good luck!

[pbjudge]

Thanks so much Tsilou. I will give this a try tomorrow morning and let you know how it goes. I really appreciate your help...

- P

[teknologika]

If the mail is an incoming mail I would also check what the "Remove copy from server" setting (Mail Preferences, accounts then advanced) is set to. There may be a copy waiting on your server for you to collect with a different mail client.

( I think this is unlikely, but it costs nothing to check. )

[pbjudge]

Originally posted by Tsilou B.:
The mail was saved together with all other mails in an mbox file. When you delete the mail, it won't take long till it is overwritten.
If you are extremely lucky and it's still somewhere on your disk, you should try the following command in a Terminal:

sudo grep -i -b -a --context=10 "aspecialword" /dev/disk0 | hexdump -C

replace aspecialword with a word that was contained in the email and that won't be in many other files. If you know no such word, you could try the sender's or receiver's email address (assuming you haven't got tens of emails from/to that person).

It will take some hours to search the entire hard drive, but if you have a little chance to save your job that way, it's probably worth it. When it finds something, it will output the context. If you find your email that way, but it is not complete, don't close the Terminal window and post here again.

Good luck!

Two questions for you Tsilou B...

1) Where I'm supposed to input a special word or mail address, I've got too much data with searching for one word or mail address, so can I input a phrase or sentence? If so, what about the spaces between words? I am new to Terminal, and I am afraid to screw up. I've been told that careless use of spaces can cause trouble. So how can I input an entire phrase to limit the search?

2) I did a few test searches and the shell gave me a lot of data in four coloums that looked like:
004d7150 30 36 36 36 37 39 34 30 34 e0 0b 05 74 6f 6b 61 |066679404...toka|

How can I extract the date from this? Is there any way to see the original email?

Thanks again for your imput.

- P

[Tsilou B.]

1) Where I'm supposed to input a special word or mail address, I've got too much data with searching for one word or mail address, so can I input a phrase or sentence? If so, what about the spaces between words? I am new to Terminal, and I am afraid to screw up. I've been told that careless use of spaces can cause trouble. So how can I input an entire phrase to limit the search?

You can input phrases with spaces, but they must be in one line in the email. If the email looks like this:

Thank you very much for your
great idea.

you would find it by searching for "very much for", but not if you entered "your great idea".

2) I did a few test searches and the shell gave me a lot of data in four coloums that looked like:
004d7150 30 36 36 36 37 39 34 30 34 e0 0b 05 74 6f 6b 61 |066679404...toka|

How can I extract the date from this? Is there any way to see the original email?

use this command instead:

sudo grep -i -b -a --context=10 "aspecialword" /dev/disk0 | cat -v -

This way you won't get that hexadecimal output.
When the command outputs a match, it will first output a number. That's the location of the match on your disk. If you find your mail, but it is not complete, you can tell the computer to output more data from that location and you will hopefully find the entire email there.

[pbjudge]

Thank you again for your advise. I will try your suggestions as soon as I can and report back on the success or failure.

I am truly greatful for your support.

- P

[pbjudge]

Hi.

Just an update. Using your advice I was able to recover a couple of sentences worth of data. While it was not the full email, it was enough for my boss to believe my side of the story.

My job is safe. Thanks so much Tsilou!

- P