Welcome to the MacNN Forums.

mac freak · Feb 13, 2003, 12:33 AM

There's a file I deleted about a year ago I recently realized I really should not have trashed...

I erased it under Mac OS 9 (might have been 9.0.4 or 9.2.2, can't remember what I was running at the time) normally, by putting it through the trash.

Has it been too long to have any hope of recovering it? If there IS still hope, what software do y'all recommend?

Thanks.

bradoesch · Feb 13, 2003, 12:38 AM

It's not really the amount of time that's passed, but how much disk activity you've done (specifically, adding or moving files.) If the system hasn't wrote over the part of the disk that used to hold your old file, then you're set. But it's not likely that after a year that space has remained untouched. Norton Utilities comes with a program for recovering file I believe.

C.J. Moof · Feb 13, 2003, 12:41 AM

A year? I'd say your chances are slim to none, unless you rarely use this machine. With any regular use, that section of the drive has probably been written and overwritten many times over by now.

Good luck.

BTP · Feb 13, 2003, 12:42 AM

Hmm. I'd have to say that being that old, the chances are very slim, but depending upon how much you use your system, it is possible, however unlikely.

Things aren't really deleted when you delete them and are recoverable as long as the file isn't overwritten. You can try some Norton products, like Unerase, but I have not heard anything good about Norton OS X products. YMMV.

Bottom line I think its gone. But what the hell do I know? Try Norton and good luck.

Millennium · Feb 13, 2003, 01:04 AM

There is a small but nonzero chance that the file may be recoverable. There is also a small but nonzero chance that I might sprout wings and fly away.

Sad to say, unless you've had the machine turned off for most of that year, you're probably hosed. Your best bet would be to take it to the NSA; they should be able to get the file for you. The problem there would be convincing them why they should do it; unless that file is an issue of national security they probably won't.

mac freak · Feb 15, 2003, 05:21 PM

Ah well, thanks for the replies.
I use the machine constantly, so I'm sure the HD sector has been overwritten like 100 times.

yukon · Feb 16, 2003, 07:52 PM

something can be recovered being overwritten >34 times, but that's with special equipment. in my experiance though, I couldn't "undelete" onythnig of many megabytes after just decompressing my undelete utility

sorry man

mrtew · Feb 16, 2003, 11:10 PM

Originally posted by yukon:
something can be recovered being overwritten >34 times, but that's with special equipment.

Is this just an urban cyber-myth? How could something possible be recovered after being over written? Has anyone actually seen this done, or just heard it and repeated it?

icruise · Feb 17, 2003, 12:30 AM

Originally posted by mrtew:
Is this just an urban cyber-myth? How could something possible be recovered after being over written? Has anyone actually seen this done, or just heard it and repeated it?

I've wondered the same thing. The "most secure" methods of deleting a file overwrite the data many many times, but I don't really understand how a file can be recovered if it has been physically overwritten.

mac freak · Feb 17, 2003, 12:42 AM

I once read a good analogy (don't know if it's valid, though) related to recovering old files...

You know when you erase something you've written with a pencil, and then you write something new over it but you can still tell what you orginially wrote, if you really try? I've heard hard drives are similar: Even if you write over something you deleted, it's still lightly "there" and can be turned back into a functional file.

Any validity to this?

Avon · Feb 17, 2003, 02:04 AM

There is still a residual magnetic field. The only sure way to erase data is to incinerate the hard disk.

yukon · Feb 17, 2003, 02:32 AM

something about an oscilloscope and an electron microscope. it's something about the magnetic 'switches" not turning entirely on a write, that by doing the math, you could find it's position many many writes earlier. of course, this gets exceptionally expensive, and years and years of difficult work when you get a number of writes. i'm not an engineer, so i never cared about the more technical stuff, only the general result ;-)

if you want to clear something, use diskwarrior to overwrite the catalog, so the file's position is more difficult to pinpoint. then zero the drive a number of times (three is sufficient)....there was some write patterns that makes it more difficult, A4 was one I think...i forget.

if you want to protect your privacy, encrypt everythnig, like an encrypted FS so keyloggers can't be installed locally etc. using secure software on a properly configured network will fix some exploit problems (linux, behind NAT, firewall, etc).

if you need to recover your data. if you are a newbie, concider utilities that save all your deleted files compressed and hidden or something. if you deleted a file, DO NOT write to the disk at all, do not boot, nothing. use a boot disk and recover the files onto other media.

after uncompressing that utility, i was able to recover all my older files, the ones I had backed up, not the new important and unbacked up ones :-\.

if you want total data protection, instead of deleting things drop them in a special folder. set up a RAID (multiple mirrored drives), back up automatically over a local network, and have that backup sent to a place in another city or something. not too easy or economical...

head hurts now ;-)