Data recovery

Derived from the "Data Recovery" chapter of our book, Troubleshooting Mac® OS X, this is one FAQ we hope you never have to read.

If you have implemented our comprehensive backup and recovery solution, the need for data recovery would be minimized. However, this FAQ provides our advice for recovering data from a hard disk, including cases where you have trashed files and emptied the Trash.

As a result of the incident that led you to this FAQ, we strongly recommend that you implement a comprehensive backup and recovery solution, such as that described in our "Backup and Recovery" FAQ.

Can the data be recovered?

First, and most important: stop using your Mac immediately. Continued use of your Mac significantly increases the likelihood that the data you want to recover may be overwritten if it has not been already.

If you are attempting to recover files from the Trash, note the following:

• If you have not emptied the Trash since trashing the files, they are still in the Trash: drag them out of the Trash to your desktop.
• If you either emptied the Trash or deleted the files with the UNIX® rm (remove) command, the data may be unrecoverable. Files you recover may be unusable.
• If you emptied the Trash using Secure Empty Trash under Mac® OS X 10.3 Panther® or later, the data is unrecoverable.

Try ProSoft Data Rescue II

It may be possible to recover some or all of the data with ProSoft® Data Rescue II.

When one uses Empty Trash, what is actually deleted are not the files themselves but the hard drive's directory entries for the files that were in the Trash. The space the files occupied is now, from the hard drive's perspective, "free space" — "Available" as seen in Get Info — that can be overwritten at any time. However, the bits that comprised your data are still there.

When this space will be overwritten depends on a variety of factors, such as how this space is distributed over the drive: large files are frequently distributed over the disk, not written into contiguous space. If you delete a small file, the space it occupied may not be overwritten until another file of equal or smaller size is to be written to the disk. However, the space once occupied by a small file may also be used to save part of a large file.

The space may be overwritten immediately, but it may also be days or weeks before it is overwritten. It all depends on how this now-free space is distributed on the disk and what write operations you have the operating system perform thereafter.

Your greatest chance of recovering a file intact is to stop using the Mac immediately and try to recover the files with Data Rescue II. The probability of recovering the files decreases dramatically the longer you use the computer after selecting Empty Trash.

If one uses Secure Empty Trash, the space is overwritten immediately with "ASCII garbage" — random ASCII characters — or zeros and hence the files are unrecoverable.

Before using Data Rescue II, thoroughly read and understand its documentation. Key points include:

• Do not install Data Rescue II on the drive, volume, or partition from which you will attempt to recover data as this may result in the overwriting of data you hope to recover.
• Run Data Rescue II from either:
  • Its bootable CD.
  • From another Mac on which you installed Data Rescue II, with the affected Mac as the target disk in FireWire® Target Disk Mode.
• Data Rescue II requires temporary space on a disk or volume other than that from which files are to be recovered. Likewise, recovered files must be saved on a disk other than the disk from which files are to be recovered. Using an external FireWire or USB 2.0 drive, or partition thereon, for temporary space and recovered files is ideal. Details can be found in the Data Rescue II documentation.

Professional data recovery services

Another option is to send the hard drive in question to a data recovery service. We recommend DriveSavers® Data Recovery as using their service will not void the warranty on an Apple-installed drive. Professional data recovery is expensive — contact DriveSavers for pricing — but "expensive" is relative: it all depends on how much the data is worth to you.