How can I get back a system file after deleting it from my Mac?

I've deleted a system file from my Mac and need to get it back.

System files can include:

hidden files in the root of / - especially unix files in /private
/System files
/Library files
/Applications files that ship with the core OS

System files are not any app, user files or files that can be regenerated by a known sequence such as cache files, Spotlight index files, etc…

^{Canonical question and answer for this comment by bmike♦.}

Solution 1:

If you have a recent Mac then it has a recovery partition.

Power on your Mac and hold down Command+R until the Apple logo appears. This will cause your Mac to boot using the recovery partition.

Once you are in the recovery partition, you can then reinstall the operating system.

This Apple technical note, OS X: About OS X Recovery, gives more details.

You can reinstall the OS and leave your files intact. Apple removed the erase/install option so you don't have to worry about the Recovery Installer erasing your files. You now have to explicitly launch the Disk Utility tool to erase or reformat/repartition a drive when booted from recovery OS.

Solution 2:

If you don't mind or are sure your Recovery HD is patched to match the OS on your main system, you can snag a file and see if it works without needing to do a full reinstall of the OS and without needing a restart or an internet connection / saved installer.

Use the Recovery partition

Many¹ system files are also included on the Recovery partition and can be copied over.

Mount the Recovery HD
```
diskutil mount Recovery\ HD
```

Mount the BaseSystem.dmg

hdiutil mount /Volumes/Recovery\ HD/com.apple.recovery.boot/BaseSystem.dmg

Copy the file

FILE="/usr/bin/codesign"
sudo cp -p /Volumes/OS\ X\ Base\ System/${FILE} ${FILE}

This process can be combined into a single-line command if you have to run it frequently…

FILE="/usr/bin/codesign"; diskutil mount Recovery\ HD && hdiutil mount /Volumes/Recovery\ HD/com.apple.recovery.boot/BaseSystem.dmg && sudo cp -p /Volumes/OS\ X\ Base\ System/${FILE} ${FILE}

Even if you have deleted the cp binary (which could happen), there is /usr/bin/ditto, /usr/bin/tar and several other commands that can stand in for cp.

Reinstall OS X

If you've got the ability to reinstall OS X through the Recovery HD, Internet Recovery or an OS X install media then reinstalling OS X will 'repair' your install and copy any missing/broken system files back to your system.

I recommend that you do a permissions repair using Disk Utility after copying a file manually and then rebooting. If the fix works, now would be an excellent time for another backup snapshot.

^{¹ Not all system files are on the Recovery HD, but many are. If the copying command doesn't work, check that the file exists on the Recovery HD.}

Solution 3:

If you are sure your Recovery HD is patched to match the OS on your main system, you can snag a file and see if it works without needing to do a full reinstall of the OS.

Hold ⌘-R during startup until you see a window similar to this:

enter image description here

These are your options:

Choose Utilities>Terminal:

Your OS X disk will be mounted in /Volumes/<your disk name>. For example, on my Mac it was mounted in /Volumes/Mavericks:
```
df
Filesystem     1K-blocks      Used Available Use% Mounted on
/dev/disk0s2   249219484 145891460 103072024  59% /Volumes/Mavericks
```
Now copy /bin to your OS X disk:
```
cp -a /bin /Volumes/<your disk name>
```
Note that the contents of /bin will be outdated, as the recovery disk is not updated with the rest of the OS, so restore /bin from Time Machine after successfully starting your Mac and logging in.

Solution 4:

There is a a solution that requires an Internet connection.

OS X Recovery

Mac models introduced after Mac OS X 10.7, Lion, include the ability to start up directly from an Internet-based version of the OS X Recovery system.

OS X automatically uses this feature when the Recovery System on the hard disk isn't available (such as when your hard disk encounters an issue, or when your hard disk has been replaced or erased). OS X Internet Recovery lets you start your Mac directly from Apple's servers. Starting up from this system performs a quick test of your memory and hard drive to check for hardware issues.

So I suggest you plug in your ethernet cable, since the wifi is probably not going to work, and choose the option to boot from the internet if the list of options come up and you've got the right version.

Restoring iLife applications after Internet Restore of OS X

If your computer came with OS X Lion or later and you erase your hard disk and install OS X, you can download iPhoto, iMovie, and GarageBand from the Mac App Store.

After installation, start (up) from OS X.
Double-click the App Store icon in the dock.
Enter your Apple ID and password.
Click Purchases. If you haven't previously accepted your bundled iLife applications within the Mac App Store, you should see your iLife applications appear in the Accept portion of the screen.
Click Accept. You may be asked for your Apple ID and password once again. Your iLife applications now move to the Purchased section. These applications are part of the software that came with your computer. Your account will not be charged for them.
Click Install to complete installation of your applications.