Can files deleted with rm -rf be recovered?
When I delete folders or files in through osx terminal using the rm -rf, where do they go? I heard that some say they are deleted directly, but some also say it only "remove the link to the file making it unable to be found or accessed without special tools" ( Where do files and directories go when I run 'rm -rf folder_or_file_name' in Ubuntu 10.04? ).
Someone said something about ext3 being able to save rm-ed files in ubuntu but what about mac?
Solution 1:
Files deleted using rm are not easily recovered and, although the contents are not overwritten by the rm command the space they occupy is marked as free space and can be used for new files or for additional content added to existing files.
As soon as the rmcommand completes, the system is no longer keeping any record of the location of the data for that file.
There are file-recovery tools you can use, but that is a separate question. If you don't have a backup - stop using the computer and look for file-recovery tools. Be prepared for total loss though as recovery is not guaranteed.
See
- Data recovery for OS X
- https://superuser.com/q/10101/52492
- How to recover deleted file in mac?
- Recover text file deleted from trash on Mac OS X?
Solution 2:
I am giving one general Example
Just consider your hard disk size is 80GB
From 0 to 10GB you saved PICTURES
11 to 30GB ----- PDF
31 to 60GB ----- MP3
61 to 75GB ----- TXT
If you try to save one 10GB movie then it shows No enough memory
It will not overwrite your any data because these files (PICTURES,PDF,MP3,TXT) are now protected by your file system.
Now you delete PICTURES, at that time that picture storage location will be detached by your filesystem ( That means now it is not protected by your file system, anyone can write here)
After deleteling also you can recover your PICTURES (as RedGrittyBrick said) that is because only logical address are gone, but that data are still in your hard disk in the form of bytes.
Now you saved your 10GB movie
At that time from 0 to 10GB PICTURES are replaced by this MOVIE
Now if you try to recover your PICTURES then its not possible
That is because it deleted from your dard disk too.
NOTE (EXTRA):
If memory location 20GB-22GB free and 50GB-58GB free then your file get split into 2 part half part saved 20-22 and half under 50-58.
If your files saved part by part in diffrent location then your computer becomes slow that is because to read a file the header (hard disk read write header) will be moved to several place and it takes time.
Solution 3:
Undeleting files is sometimes possible as some experts here have already pointed out. It is in any case extremely tricky and usually you can only recover some files, you lose their names and location paths etc. That is: a real mess. There is a free-libre program made by the USAF, foremost, and I could use it to recover some things from the hard disk of a friend, but it does not do miracles. Destroyed is is destroyed.
The general answer to you question is: files deleted from a filesystem (not considering some extra recycle bin services offered by some desktop managers) CANNOT be undeleted.
Said that:
- Most important: Introduce backups as an essential task in your daily life
- Pay extreme attention to what you do from the console. Be cautious. For example: If organizing data, instead of quickly removing, try to move the folder to a "to_be_deleted" folder, and once you have double-checked everything, remove it.
Please make backups regularly, and remove a lot of grief and stress that is created in this planet every day.