Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

MP All Models Recover deleted directory with rm -rf

B

brendaelliott201

macrumors newbie
Original poster
Jul 19, 2024
14
2
Hello Guru,

Please I mistakenly removed my project directory while trying to push to github. I am dieing as i type. I removed the directory using rm -rf ~/directorylocation . I have searched the internet to see how I can recover the directory but the solution i have tried weren't recovering the directory. I have not restarted my computer after I deleted and the date I mistakenly deleted it was still today 2nd of August, 2024.



********WHAT I HAVE TRIED


I have tried to recover the directory by doing the following:

a) Change directory to the ~/.Trash directory,

In the directory, i could find other deleted files and es but I couldn't find my project directory I was looking for there until I read that files or directories deleted using the rm -rf ~/direcorylocation cannot be recovered like that. To my surprise, i came across the software EaseUS Data Recovery Wizard, i used the software to search for deleted File and Directories on my computer and after almost 4hrs searching the software found my project directory but to my surprise it needs me to upgrade and pay despite the fact that my project directory is not upto 2GB that is given as Free license edition but the EaseUS Data Recovery software wouldn't allow me recover the directory.


My question is, where on my mac computer is this directory and how do I recover the directory I deleted using rm -rf ~/directorylocation in MacOS? At least the EaseUS Data Recovery found it on my computer.



Please help gurus.



Thank you in advance.
 
Your only hope is that you have Time Machine turned on and that folder is still in your time machine backups.

You're otherwise out of luck. That folder is vapor now.

Do not ever rm with the -rf flags unless you're absolutely sure of what you're doing and if you're not sure what you're doing, you really should not be on the command line on your main computer. Practice on something you can restore or reset.
 
  • Like
Reactions: john123, jdogg836 and KeithBN
Thank you @smirking, so unfortunate that I did not configure Time Machine. But my question is, the software EaseUS Data Recovery Wizard found the directory on my computer when I scanned it using the software and that makes me to believe I can find solution on the forum with the help of gurus like you. Where did the EaseUS Data Recovery Wizard found it on my computer? It is Paid version and it is not allowing me to recover it.

Please help
 
brendaelliott201 said:
Thank you @smirking, so unfortunate that I did not configure Time Machine. But my question is, the software EaseUS Data Recovery Wizard found the directory on my computer when I scanned it using the software and that makes me to believe I can find solution on the forum with the help of gurus like you. Where did the EaseUS Data Recovery Wizard found it on my computer? It is Paid version and it is not allowing me to recover it.
Click to expand...

You could try EaseUS. I've used that to recover a corrupted drive, but I don't know how well it'll work on erased files. Why aren't you trying to recover using EaseUS?
 
  • Like
Reactions: NoGood@Usernames
Using the rm -rf command does not put anything into a trash folder- the data is simply deleted. You can try data recovery but you're most likely out of luck.
 
  • Like
Reactions: KeithBN and NoGood@Usernames
smirking said:
You could try EaseUS. I've used that to recover a corrupted drive, but I don't know how well it'll work on erased files. Why aren't you trying to recover using EaseUS?
Click to expand...
EaseUS Data Recovery found it believe me but it wanted me to paid for it and the directory is not up to 2GB. The EaseUS Data Recovery states that recovering less than 2GB is free but it asks me to pay before I can recover it. I am surprised it found the directory. I could even open individual file and view the contents inside the file to be sure it is your file but cannot copy it.

EaseUS Data recovery found directory and files deleted using rm -rf. The directory is still on the computer because EaseUS Data Recovery can find it and that means it is still in my computer.
 
  • Like
Reactions: -DMN-
I would have recommended something free but you're using macOS which I have limited knowledge of...

Since the software already found the deleted directory, see if it has a money back guarantee in case it did not successfully recover the directory/folder that you deleted...

As what was mentioned earlier, some software require you to pay for the license to unlock all the features... You only have two choices in this instance, pay for the license or just forget about the lost data and move on...

There could be a free software for macOS that can recover data but the longer you use the drive, the smaller the chance of you being able to recover what was lost...

I was in a similar situation before but it is about wiping hard disk... I was using a drive erase software which I think was CLI only...

I thought the disks were numbered 1 and 2 thinking 1 was the boot drive but as it turned out, the boot drive was number 0 and data disk was number 1... So I ended up wiping the data disk realizing it was too late...

I had very little knowledge about data recovery at the time so I was just crying over spilled milk... Have I learned my lesson? To a certain extent, since there are still times I erase something not knowing I did not have a backup copy of the contents of the drive...
 
brendaelliott201 said:
@smirking , it actually wanted an upgrade before I can recover the directory.
Click to expand...

I thought you said your directory was below the 2GB limit? If you can recover anything at all, do it ASAP. Using the drive that your missing files are on is a very bad idea. If you really value those files, don't waste any time and get recovering. Those files are not simply sitting in a hidden folder waiting for you to move them out. They are for all intents and purposes gone for all normal file management routines. That EaseUS is even seeing them is a surprise to me.
 
  • Like
Reactions: Analog Kid, -DMN- and NoGood@Usernames
Data recovery is your only hope here, and any files that have been overwritten will be unrecoverable. Best practice is to immediately create a true bit-level image of the drive and stop using it, then perform recovery on the image. Some data recovery software has provisions for this, I have had to do the same when an SD card became corrupted a few times.
 
  • Like
Reactions: john123, iMac2019 and NoGood@Usernames
After looking at the EaseUS Data Recovery software carefully, I studied the interface and realised I could select only directories I am interested and fully recover it out of all the recovered directory. I was/am lucky that I have it successfully recovered. What mesmerised me is that 90% of software developers and system administrator believe directory or file deleted with rm -rf cannot be recovered. I am surprised, in fact some files and directories that it detected that I have deleted for a longer time in the past were there but I can only use the free version to recover directories and files not more than 2GB.



I THANK everyone that took time out of their no time to contribute their support.



Thank you
 
  • Like
Reactions: NoGood@Usernames
EaseUS has a help page on using the rm command and recovering files removed by the rm command.
www.easeus.com

How to Recover Files Deleted by RM on Mac

Trying to recover RM deleted files or undo RM command on Mac? Read on and learn how to find and recover files deleted by RM command from Mac with EaseUS Mac drive recovery. All types of files can be recovered by this file recovery software for macOS 10.14 - OS X 10.6.
www.easeus.com www.easeus.com

That's news to me. I've always believed that anything deleted off off of an encrypted SSD drive was toast. According to that EaseUS article, it's basically the same as it was when files were removed from a HDD. Only the pointer to the file is purged, but the actual file is still recoverable.

However, don't make it a habit to rm -rf entire directories unless you're absolutely absolutely absolutely sure you want to purge it. I've once saw a fresh server admin delete an entire server that way and still have nightmares about it. That was 20 years ago and to this day if I have to rm -rf an entire directory, I stop, count to 3, clear my head, read the command letter by letter to make sure, and then press enter.

Wait. I missed a few steps. In between each step above, I pray to Linus and I'm not even religious.
 
brendaelliott201 said:
EaseUS Data Recovery found it believe me but it wanted me to paid for it and the directory is not up to 2GB. The EaseUS Data Recovery states that recovering less than 2GB is free but it asks me to pay before I can recover it. I am surprised it found the directory. I could even open individual file and view the contents inside the file to be sure it is your file but cannot copy it.

EaseUS Data recovery found directory and files deleted using rm -rf. The directory is still on the computer because EaseUS Data Recovery can find it and that means it is still in my computer.
Click to expand...
Yes, EaseUS should be able to recover it as should free tools such as those from Piriform. You haven’t deleted the file, you have deleted the reference to it in the file system so you have some time where recovery is possible.
 
  • Like
Reactions: AlixSPQR, NoGood@Usernames and smirking
brendaelliott201 said:
After looking at the EaseUS Data Recovery software carefully, I studied the interface and realised I could select only directories I am interested and fully recover it out of all the recovered directory. I was/am lucky that I have it successfully recovered. What mesmerised me is that 90% of software developers and system administrator believe directory or file deleted with rm -rf cannot be recovered. I am surprised, in fact some files and directories that it detected that I have deleted for a longer time in the past were there but I can only use the free version to recover directories and files not more than 2GB.



I THANK everyone that took time out of their no time to contribute their support.



Thank you
Click to expand...
Not sure if this has been said yet, but I would imagine that you do NOT want to actively be using the machine in question until you recover the data. Since the space the files occupy is marked as ok to write on by the system, and anything new created could be written right over it.
 
  • Like
Reactions: AlixSPQR
"However, don't make it a habit to rm -rf entire directories unless you're absolutely absolutely absolutely sure you want to purge it. I've once saw a fresh server admin delete an entire server that way and still have nightmares about it. That was 20 years ago and to this day if I have to rm -rf an entire directory, I stop, count to 3, clear my head, read the command letter by letter to make sure, and then press enter.

Wait. I missed a few steps. In between each step above, I pray to Linus and I'm not even religious."

Before making first incision at surgery, a TIME OUT is taken by all hands present: ?right patient, ?right side, ?right procedure. Then, cut.
 
  • Like
  • Love
Reactions: Sezel, NoGood@Usernames and smirking
riptilian said:
"However, don't make it a habit to rm -rf entire directories unless you're absolutely absolutely absolutely sure you want to purge it. I've once saw a fresh server admin delete an entire server that way and still have nightmares about it. That was 20 years ago and to this day if I have to rm -rf an entire directory, I stop, count to 3, clear my head, read the command letter by letter to make sure, and then press enter.

Wait. I missed a few steps. In between each step above, I pray to Linus and I'm not even religious."

Before making first incision at surgery, a TIME OUT is taken by all hands present: ?right patient, ?right side, ?right procedure. Then, cut.
Click to expand...
Thank you so much, i was already crying cos i believed it was impossible especially when i couldn't find it in the Trash ~/.Trash directory.
 
In programming terms, IIRC the underlying syscall used when deleting a file like this is called "unlink", and that name makes it a bit clearer that it is only removing a reference and not necessarily scrubbing the actual data.
 
  • Like
Reactions: smirking
frou said:
In programming terms, IIRC the underlying syscall used when deleting a file like this is called "unlink", and that name makes it a bit clearer that it is only removing a reference and not necessarily scrubbing the actual data.
Click to expand...

But many programmers, developers and even sysadmin believed this was impossible. Why weren't/aren't people being recovering resources removed using rm -rf? I have been to 3 different forums but all I got were "It is impossible" as an answer.

THANK YOU FOR BEING HERE
 
It's impossible to recover something in a drive in use, specially if the data to be recovered is in the boot drive... You'll never know what background process is running that could cause overwriting the data you are trying to recover...

It's impossible in the sense that it is not straightforward for non-tech users... A specialized data recovery software is required to perform the operation... Sometimes, seeking professional help from long time data recovery facility which comes with a price is what you need...

It's not like looking at the Recycle Bin [Windows] or Trash [macOS] and you will see the files or folders/directories in there... What you told the computer to do was to force delete and apply the same to all [Yes to All]... So to the computer or operating system, the files or folders/directories no longer exist but a deeper inspection would tell you that they are still there, not just accessible to you in a straightforward manner...

The correct way to recover data from a boot drive is to disconnect it from the system and use it as a secondary drive in another computer, like installing it in an external drive enclosure and connect via USB...
 
  • Like
Reactions: AndyMacAndMic and smirking
Over the years, I have recovered/tried recovering data for multiple reasons. It’s not a sure shot. You were lucky that data wasn’t over written after unlinking from rm-rf. It’s better to not depend on recovery and be careful with rm -rf.
 
I was gonna say it's completely possible since you just deleted it. The data is still there but with a flag that says OK to overwrite, basically.
 
DrWojtek said:
I was gonna say it's completely possible since you just deleted it. The data is still there but with a flag that says OK to overwrite, basically.
Click to expand...

Yes, but in this case all the data is on his boot drive. The OS is constantly writing (temp) files and other stuff to the boot drive for house keeping. So, unless the user immediately shuts down the computer, all bets are off. Every minute the computer is on and in use, the bigger the chance that those files get overwritten.

I could not determine from the OP that the data was just deleted. How long has the OP tried things before posting here? How much stuff did the OP do on the computer before posting here? Was the OP still using the computer or even used it to write this post on it?
 
Last edited:
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back