Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

brendaelliott201

macrumors newbie
Original poster
Jul 19, 2024
14
2
Hello Guru,

Please I mistakenly removed my project directory while trying to push to github. I am dieing as i type. I removed the directory using rm -rf ~/directorylocation . I have searched the internet to see how I can recover the directory but the solution i have tried weren't recovering the directory. I have not restarted my computer after I deleted and the date I mistakenly deleted it was still today 2nd of August, 2024.



********WHAT I HAVE TRIED


I have tried to recover the directory by doing the following:

a) Change directory to the ~/.Trash directory,

In the directory, i could find other deleted files and es but I couldn't find my project directory I was looking for there until I read that files or directories deleted using the rm -rf ~/direcorylocation cannot be recovered like that. To my surprise, i came across the software EaseUS Data Recovery Wizard, i used the software to search for deleted File and Directories on my computer and after almost 4hrs searching the software found my project directory but to my surprise it needs me to upgrade and pay despite the fact that my project directory is not upto 2GB that is given as Free license edition but the EaseUS Data Recovery software wouldn't allow me recover the directory.


My question is, where on my mac computer is this directory and how do I recover the directory I deleted using rm -rf ~/directorylocation in MacOS? At least the EaseUS Data Recovery found it on my computer.



Please help gurus.



Thank you in advance.
 

smirking

macrumors 68040
Aug 31, 2003
3,960
4,022
Silicon Valley
Your only hope is that you have Time Machine turned on and that folder is still in your time machine backups.

You're otherwise out of luck. That folder is vapor now.

Do not ever rm with the -rf flags unless you're absolutely sure of what you're doing and if you're not sure what you're doing, you really should not be on the command line on your main computer. Practice on something you can restore or reset.
 

brendaelliott201

macrumors newbie
Original poster
Jul 19, 2024
14
2
Thank you @smirking, so unfortunate that I did not configure Time Machine. But my question is, the software EaseUS Data Recovery Wizard found the directory on my computer when I scanned it using the software and that makes me to believe I can find solution on the forum with the help of gurus like you. Where did the EaseUS Data Recovery Wizard found it on my computer? It is Paid version and it is not allowing me to recover it.

Please help
 

smirking

macrumors 68040
Aug 31, 2003
3,960
4,022
Silicon Valley
Thank you @smirking, so unfortunate that I did not configure Time Machine. But my question is, the software EaseUS Data Recovery Wizard found the directory on my computer when I scanned it using the software and that makes me to believe I can find solution on the forum with the help of gurus like you. Where did the EaseUS Data Recovery Wizard found it on my computer? It is Paid version and it is not allowing me to recover it.

You could try EaseUS. I've used that to recover a corrupted drive, but I don't know how well it'll work on erased files. Why aren't you trying to recover using EaseUS?
 
  • Like
Reactions: NoGood@Usernames

chrfr

macrumors G5
Jul 11, 2009
13,729
7,306
Using the rm -rf command does not put anything into a trash folder- the data is simply deleted. You can try data recovery but you're most likely out of luck.
 

brendaelliott201

macrumors newbie
Original poster
Jul 19, 2024
14
2
You could try EaseUS. I've used that to recover a corrupted drive, but I don't know how well it'll work on erased files. Why aren't you trying to recover using EaseUS?
EaseUS Data Recovery found it believe me but it wanted me to paid for it and the directory is not up to 2GB. The EaseUS Data Recovery states that recovering less than 2GB is free but it asks me to pay before I can recover it. I am surprised it found the directory. I could even open individual file and view the contents inside the file to be sure it is your file but cannot copy it.

EaseUS Data recovery found directory and files deleted using rm -rf. The directory is still on the computer because EaseUS Data Recovery can find it and that means it is still in my computer.
 
  • Like
Reactions: -DMN-

winxmac

macrumors 68000
Sep 1, 2021
1,571
1,832
I would have recommended something free but you're using macOS which I have limited knowledge of...

Since the software already found the deleted directory, see if it has a money back guarantee in case it did not successfully recover the directory/folder that you deleted...

As what was mentioned earlier, some software require you to pay for the license to unlock all the features... You only have two choices in this instance, pay for the license or just forget about the lost data and move on...

There could be a free software for macOS that can recover data but the longer you use the drive, the smaller the chance of you being able to recover what was lost...

I was in a similar situation before but it is about wiping hard disk... I was using a drive erase software which I think was CLI only...

I thought the disks were numbered 1 and 2 thinking 1 was the boot drive but as it turned out, the boot drive was number 0 and data disk was number 1... So I ended up wiping the data disk realizing it was too late...

I had very little knowledge about data recovery at the time so I was just crying over spilled milk... Have I learned my lesson? To a certain extent, since there are still times I erase something not knowing I did not have a backup copy of the contents of the drive...
 

smirking

macrumors 68040
Aug 31, 2003
3,960
4,022
Silicon Valley
@smirking , it actually wanted an upgrade before I can recover the directory.

I thought you said your directory was below the 2GB limit? If you can recover anything at all, do it ASAP. Using the drive that your missing files are on is a very bad idea. If you really value those files, don't waste any time and get recovering. Those files are not simply sitting in a hidden folder waiting for you to move them out. They are for all intents and purposes gone for all normal file management routines. That EaseUS is even seeing them is a surprise to me.
 

Timpetus

macrumors 6502
Jun 13, 2014
410
931
Orange County, CA
Data recovery is your only hope here, and any files that have been overwritten will be unrecoverable. Best practice is to immediately create a true bit-level image of the drive and stop using it, then perform recovery on the image. Some data recovery software has provisions for this, I have had to do the same when an SD card became corrupted a few times.
 

brendaelliott201

macrumors newbie
Original poster
Jul 19, 2024
14
2
After looking at the EaseUS Data Recovery software carefully, I studied the interface and realised I could select only directories I am interested and fully recover it out of all the recovered directory. I was/am lucky that I have it successfully recovered. What mesmerised me is that 90% of software developers and system administrator believe directory or file deleted with rm -rf cannot be recovered. I am surprised, in fact some files and directories that it detected that I have deleted for a longer time in the past were there but I can only use the free version to recover directories and files not more than 2GB.



I THANK everyone that took time out of their no time to contribute their support.



Thank you
 
  • Like
Reactions: NoGood@Usernames

smirking

macrumors 68040
Aug 31, 2003
3,960
4,022
Silicon Valley
EaseUS has a help page on using the rm command and recovering files removed by the rm command.

That's news to me. I've always believed that anything deleted off off of an encrypted SSD drive was toast. According to that EaseUS article, it's basically the same as it was when files were removed from a HDD. Only the pointer to the file is purged, but the actual file is still recoverable.

However, don't make it a habit to rm -rf entire directories unless you're absolutely absolutely absolutely sure you want to purge it. I've once saw a fresh server admin delete an entire server that way and still have nightmares about it. That was 20 years ago and to this day if I have to rm -rf an entire directory, I stop, count to 3, clear my head, read the command letter by letter to make sure, and then press enter.

Wait. I missed a few steps. In between each step above, I pray to Linus and I'm not even religious.
 

CraigJDuffy

macrumors 6502
Jul 7, 2020
480
780
EaseUS Data Recovery found it believe me but it wanted me to paid for it and the directory is not up to 2GB. The EaseUS Data Recovery states that recovering less than 2GB is free but it asks me to pay before I can recover it. I am surprised it found the directory. I could even open individual file and view the contents inside the file to be sure it is your file but cannot copy it.

EaseUS Data recovery found directory and files deleted using rm -rf. The directory is still on the computer because EaseUS Data Recovery can find it and that means it is still in my computer.
Yes, EaseUS should be able to recover it as should free tools such as those from Piriform. You haven’t deleted the file, you have deleted the reference to it in the file system so you have some time where recovery is possible.
 

ignatius345

macrumors 604
Aug 20, 2015
7,640
13,090
After looking at the EaseUS Data Recovery software carefully, I studied the interface and realised I could select only directories I am interested and fully recover it out of all the recovered directory. I was/am lucky that I have it successfully recovered. What mesmerised me is that 90% of software developers and system administrator believe directory or file deleted with rm -rf cannot be recovered. I am surprised, in fact some files and directories that it detected that I have deleted for a longer time in the past were there but I can only use the free version to recover directories and files not more than 2GB.



I THANK everyone that took time out of their no time to contribute their support.



Thank you
Not sure if this has been said yet, but I would imagine that you do NOT want to actively be using the machine in question until you recover the data. Since the space the files occupy is marked as ok to write on by the system, and anything new created could be written right over it.
 
  • Like
Reactions: AlixSPQR

riptilian

macrumors newbie
Jan 14, 2022
13
8
"However, don't make it a habit to rm -rf entire directories unless you're absolutely absolutely absolutely sure you want to purge it. I've once saw a fresh server admin delete an entire server that way and still have nightmares about it. That was 20 years ago and to this day if I have to rm -rf an entire directory, I stop, count to 3, clear my head, read the command letter by letter to make sure, and then press enter.

Wait. I missed a few steps. In between each step above, I pray to Linus and I'm not even religious."

Before making first incision at surgery, a TIME OUT is taken by all hands present: ?right patient, ?right side, ?right procedure. Then, cut.
 

brendaelliott201

macrumors newbie
Original poster
Jul 19, 2024
14
2
"However, don't make it a habit to rm -rf entire directories unless you're absolutely absolutely absolutely sure you want to purge it. I've once saw a fresh server admin delete an entire server that way and still have nightmares about it. That was 20 years ago and to this day if I have to rm -rf an entire directory, I stop, count to 3, clear my head, read the command letter by letter to make sure, and then press enter.

Wait. I missed a few steps. In between each step above, I pray to Linus and I'm not even religious."

Before making first incision at surgery, a TIME OUT is taken by all hands present: ?right patient, ?right side, ?right procedure. Then, cut.
Thank you so much, i was already crying cos i believed it was impossible especially when i couldn't find it in the Trash ~/.Trash directory.
 

frou

macrumors 65816
Mar 14, 2009
1,394
2,003
In programming terms, IIRC the underlying syscall used when deleting a file like this is called "unlink", and that name makes it a bit clearer that it is only removing a reference and not necessarily scrubbing the actual data.
 
  • Like
Reactions: smirking

brendaelliott201

macrumors newbie
Original poster
Jul 19, 2024
14
2
In programming terms, IIRC the underlying syscall used when deleting a file like this is called "unlink", and that name makes it a bit clearer that it is only removing a reference and not necessarily scrubbing the actual data.

But many programmers, developers and even sysadmin believed this was impossible. Why weren't/aren't people being recovering resources removed using rm -rf? I have been to 3 different forums but all I got were "It is impossible" as an answer.

THANK YOU FOR BEING HERE
 

winxmac

macrumors 68000
Sep 1, 2021
1,571
1,832
It's impossible to recover something in a drive in use, specially if the data to be recovered is in the boot drive... You'll never know what background process is running that could cause overwriting the data you are trying to recover...

It's impossible in the sense that it is not straightforward for non-tech users... A specialized data recovery software is required to perform the operation... Sometimes, seeking professional help from long time data recovery facility which comes with a price is what you need...

It's not like looking at the Recycle Bin [Windows] or Trash [macOS] and you will see the files or folders/directories in there... What you told the computer to do was to force delete and apply the same to all [Yes to All]... So to the computer or operating system, the files or folders/directories no longer exist but a deeper inspection would tell you that they are still there, not just accessible to you in a straightforward manner...

The correct way to recover data from a boot drive is to disconnect it from the system and use it as a secondary drive in another computer, like installing it in an external drive enclosure and connect via USB...
 

TechnoMonk

macrumors 68030
Oct 15, 2022
2,628
4,147
Over the years, I have recovered/tried recovering data for multiple reasons. It’s not a sure shot. You were lucky that data wasn’t over written after unlinking from rm-rf. It’s better to not depend on recovery and be careful with rm -rf.
 

DrWojtek

macrumors regular
Jul 27, 2023
191
406
I was gonna say it's completely possible since you just deleted it. The data is still there but with a flag that says OK to overwrite, basically.
 

AndyMacAndMic

macrumors 65816
May 25, 2017
1,116
1,680
Western Europe
I was gonna say it's completely possible since you just deleted it. The data is still there but with a flag that says OK to overwrite, basically.

Yes, but in this case all the data is on his boot drive. The OS is constantly writing (temp) files and other stuff to the boot drive for house keeping. So, unless the user immediately shuts down the computer, all bets are off. Every minute the computer is on and in use, the bigger the chance that those files get overwritten.

I could not determine from the OP that the data was just deleted. How long has the OP tried things before posting here? How much stuff did the OP do on the computer before posting here? Was the OP still using the computer or even used it to write this post on it?
 
Last edited:
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.