18

When I delete folders or files in through osx terminal using the rm -rf, where do they go? I heard that some say they are deleted directly, but some also say it only "remove the link to the file making it unable to be found or accessed without special tools" ( Where do files and directories go when I run 'rm -rf folder_or_file_name' in Ubuntu 10.04? ).

Someone said something about ext3 being able to save rm-ed files in ubuntu but what about mac?

1

3 Answers 3

17

Files deleted using rm are not easily recovered and, although the contents are not overwritten by the rm command the space they occupy is marked as free space and can be used for new files or for additional content added to existing files.

As soon as the rmcommand completes, the system is no longer keeping any record of the location of the data for that file.

There are file-recovery tools you can use, but that is a separate question. If you don't have a backup - stop using the computer and look for file-recovery tools. Be prepared for total loss though as recovery is not guaranteed.

See

5
  • 1
    Once it's overwritten, it's probably gone. But if you have enough free space on the drive, it might be a while before your deleted bits get overwritten by new files, so you can often salvage lots of old documents.
    – Thomas
    Oct 13, 2012 at 11:30
  • Ok, separate question: What file recovery tools that I can use to recover files deleted through rm?
    – Lena
    Oct 13, 2012 at 12:50
  • @Lena - see the tools mentioned in the answers to the questions listed at the bottom of the answer above. Oct 13, 2012 at 17:30
  • @Lena Even without a specialized recovery tool, you can always open up your hard drive in raw read-only mode, search for something you know your file contained, and then read the raw bits off the hard drive if you manage to find your keyword. But that's really a desperate man's recovery method.
    – Thomas
    Oct 14, 2012 at 11:29
  • @Thomas I am desperate. How can I open up my hd in raw read-only mode and do the rest of the things you say? Keyword means I cant save some archives?
    – Lena
    Oct 14, 2012 at 13:37
1

I am giving one general Example

Just consider your hard disk size is 80GB

From 0 to 10GB you saved PICTURES

11 to 30GB ----- PDF

31 to 60GB ----- MP3

61 to 75GB ----- TXT

If you try to save one 10GB movie then it shows No enough memory

It will not overwrite your any data because these files (PICTURES,PDF,MP3,TXT) are now protected by your file system.

Now you delete PICTURES, at that time that picture storage location will be detached by your filesystem ( That means now it is not protected by your file system, anyone can write here)

After deleteling also you can recover your PICTURES (as RedGrittyBrick said) that is because only logical address are gone, but that data are still in your hard disk in the form of bytes.

Now you saved your 10GB movie

At that time from 0 to 10GB PICTURES are replaced by this MOVIE

Now if you try to recover your PICTURES then its not possible

That is because it deleted from your dard disk too.

NOTE (EXTRA):

If memory location 20GB-22GB free and 50GB-58GB free then your file get split into 2 part half part saved 20-22 and half under 50-58.

If your files saved part by part in diffrent location then your computer becomes slow that is because to read a file the header (hard disk read write header) will be moved to several place and it takes time.

5
  • Actually, what I want to know is where they go. An alternate universe? Guess not. I have lots that were accidentally rmed and I want to know how to salvage them. And I dont think normal file recovery works.
    – Lena
    Oct 13, 2012 at 13:28
  • @lena: They don't "go" anywhere, the contents of the file will still reside in the same space that the file occupied the whole time before, but what matters is that the records where which file is stored are lost, and your operating system needs these records for normal operation (i.e. listing files in the Finder.) But because the contents are still there on your hard disk (albeit in a space now marked as "free" in the filesystem), some specialized searching programs can scan your whole hard drive for file structures and recover such files IF they aren't already overwritten. Oct 13, 2012 at 19:51
  • @lena: so what's most important is that you STOP USING YOUR COMPUTER for anything else than file recovery! Do not edit files, download files, install programs, don't do anything which will affect the contents of your hard drive. Install the recovery program to a different hard drive. And during recovery, of course, you will need a second hard drive or USB key to store the recovered files on. Oct 13, 2012 at 19:52
  • @FelixDombek HAHA too late. I downloaded lots of stuff (more than 2 gigs of files in the past few days), but I didn't put anything into the folder where I lost the files. Anyway, I understand what you said. Now what I want to know is the "specialized searching programs can scan your whole hard drive for file structures and recover such files IF they aren't already overwritten". As I said before, I dont think "normal" file recovery (that recovers deleted files) work. Ok, use another hard drive.
    – Lena
    Oct 14, 2012 at 13:34
  • @lena: Where you put the files doesn't matter, as they will simply be spread out over any free space there is. So your new downloads might as well have destroyed your lost data. You can't be sure until you try a data recovery. "Normal" deleted file recovery will probably work though. I'm a Windows user so I can't point you to specific programs, but you should just give the solutions mentioned in the other answers a shot. Oct 14, 2012 at 13:47
1

Undeleting files is sometimes possible as some experts here have already pointed out. It is in any case extremely tricky and usually you can only recover some files, you lose their names and location paths etc. That is: a real mess. There is a free-libre program made by the USAF, foremost, and I could use it to recover some things from the hard disk of a friend, but it does not do miracles. Destroyed is is destroyed.

The general answer to you question is: files deleted from a filesystem (not considering some extra recycle bin services offered by some desktop managers) CANNOT be undeleted.

Said that:

  • Most important: Introduce backups as an essential task in your daily life
  • Pay extreme attention to what you do from the console. Be cautious. For example: If organizing data, instead of quickly removing, try to move the folder to a "to_be_deleted" folder, and once you have double-checked everything, remove it.

Please make backups regularly, and remove a lot of grief and stress that is created in this planet every day.

1
  • Shouldn't there be something. Even Ubuntu with ext3 can. I would make backups from now on, but I must recover all my lost files. Please Help.
    – Lena
    Oct 14, 2012 at 13:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .