I was playing around with OSX find and GNU find from findutils (v 4.4.2) package for learning purposes. GNU find has a -delete option, which is self-explanatory. What isn't, however, is that "Use of -delete automatically turns on the -depth option", which means it will recursively remove the current working directory content without a warning.
The problem is I accidentally executed such a command on my system, instead of remote shell session.
I tried to research the internals behind -delete but all I could come up with was official GNU findutils docs.
As I realised what happened, I turned off the system to prevent possible overwriting of sectors. Then, I took a "standard recovery approach" using
- EaseUS Data Recovery Wizard for Mac
- Prosoft Data Rescue 3
- Disk Drill
- Mac Data Recovery Guru
but to no results. The removed directory was actually a git repository with many small files. As close-to-zero disk operation was made since the deletion, I doubt all of them could get overwritten. It's not a disastrous situation because I'm obviously pull the repository content from remote. Still, I loose unpublished local branches and files under .gitignore.
Are there any OSX mechanisms I could use to get these files back?
Best Answer
OS X maintains deleted files in the local time machine storage area if you have enabled (or the system has enabled) a local store.
If you can make a snapshot, you can enter Time Machine and recover these files. If you get an error like **Local snapshots are not enabled. ** then you don't have the ability to recover the files from the OS level. Since there is no other undelete mechanism in the filesystem, you have a good survey of recovery tools (I use Data Rescue pretty much exclusively) and your only third option would be to locate a viable backup of the system or the files in question.
I make a habit of enabling the local store and forcing a snapshot before doing anything as root or anything I might regret from the terminal. Having made mistakes like this over the years, I've learned to have that "premonition" to check backup and double check the syntax. In general, I try to make a list of files to delete and save it to a file so I have a pause and a second script that does the removal rather than piping them together. It's not going to help, but it's my experience and way to mitigate when I can't ensure a good backup.