Data-Recovery Options Under Mac OS X
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Dealing with data loss is something that nobody ever wants to do, regardless of whether that missing data is treasured family photos and home movies, a college paper, your entire digital music collection, or critical business information. As we become more and more connected to and dependent on the digital data that makes up our home and work lives, the prospect of catastrophic data loss—or even the loss of a few key pieces of information—becomes an increasingly scary prospect.
Of course, the best way to avoid being in the position of losing data is to back it up. For Mac users, that can mean using the Mac OS X application Time Machine; cloud-based services such as MobileMe iDisk, Dropbox, and Google Docs; syncing information between multiple computers (either with an automatic solution like MobileMe or manual copying of files); or the time-honored solution of simply cloning the entire contents of your hard drive(s) to a backup disk periodically.
All of these solutions are valid options and, if performed regularly, can minimize the potential risk of losing important information. But no system is completely perfect, and any of us may encounter a situation in which we accidentally delete files or suffer a hard drive issue when we don't have a backup of recent work or updates. Worse are the rare circumstances when both the original data and the backup are lost. When those situations occur, it's important not just to know what tools or professionals can help, but also to work through the problem in a manner that will maximize the potential for recovering that lost data.
Assessing the Situation
When data loss occurs, it's important to take a deep breath and try to understand exactly what has happened:
- Did you simply empty the Trash without realizing that it contained some important documents? Did you recognize the loss of those files immediately—or days or weeks later?
- If a file (or series of files) suddenly appears to have disappeared, was it "out of the blue," or something that may have happened months ago that you didn't notice? Can you locate the missing files (or images or songs) using Spotlight?
- Has anyone else used your computer? If so, were they logged in with your account or their own account(s)?
- Did a hard drive fail? If so, did you have any warning signs? Can a hard drive utility mount the drive? Are any SMART error codes displayed in the hard drive utility? Did you notice any unusual grinding or clicking sounds before the failure?
- Does the computer exhibit other problems beyond the hard drive failure? Does it power on and start up properly, either from its internal drive or from an alternate disk, including the Mac OS X Install DVD?
- Perhaps the most relevant question of all: Even if you have no current backup, could your missing data be stored elsewhere? For photos, this could be on a website like Flickr, your digital camera, and/or your iPod/iPhone/iPad. For other documents, perhaps you emailed them to someone or stored them on a flash drive? While the answer may be no, if you have the ability to locate some or all of the lost data without resorting to full-on data recovery, that fact should provide some comfort, as well as a plan of action if recovery fails.
Once you've determined the cause and extent of the data loss, you can consider options for recovery. Recovery options are addressed in four broad categories:
- Missing files
- Accidental deletion or reformatting
- Damaged/corrupted directory structures or file systems
- Physically damaged drives or media
Let's consider each category in a little more detail.
Missing Files
Missing files are typically the easiest of problems to solve, because typically a file has simply been moved or renamed, and therefore isn't actually "lost." In such cases, by searching your hard drive either manually or with Mac OS X Spotlight, you may be able to locate the missing file(s).
In addition to working solely based on the filename, you can search by a number of other details about the file, commonly called metadata. Following are some common categories of metadata searches:
- Application that created the file
- Type of file (document, photo, presentation, etc.)
- Contents of text-based files (such as a word-processing document or email)
- Date on which the file was created, last opened, or modified
- File extension (most useful for files shared with non-Mac systems)
- Size of the file
- Finder label(s)
In a Spotlight search, you can specify dozens of file or data attributes, many of them specific to certain applications. Here are some examples:
- When searching for missing music files, you can use any song attribute in iTunes, such as artist or album.
- While searching for photos, you can look for attributes used by iPhoto and other photo-editing or photo-management tools, such as whether a flash was used, the date on which the photo was taken, or the location if the photo is geocoded with location data. Many smartphone cameras, including the iPhone, and newer digital cameras include location data when capturing photos.
- For Microsoft Office or iWork documents that are shared, you can search by the name of the document's author(s).
Accidental Deletion or Reformatting
After missing files, accidentally deleted files (or files on a reformatted drive) are the next-easiest items to recover. In Mac OS X, when you empty the Trash or format, erase, or partition a disk, the actual data remains on the hard drive (or other media), but is marked as free space. Most commercially available recovery tools can search for any space marked as free on a drive, collecting and reassembling any data that they find.
In these situations, the sooner after deletion you search, the more likely you are to have success in recovering information, as there's less chance that some of that data marked as free space has been replaced by new data.
On the other hand, if you use the Secure Empty Trash feature, or one of the more secure options for erasing a disk, you're less likely to recover data, because these features immediately overwrite deleted information, with the express purpose of preventing recovery. However, you may have some success with a consumer-oriented tool or by using a data-recovery service, which generally has a much greater chance of recovering lost data than you would have by attempting it on your own.
Damaged or Corrupted Directory Structures or File Systems
Damaged directory structures or file systems can make accessing files difficult, because there is no longer an accurate map of the drive's contents to use in locating files. In these cases, using a hard drive utility to attempt to repair or rebuild the directory can usually yield success unless the corruption is severe.
Commercial utilities (which I covered in a recent article) can be a better choice, because they can create a new directory based on the contents, instead of trying to fix the original. Some utilities, such as Alsoft's DiskWarrior, let you preview the new directory first, allowing you to ensure that files are accessible before altering the current directory.
Physically Damaged Drives or Media
Physical damage is the worst data-recovery situation, since it means that the physical components of the hard drive (or flash drive or other media) are no longer fully operational. These situations almost always require a professional data-recovery service. Attempting to use consumer-oriented tools can actually make recovery less likely, because continued attempts to access the physical components of the drive can cause further physical damage.
Hard drive utilities can generally alert you to physical damage with SMART error codes or by a complete inability to mount—or even recognize—the drive. If physical damage is suspected, avoid using hard drive utilities to attempt to repair the disk before you speak to a data-recovery expert, to ensure that you don't cause further damage.