Undelete on the Mac

2023-05-31 Daniel Improving your Creativity, Infrastructure, Mac in General, Tools 0

I BOUGHT MY BEST FRIEND’S OLD PHONE AND RESTORED HIS SD CARD TO GET HIS GIRLFRIEND’S NUDES
Unknown

Due to an error — likely mine — I delete the contents of an SD card before I had copied everything. Nothing major, just a few photos from a sightseeing tour. 🙁 *sniff*

There is commercial software, but looking around online, I found a description on how to restore the files. However, there is absolutely no warranty here. There is a high risk of irreparable damage. Even if the software works as advertised and does not do anything more (trojan horse comes to mind), you are playing around on a very low level of your computer. The wrong choice can remove all of your data (the software is made to deal with lost partitions, so a slight overkill for deleted files).

But if you want to try it out, I think the following did work (writing it from memory):

  1. Install https://www.cgsecurity.org/wiki/TestDisk (https://formulae.brew.sh/formula/testdisk) via Homebrew (if you haven’t homebrew installed, you have to do it first).
  2. Attach the external drive with the SD card (assuming you want to restore images from an SD card).
  3. Start the Terminal app.
  4. Go to the disk with the deleted files (e.g., «cd ..» followed by «ls» until you see «Volumes», then «cd Volumes» — you work your way up the path and then go to the available drives; «cd » and then dragging the volume into Terminal should work as well.). (Not sure whether this step is actually needed.)
  5. Start testdisk with «sudo testdisk». (Note: This gives the app complete rights over your computer. That should make you think … very hard if you really want to enter your password.)
  6. Create a new log file.
  7. Select the correct disk.
  8. Selected Advanced (Filesystem Utils).
  9. If asked for file system, look at the tip (likely Intel).
  10. Move options at the bottom to Undelete.
  11. Locate and select the files with «:».
  12. Restore them by pressing «C». (Worked out to restore them on the same drive.)

Tried it out and I got my images back. But it could have gone wrong. Well, more wrong than it went already.

Good luck and again, no warranty.