How to recover files on mac deleted from Bootcamp

[Vee3]

Hello,

So today, I installed Windows 10 on Parallel Desktop and after opening it, I saw my mac Desktop folders and files there so i thought it was copied from mac desktop and i deleted it permanently from there. But later i found out that files where deleted from my mac desktop as well. I tried recovery tools but the files deleted like that is not coming up.

Is there any way to recover it now? Please help.

Thank you!

 

[AidenShaw]

Hello,

So today, I installed Windows 10 on Parallel Desktop and after opening it, I saw my mac Desktop folders and files there so i thought it was copied from mac desktop and i deleted it permanently from there. But later i found out that files where deleted from my mac desktop as well. I tried recovery tools but the files deleted like that is not coming up.

Is there any way to recover it now? Please help.

Thank you!

Ooops. Time machine time.

 

[glynster]

Unless you have time machine to restore them then deleting files outside of the Mac OS will not put them in your trash and "restore" or undelete within the OS will not be an option. However, chances are they can still be recovered - just do not make any more changes to your system until you have properly researched it. Computers do not actually delete anything from the hard disk when you perform a delete under normal conditions, that would be grossly inefficient - they instead merely make the disk sectors that were occupied with your files available for writing over and hidden from the file listings - usually by changing the first letter of each file to a system reserved character (at least that's how Windows does it - i.e. "myfile.txt" would become "._yfile.txt"). The good news is that there are a great many apps that will find and list those hidden/deleted files for you and give you the option to restore them - just be careful that the app you download does not itself over-write your lost data - ideally download it on a separate computer and run from a USB if possible - a quick google will find a suitable app, there are plenty - I have had 100% success using them in the past where the disk itself is not corrupted.

Stupid question - but you did check your windows trash can right? If not, try booting up Windows and checking there - also try your recovery method within the OS with which you deleted the files.

 

[AidenShaw]

[QUOTE="glynster, post: 22474149, member: 1011199]usually by changing the first letter of each file to a system reserved character (at least that's how Windows does it - i.e. "myfile.txt" would become "._yfile.txt").[/QUOTE]
What?

What filesystem are you talking about?

NTFS deletes files by changing the pointers to the meta-data file structures - not by giving files strange "hidden" filenames. The pointers are deleted from the directory and file record tables. They're marked as "unused" in the meta-data.

NTFS "undelete" utilities work by looking for the "orphaned" meta-data structures. (The file record data is not overwritten until the system write new files and reclaims the file records.)

 

[ZombiePhysicist]

https://www.prosofteng.com/data-rescue-4/

This can help, Data Rescue 4

 

[glynster]

AidenShaw,

And... so you are making this point to help the OP solve his problem - exactly how?

 

[AidenShaw]

AidenShaw,

And... so you are making this point to help the OP solve his problem - exactly how?

You implied that the files might just be hidden via a naming convention, when modern filesystems mark the file meta-data as deleted (usually without actually erasing the file data or meta-data).

The OP needs a tool like ZombiePhysicist suggested to scan the meta-data and "unmark" the files marked for delete.

 

[nigelbb]

Data recovery tools aren't really suitable when such extensive deletion has occurred. The only safe option to be sure that everything is recovered properly is to restore from a Time Machine backup.

 

[AidenShaw]

Data recovery tools aren't really suitable when such extensive deletion has occurred. The only safe option to be sure that everything is recovered properly is to restore from a Time Machine backup.

I've recovered from accidental reformats and recursive directory deletions - in otherwords, extensive deletion.

The key is to immediately stop writing to the partition in question after the mistake. That leaves all of the "marked for delete" files and directories intact.

If you write to the partition, things will get "recycled" and the marked for delete files will be reused. The more writing, the less likely you'll be able to recover.

A corollary of this is that if the mistake was on the system partition, pull the power cord right away. Boot from another disk or a recovery disk and work from there. The system is constantly writing to the system disk. (Don't shutdown - shutting down writes lots of files...)

 

[nigelbb]

I've recovered from accidental reformats and recursive directory deletions - in otherwords, extensive deletion.

The key is to immediately stop writing to the partition in question after the mistake. That leaves all of the "marked for delete" files and directories intact.

If you write to the partition, things will get "recycled" and the marked for delete files will be reused. The more writing, the less likely you'll be able to recover.

A corollary of this is that if the mistake was on the system partition, pull the power cord right away. Boot from another disk or a recovery disk and work from there. The system is constantly writing to the system disk. (Don't shutdown - shutting down writes lots of files...)

Let me reiterate. The only safe option to be sure that everything is recovered properly is to restore from a Time Machine backup. The system will be in an inconsistent state. Restoring from a full backup will be quicker than futzing around using data recovery tools & never being quite sure that you didn't miss anything.

 

[AidenShaw]

Let me reiterate. The only safe option to be sure that everything is recovered properly is to restore from a Time Machine backup. The system will be in an inconsistent state. Restoring from a full backup will be quicker than futzing around using data recovery tools & never being quite sure that you didn't miss anything.

Agree completely that restoring is the safest, but far too often people start running backups after a major loss.