Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

l0uismustdie

macrumors regular
Original poster
Nov 30, 2009
109
1
Edinburgh, UK
Hello. I have two disks I have been working with one on my MacBook Pro (HFS+) and one connected to a Linux machine (FAT - this is an external hard drive). Recently I started exploring backing up my files with rsync over an ssh from my Mac to the external hard drive connected to the Linux machine. I did this once successfully and ported all of my Mac files to the external. However, I did something incorrectly the second time and I believe I may have done rsync in the wrong direction and it has overwritten some files on my Mac (configuration files for iCal that had events stored, an iPhone program I've been working on). The full rsync command I used was the following:
Code:
rsync -avz -e ssh linux@linuxuser:/media/external/Users /Users
However, I was under the impression rsync wouldn't touch files that are timestamped at a newer date so even if it was copying from the linux external to the mac hard drive why would it overwrite newer files??

I have recently downloaded scalpel to try to see if I could find these files but every time I run
Code:
./scalpel /dev/disk0s2 -o recovery/
I get the error
Code:
ERROR: You have attempted to use a non-empty output directory. In order
       to maintain forensic soundness, this is not allowed.
Aborting.
recovery/ is a directory I created solely for the purpose to scalpel and is empty.

If there is anyone out there who has any ideas that might lead me down the path to recovering some of these overwritten files I would be eternally grateful (especially the iPhone program which I've been working on for 3 months).
 

goombah88

macrumors member
Aug 6, 2008
36
0
Is it possible it wants to create the dir for you? Never heard of scalpel but worth a shot.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.