I accidentally deleted a file by running:

rm -rf ./Desktop/myScript.sh

I think it's possible to recover the file, because the rm command removes temporarily. How can I recover the deleted file on Mac OSX?

  • 1
    You'll want to look for HFS+ undelete tools, assuming you're using HFS+. The Apple SE site probably knows more.
    – derobert
    Sep 14, 2012 at 16:28
  • 1
    Anecdotal, but my father-in-law accidently deleted a large directory of photos on Mac OS X, and was successful in recovering most of them using a tool he downloaded (I think it cost money, but had a trial for one or two files, so you can test if it's going to work, and in your case that would be sufficient). discussions.apple.com/thread/… Sep 14, 2012 at 17:05

2 Answers 2


MacOS is a Unix OS and rm means "good-bye". The GUI interface allows you to move a file to the trash (which you can then recover) but that's not what you did. If you have a backup (e.g. you have Time Machine running) then you are saved.


Strictly speaking (as @ire_and_curses points out) a rm simply deletes the directory entry for the file while leaving the disk blocks it used, untouched. If you could quiesce the filesystem in which the file had been, there are advanced methods by which you can try to re-discover those blocks contents. There are also some recovery tools which can be purchased to recover the loss. The central issue is that nothing else re-uses any of the disk blocks represented by your file.

The MacOS also has a secure remove command (srm) which over-writes a file before it is unlinked making it unrecoverable. I use the unlink term since this is the underlying system call associated with a shell's rm command. This sets the stage for the next part of this discussion, below.


[ I should hasten to add that even if you over-write a disk multiple times, there are ways to read what was written a dozen or more times before. To properly sanitize a disk for disposal really requires an acid bath, a big hammer and a shredder. ]

unlinking a file decrements the file's inode link-count. If this value reaches zero, the file is deleted from the filesystem directory and its disk blocks freed for re-use. This only happens when no processes have the file open. It is often confusing to administrators to find that a filesystem is utilizing very large amounts of space that can't be accounted for by the simple summation of disk blocks (with something like du). Most often the reason is that an open file has been removed, so that it is no longer represented in its directory. The reason is that the disk blocks remain inuse until the last process using the file terminates.

Opening a file and immediately unlinking it is actually a common practice for creating secure, temporary files. Tools like lsof can expose these otherwise invisible files if you look for files with a link count (NLINK) of zero.

In Unix and Linux (of which the MacOS is a branded Unix), an rm follows the Unix philosophy of "do-it" without fanfare if it can. That is, if you have the permissions to remove a file (i.e. your directory allows writing) then rm does just what you ask. You might like to create a shell alias rm='rm -i' that prompts you for confirmation before performing the operation. Using the -f switch with rm overrides that if necessary. An aliased rm is most useful when you do glob removes like rm *.log. That is, you have the option of skipping a file in the list.

  • Well done on the "clarification" section.
    – Tim
    Sep 14, 2012 at 19:45
  • The Mac OS "secure erase trash" function uses a pattern researched to actually erase the quantum wells on modern spinning disks. On solid state storage, it uses the "trim" functionality to put the storage blocks associated with the file at the head of the "to be erased" queue in the storage controller. Use them if you really want the contents off your disk, but note they take a long time to scrub a spinning disk.
    – Wexxor
    Sep 1, 2016 at 19:21

Depending on your content, but you can use different 3rd party softwares to do that, e.g.:

and many more.

You can find more apps by typing 'data recovery' in App Store.

More advanced way is to boot your OSX in recovery mode (or umount your partition if you can) and look for it manually (if you remember some specific text from your script).

Some example:

diskutil list
sudo cat /dev/disk0s2 | strings | grep -C20 "my_stuff"
  • 2
    Used Wondershare and got some code back I "git clean -f"'d
    – fionbio
    Feb 2, 2016 at 3:21
  • 3
    As of 2019 the block device scanning trick is either impossible or more difficult to do on OSX now due to APFS encryption. I have successfully data that way on linux though :P Jul 2, 2019 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .