There are two main options if you need to recover deleted files with Mac Terminal. The first situation involves recovering files that have been removed and put in the trash, usually from one of your desktop applications or from Finder. For this, we just go into the .Trash directory and move the files to a recovery location.
The second situation is when files have been removed using the rm command or removed without moving them to the Trash. For this, you will need to have a backup in place, and you can extract the files from the backup using Time Machine commands from Mac Terminal.
tmutil restore ‘<BackupPath>/<OriginalFilePath>’ <Destination>
My name is Eric, and I have worked with computers and software since the early 1980s. I have accidentally deleted my share of files over the years, and luckily there are ways to recover files in most situations. I can show you some tricks in Mac Terminal to quickly get files back.
If you want to see the two methods I have described above, then keep reading below. I will also give you a third way to recover deleted files that can take place in Mac Terminal or from your Mac’s desktop.
Contents
Recovering Deleted Files from the Trash
When you delete files from your desktop using Finder, you usually move them to the Trash. In this case, recovering them using Mac Terminal is fairly simple. The one thing that you will need to do first is to make sure that the Terminal application has full disk access.
You need full disk access to navigate to and look at the files in the .Trash folder, which is where all files moved to the Trash are stored. Follow the steps below to ensure that the Terminal application has full disk access.
Provide Full Disk Access to Terminal
Step 1: Close your Terminal application.
Make sure all instances of Terminal are closed. You must start a new instance once you change the setting.
Step 2: Open your Mac’s System Settings on the desktop.
Click on the Apple symbol in the upper left corner of the screen and select System Settings.
Step 3: Select Privacy & Security and then Full Disk Access.
In the pane on the left side of the System Settings window, click on Privacy & Security and then click on Full Disk Access in the main window.
Step 4: Turn on Full Disk Access for Terminal.
Click on the switch to turn on Full Disk Access for the Terminal Application.
Once the Terminal application has full disk access, you will now be able to access the .Trash directory. You can use the following steps to create a temporary directory for the recovered files and then move the files you want to recover from the .Trash directory to the temporary directory.
Move Files out of the Trash
Step 1: Start Terminal.
Use your preferred method to start up the Terminal application.
Step 2: Create a temporary directory.
This step is unnecessary if you already have a specific place to which you want to move the recovered file. I like to create a temporary holding location, so I can move the file there immediately and then decide what I need to do with it later.
For this example, I will create a temporary directory called recovered.
mkdir ~/recovered
Step 3: Navigate to the .Trash directory.
Now you can move into the .Trash directory where your file should be.
cd ~/.Trash
Step 4: List the .Trash directory to look for your file.
Use the ls -la command to list the contents of the .Trash directory and find your file. For our example below, I am looking for a file called test.txt.
ls -la
Step 5: Move your file from the .Trash directory to the temporary directory.
In our example, the temporary directory is called recovered and the file we are looking for is called test.txt. We will use the mv command with a format as shown below.
mv <FileToRecover> <Destination>
So, the command for our example will look like the following.
mv test.txt ~/recovered
Step 6: Verify the recovered file.
Navigate to the temporary directory and look at the file to ensure it is still good. You can use whatever tools are necessary to check the file. In the case of our example, the recovered file is a plain text file, so I may just want to check its contents and see if they are there.
Use the cd command to move to the temporary directory.
cd ~/recovered
To test a text file, I will simply use the cat command to display its contents. You can use whatever tool you need to verify the file is still good.
cat test.txt
Step 7: Move the file to its final destination.
Now you have the file recovered and have tested that it is valid. You can move or copy the file to wherever you want it to go for whatever you want to do with it. You can do so now if you want to copy it back to its original destination.
Recovering Files That Are Not in the Trash
If you have removed files in Terminal using the rm command, permanently removed files using another application, or emptied your Trash, then you cannot recover files using the method shown in the previous section.
In this case, you may be able to recover a deleted file using Time Machine if you have Time Machine backups set up and running and there has been a backup run that included the file you are trying to recover.
To use this method, you must ensure that the Terminal application has full disk access, just as we did in the previous procedure. If you haven’t already, adjust your settings using the method shown in steps 1 through 4 in the first section.
Use the following steps to recover files in Mac Terminal using Time Machine from the command line.
Step 1: Ensure the Terminal Application has full disk access.
Use steps 1 through 4 in ( Provide Full Disk Access to Terminal ) the previous section, to do this.
Step 2: Start Terminal.
Use your preferred method to start up the Terminal application.
Step 3: Create a temporary directory.
This step is unnecessary if you already have a specific place to which you want to move the recovered file. I like to create a temporary holding location so I can move the file there immediately and then decide what I need to do with it later.
For this example, I will create a temporary directory called recovered.
mkdir ~/recovered
Step 4: List available Time Machine backups.
To do this you will use the tmutil command with the listbackups parameter. This will give you a list of available backups, and you can choose the one that might have your file. You will need to know the time frame of when the file was deleted and choose one that was done before.
tmutil listbackups
In the image above, I only have 1 backup available, so that is the one I will use. You will likely have multiple backups to choose from.
Step 5: Restore the file.
Now you will use the tmutil command along with the restore parameter to restore the file. You will need to know the original path and file name of the file you wish to restore, and you will place it in the command at the end of the path of the backup file you select from the previous step.
tmutil restore ‘<BackupPath>/<OriginalFilePath>’ <Destination>
For example, I am looking to restore a file called 20210305_095002 copy.jpg. I know the original path was /Data/Users/ericwinkler/Downloads/ and I have a backup /Volumes/.timemachine/6E529B48-0C29-4661-BF30-6DD0AA13626A/2022-02-11-084340.backup/2022-02-11-084340.backup that included that file.
I will use the following command (which is all one line) to restore the file to my temporary directory.
tmutil restore ‘/Volumes/.timemachine/6E529B48-0C29-4661-BF30-6DD0AA13626A/2022-02-11-084340.backup/2022-02-11-084340.backup/Data/Users/ericwinkler/Downloads/20210305_095002 copy.jpg’ ~/recovered
Notice the quotation marks around the <BackupPath>/<OriginalFilePath> parameter. These are needed when the path or file name has a space. Without quotation marks, you would see an error when running the command if any part of the path or file name has spaces in it.
Step 6: Verify the file was recovered.
If you’re not already there, navigate to the temporary directory and check to see if the file is there. If so, use whatever application or tool needed to verify the file is good and not corrupted.
For the recovered JPEG file I have above, I would use finder to navigate to the recovered folder and then double-click on the file to see if it opens up as an image file.
Step 7: Move or copy the recovered file to its destination.
Now that you have recovered the file and verified it, you may want to move or copy it to its original location or a location where you will use it. Use the mv command to move the file or the cp command to copy it.
Using Data Recovery Tools
If your files are not in the Trash and you don’t have a backup of them, it can be more difficult to recover them. In this case, you might require a third-party tool to do this. Many are out there, and you can find them with a Google search or in the App Store.
Many of these tools will cost money, but some are free. Most of them are tools that have a graphical user interface that you use from your desktop. This is the way to go for many, but if you still prefer to work from Terminal, there are a few command line tools out there that you can use from Terminal.
PhotoRec is one such tool. It is part of the TestDisk package and can be downloaded and installed for free using HomeBrew. There are others out there, and you can research them further if you want.
FAQs
Recovering deleted files using Mac Terminal is a great skill to learn, but it raises many questions. Below are some that are frequently asked when using some of the methods above.
What if I get a message indicating I don’t have permission to recover the file?
This can often happen when trying to recover files; it all depends on the original permissions of the files you are trying to recover. You can, most of the time, solve the problem by placing the sudo command in front of whichever command you use. You will be prompted to enter your password using the sudo command.
sudo tmutil restore ‘<BackupPath>/<OriginalFilePath>’ <Destination>
Is it safe to leave the full disk access setting on for Terminal?
The restriction of disk access by certain applications is a security feature implemented by Apple. Usually, it is safe to leave full disk access enabled, but if you are uncomfortable with it, you can certainly turn full disk access off once you have completed your tasks.
What if the tmutil command gives me a file not found error?
Unfortunately, this usually means that the file you are looking for is not contained in the backup you are trying to recover from. With this being said, it could just be that you have typed the path or file name incorrectly in the command. Make sure to go back and verify you have the path and file name typed exactly as they should be. Otherwise, tmutil will not be able to find the file.
Conclusion
Recovering deleted files is something most of us will need to do at one time or another. While there are ways to do this from your desktop, many of us who prefer to do things using Mac Terminal also have a way to recover files from the command line.
Moving files out of the .Trash folder is an easy way to recover them from the Trash, and using the tmutil command is a way to recover files from a Time Machine backup. If neither of these methods applies to your situation, you will definitely want to look into a third-party recovery tool.
I hope the information above can help you to recover your files. As usual, let me know if you have any questions or feedback. I would love to hear from you.
