How to Use Terminal to Recover Deleted Files on Mac

Updated on:
AuthorDavid Morelo
Fact Checked ByRoman Kropachek
Roman KropachekEditor and Tech ApproverWith over two decades of experience in IT and marketing, Roman Kropachek is an essential figure in content verification at Macgasm and an invaluable asset to the editorial team. As an editor and tech approver, Roman is responsible for reviewing and fact-checking articles before publication. His commitment to accuracy and detail guarantees that all content meets the high standards of trustworthiness Macgasm's readers have come to expect over the years.
Why Trust Us

At Macgasm, we’re dedicated to bringing you insightful Apple-centric content that adheres to our comprehensive editorial guidelines whose purpose is to maintain the utmost accuracy, relevance, and impartiality in everything we publish. This commitment to preserving the integrity of our content is shared across our team, from expert writers to seasoned editors.

Recover Deleted Files with Mac Terminal

Thanks to its Unix-based core, Mac provides multiple ways to accomplish most common tasks, including recovering deleted files, which can be done using Finder or Mac Terminal commands. This article focuses on the latter method and describes everything you need to know about Mac Terminal when it comes to data recovery.

How Does Terminal Work?

You can think of Terminal as the gateway to the Unix underbelly of Mac computers. It provides a command line interface to the operating system, allowing you to interact with your computer by typing commands on your keyboard, instead of using your mouse to interact with the regular graphical interface.

Most regular users never use Terminal because Mac’s graphical user interface is good enough for most computing needs.

However, there are some hidden settings that can be accessed only via the command line. Additionally, certain operations can be executed far more efficiently (or even completely automated) with a few simple commands than a series of mouse clicks.

If you’ve never used Terminal on Mac before, it’s completely natural to feel somewhat intimidated by it, but there’s really nothing to be afraid of. All you need to do is follow our instructions on how to use the undelete command to recover deleted files using Mac Terminal.

How to Recover Deleted Files Using Mac Terminal?

When you delete a file on a Mac, the file is either moved to Trash or permanently deleted. In this section, we explain how you can recover both files that are in Trash and files that are permanently deleted using Mac Terminal.

Recover Files from Trash Using Mac Terminal

Recovering files from Trash via the command line is easy because Trash is really just a special folder from which you can copy any file with a simple command.

Step 1:Open the Security & Privacy Preferences pane of System Preferences and select the Privacy tab.

Step 2:Unlock the interface by clicking the lock icon, choose Full Disk Access from the list of services on the left, and drag and drop the icon for Terminal into the list.

Full Disk Access

Step 3:Launch Terminal.

Step 4:Type cd .Trash and hit Enter to navigate to the Trash folder.

Step 5:Type ls -al ~/.Trash and hit Enter to view the content of the Trash folder.

View the Content of the Trash Folder

Step 6:Type mv filename ../ and hit Enter to move a specific file to your home folder (replace filename with the name of the file you want to recover).

Step 7:Type Quit and hit Enter to close Terminal.

Recover Files Deleted with “rm” Command

The rm command can be used to delete any file directly from Terminal. Because files deleted using the rm command don’t go to the Trash folder, you can’t recover them using the above-described method.

You can, however, recover them using a data recovery application for Mac like PhotoRec, which runs in Terminal and can be installed using Homebrew.

Notice: If you want to scan your internal system drive (the drive where macOS is installed), you need to complete the following steps before you can use a data recovery application:

  1. Reboot the Mac and hold down Command + R keys simultaneously to boot into Recovery mode.
  2. Open the Utilities menu at the top of the screen and choose Terminal.
  3. Type csrutil disable and press Enter to disable System Integrity Protection.
  4. Restart your Mac.
  5. Launch Terminal.

Keep in mind that disabling System Integrity Protection comes with certain risks since it helps protect your Mac from malicious software.

 

Step 1:Install Homebrew by pasting the following command in Terminal:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

Step 2:Type brew install testdisk and hit Enter to install TestDisk (PhotoRec is included in the TestDisk package).

Step 3:Type sudo photorec and hit Enter to launch PhotoRec.

Launch PhotoRec

Step 4:Select your hard drive.

Select your hard drive

Step 5:Select your partition. Choose the No partition option to scan the whole drive.

Select your hard drive

Step 6:Select the right file system and press Enter. PhotoRec will automatically suggest what it believes to be the right option.

Select the file system

Step 7:Select a destination to save the recovered files to and press C on your keyboard when done.

Select a destination for recovered files

If you find PhotoRec too difficult to use, and you just want to get your permanently deleted files back as quickly and painlessly as possible, you can recover them with Disk Drill, and easy-to-use data recovery application with a modern graphical user interface and support for hundreds of file formats.To recover permanently deleted files with Disk Drill:

  1. Download and install Disk Drill.Disk Drill 4 for Mac Install
  2. Click the Recover button next to the drive on which your files were stored prior to deletion.start scan with disk drill
  3. Select the files you want to recover, specify the recovery directory, and click the Next button.select files to recover

That’s how simple data recovery is with Disk Drill.

Recover Files from a Time Machine Backup

You can actually recover deleted files from a Time Machine backup without using the graphical interface, which may come in handy in situations when you can’t use your touchpad or mouse or interact with the graphical user interface for some other reason.

Step 1:Use the Privacy tab in the Security and Privacy preference pane to add Terminal to the list of applications with Full Disk Access like we explained in the first solution.

Step 2:Launch Terminal.

Step 3:Type tmutil listbackups to list all available Time Machine backups.

List of Available Time Machine Backups

Step 4:Type

tmutil restore '$BACKUP_PATH/$ORIGINAL_PATH' '$DESTINATION'

to restore your file.

  • $BACKUP_PATH = the location of your Time Machine backup.
  • $ORIGINAL_PATH = the location of the deleted file.
  • $DESTINATION = the place where you want to recover the deleted file.

Conclusion

As you can see, it’s possible to recover deleted files using Mac Terminal but only in certain situations. Because undeleting files from Terminal is far from easy, regular Mac users should first try a data recovery application with a graphical user interface and experiment with undelete commands only if it doesn’t work.

FAQ:

Terminal is just another app on Mac computers which means that you can launch it like any other app:

  1. Open Finder, go to /Applications/Utilities, double-click Terminal.
  2. Press Command-Space to open Spotlight, type “terminal”, and hit Enter.
  3. Invoke Launchpad (from the Dock or by pressing F4), type “terminal”, click Terminal.
It means that the command you typed was not recognized as a valid command. This error can occur due to a variety of reasons, such as incorrect spelling, wrong syntax, or the command is not installed on the system.

To recover a delted folder using the Terminal on a Mac, follow these steps:

  1. Open Terminal
  2. Navigate to the Trash using the cd command: cd ~/.Trash
  3. If you want to see the contents of your Trash use the ls command to do that: ls -l
  4. Once you’ve identified the folder you want to recover, use the mv command to move itfrom trash: mv DeletedFolder ~/Documents/ – this command will move whole DeletedFolder folder to the Documents
David Morelo
Author
David Morelo is a seasoned technology writer with a decade of professional experience and a Bachelor's degree in English Linguistics. He also holds a Google Cybersecurity Certificate. At Macgasm, he mainly writes product reviews and in-depth guides, with a focus… Full Bio
Related Articles