.Create a data recovery/undelete external boot drive
Hello and welcome to my User Tip
I will explain how to make a data recovery drive.
The need for a data recovery drive are as follows:
1: If your OS X boot drive or partition is not booting due to "full disk" or software reasons, not because of failed hardware.
2: You have accidentally deleted files or reformatted a drive and realized your mistake and don't have a recent backup.
3: You need to remove data before taking a machine in for service.
4: You don't have another or compatible Mac and a FireWire cable and/or adapter to use Target Disk Mode instead.
https://support.apple.com/kb/ht1661
5: You don't have hold option key bootable clone (TimeMachine can't be used to recover files)
6: Your TimeMachine drive is hosed, won't restore, migrates fail, etc., and you need to get files off and out of it's death clutches.
Most commonly used backup methods
7: Your internal boot drive is in the process of failing and you need to run the computer off a external drive.
What this User Tip can't help you with:
1: If your OS X boot drive is Filevaulted, as it's one big encrypted image. Not that it might be possible to copy it to another drive, more that I don't know how to go about it and it doesn't make much sense for most to even bother enabling Filevault.
2: If the drive appears not to be working or accessing correctly, you might have to remove the drive from the machine or send it to professional recovery services.
My computer is not working, is my personal data lost?
"Help! I've just deleted data by accident!!"
STOP using the computer as soon as possible, because computers write to the internal drive all the time. So you can't download software or do anything from OS X on that drive/ partition until you have created a data recovery external drive first to run the computer off of.
If you can't understand the steps further on, can't buy a new external drive and/or $100 for third party recovery software, then your going to need the services of a local PC/Mac data recovery/computer service, any of them should be more than competent enough to passively image your drive and hand it to you for digging through the mess to find your files.
If some time has passed, or you overwrote the drive with a lot of new data, your too late and your chances are slim to none.
If you used "Secure Empty Trash" or Disk Utility > Zero Erase or Zero Free Space (or 7x-35x erase), your files cannot be recovered. If you have Filevault or encrypted files, most likely in nearly all cases they can't be recovered.
"My boot drive refuses to boot because it's full"
Make the external boot drive as outlined below, then use that to access your Users folders and target something with a lot of large files to copy to the external drive and then remove from the boot drive so it will be able to boot again. OS X needs a about a minimal of 10% free disk space for swap and other temp files, so you can't fill the boot drive completly.
Grand Perspective is a nice free program to show you what is taking up what space, you should only target your users files, not system or other ones.
10.8+ users, set Apple menu > System Preferences > Security > General > downloads to "Anywhere" to accept software from outside Apple sources or right or control click on the program and select "Open"
http://grandperspectiv.sourceforge.net/
"My computer refuses to boot up, (like in gray screen issues), what to do to grab my files off?"
What your going to need
A blank powered external hard drive (not port powered) USB or FireWire preferred, don't go too much larger than the drive your attempting to recover from.
10.6 or earlier - a copy of your machine specific OS X install disks or upgrade disks matching the OS X version on the machine.
10.7 or later - a working Recovery HD partition, which is located on the same boot drive as the one your attempting to recover data from
or Internet Recovery on newer Mac's + a fast reliable Internet connection
or Recovery HD on a USB thumb drive if yours is not working, phone a Lion Mac friend with Admin access.
How to create a hold option key bootable Recovery USB thumb drive
https://support.apple.com/kb/dl1433
10.7 or later also needs a fast, reliable Internet connection, a AppleID and password to install OS X from Apple's servers.
Also needed for recovering deleted files, drives that were reformatted, messed up file structures etc.
DataRescue or some other similar "undelete" Mac type software that can read the 1's and 0's of deleted (but not overwritten, encrypted or "scrubbed") files off a drive. This type of software is usually expensive (about $100) because of the necessity of reconstructing all the different types of file formats etc.
You install this later when you boot from the data recovery drive and onto the data recovery drive (not on the drive your recovering data from!)
If the internal boot drives data exceeds the external data recovery's boot drive's capacity, get another external drive that matches or exceeds it, because Data Rescue type software recovers everything salvageable and you need a place to put it all to pick through the mess.
If you completely fill up the external drive then you won't be able to boot from it. OS X boot drives need about 15% free space.
What your going to do
Erase and format the external drive:
Connect the drive to the machine and power it up.
10.6 or earlier - hold c (or option/alt key) on a wired/integrated keyboard and boot off the OS X install disk, under the Utilities menu is Disk Utility.
If your on 10.7 or later, you should use RecoveryHD first as it uses the OS X version on the machine.
If RecoveryHD is not working then use Internet Recovery (connect via Ethernet cable if possible) but it uses the OS X version that originally came with the machine or 10.7 earliest.
If your machine is not capable of Internet Recovery, then you need to use the 10.6 install disks.
If you don't have a copy of the 10.6 disks, then call Apple for the correct copies as the 10.6.3 retail disks online don't work for everyone.
If you install a older OS X version of the operating system on the external drive, once you boot from it you will need to upgrade via AppStore to match the version on the internal drive by holding option and clicking on Purchases and running the upgrade installer.
10.7 or later - hold command(⌘) r (or command r option/alt keys for Internet Recovery, or option/alt key for Recovery USB) on a wired/integrated keyboard and boot into Recovery.
Select Disk Utility and choose the external drive on the left which will have the drive makers name and size, select Erase> Security Option: Zero All Data (one option below maximum secure erase in Disk Utility 10.7) and click ok. This will take some time let it complete, if it fails the hard drive is bad and take it back for a exchange. For SSD's Disk Utility doesn't give a secure erase option, it's just erase.
Check under the Partition Tab that Partiton Layout is 1, click the box, Options: is GUID and Format: is OS X Extended Journaled or else make it that.
.Drives, partitions, formatting w/Mac's + PC's
Install OS X:
Connect the drive to the machine and power it up.
10.6 or earlier - quit Disk Utility and use the installer for OS X.
10.7 or later - quit Disk Utility, connect to the Internet, use the OS X installer, your AppleID and password and install OS X onto the external drive.
Erase, formatting, OS X installs on Mac's
How to erase and install Snow Leopard 10.6
Reboot and hold option/alt key down (wired or built in keyboard)
Select the external drive to boot from
Enjoy the setup video, use your same user name as on the internal drive.
Enter your network info and Software Update fully, repeat until clear.
At this point if your on a later OS X version on your internal drive, you need to upgrade to the same on the external drive via AppStore.
Try to recover and/or erase files off the internal boot drive using manual drag and drop copy methods on the users folders of Music, Pictures, Documents, etc.
Do not copy Users/Library, start off with a fresh new one. In fact in 10.7+ Apple has hidden it intentionally as it can be problematic and complicated.
You might have to select the internal drive icon and Finder > Get Info and at the bottom "Ignore Permissions on this volume"
Also you can copy and paste the locked Users folders to the external drive, using your Admin password.
You may need to change user permissions on all transfered files in your user account on the new external drive see #6 here
..Step by Step to fix your Mac
Also if your doing this to remove files off a too full boot drive, don't forget to Finder > Empty Trash as your trying to free up space and the files in the Trash are taking up the same amount of space.
If your going to erase everything and reinstall on the internal drive:
Create other user accounts matching the ones on the internal drive if necessary and log into those and place their data in those same named users.
Act like your rebuilding your boot drive exactly as the internal drive, even install your third party applications because later if your boot drive is replaced you can use Carbon Copy Cloner to easily clone your new external boot drive back to the new/erased internal drive. 😉
Most commonly used backup methods
For recovery of deleted data or hosed TimeMachine drives
Install the data rescue type software and run it against the target drive, with the output going to another external drive (preferred as it's quite a lot of data recovered)
Enjoy the pain picking through the mess. Especially recovered TM data as a lot of the files have the same name, just no data.