Help in recovering deleted files - MacOS, used Terminal deletion commands

Recovering Deleted Files on macOS After Terminal Deletion

There may still be a way to recover the files. 

Since they were deleted using Terminal and do not appear in the Trash, the first step should be to avoid making further changes to the Mac's internal storage.

In particular, do not erase the disk or reinstall macOS until we know what happened.

You mentioned that, after restarting, the Mac displayed the macOS setup process. 

That fact alone does not establish whether the deleted files are still present or whether the disk was erased. The exact Terminal command you used is therefore very important.

Apple's macOS Recovery provides access to Disk Utility and Terminal, as well as options for restoring from a Time Machine backup. Apple: Use macOS Recovery on a Mac with Apple silicon

If you have a Time Machine backup, Apple provides procedures for restoring your files from that backup, including restoring your user account and personal files. Apple: Restore your Mac from a backup (Apple Support)

For now, the safest next step is to start macOS Recovery and inspect the available storage without erasing anything. 

Apple explains how to start Recovery on both Apple-silicon and Intel Macs here: Apple: How to start up from macOS Recovery(Apple Support)

Once in Recovery, do not select any option to erase the disk. Terminal is available from the Recovery environment. We can use it to inspect the storage with commands such as:

diskutil list

and:

diskutil apfs list

These commands will help determine what disks, volumes, and APFS containers are currently visible. 

At this stage, we should avoid commands that modify the storage.

The most useful information you can provide next is the exact Terminal command you used, even if you only remember part of it. 

Also tell me whether the Mac is still at the initial setup screen and whether you have a Time Machine backup.

With that information, we can determine the next step without making assumptions about what happened to the files.

I’d avoid using the Mac any more than necessary until you know what was deleted. Don’t reinstall macOS, erase the disk, or create a lot of new files yet.

If you used an `rm` command in Terminal, those files normally don’t go to the Trash. Your best recovery options are a Time Machine backup or, if Desktop/Documents were stored in iCloud Drive, checking iCloud.com for recently deleted files. Apple allows deleted iCloud Drive files to be recovered for up to 30 days unless they were permanently removed.

The fact that the Mac restarted into Setup Assistant is important. That suggests more than a few documents may have been deleted, possibly including your user account/home folder data.

Do you remember the exact Terminal command you entered? If you can post it here, that would help determine what was actually removed before you try anything else.

Apple’s iCloud recovery instructions: Recover deleted files on iCloud.com - Apple Support

sabari196 wrote:

Accidentally deleted the home folders and files using Terminal command. Unfortunately, I thought I had duplicated this home folder to another folder, but I hadn't.

What do you mean by "home folder"?

"Home folder" to me & most regular contributors is the folder with your macOS user account name(s). In the Finder this "Home folder" will have an icon of a house on the Finder's sidebar. This "Home folder" is located at "/Users".

If you ended up deleting this "Home folder, then you will need to restore it from a backup.

Is there a way to recover files from this hard deletion? Does not exist in the trash.

If the storage device is an SSD, then the only way to recover those items is by restoring them from a backup made prior to their deletion. As @PreCognition mentions, when using the Terminal command line any deletions are instantaneous. There are no safety nets when using the command line. The Finder provides those safety nets by moving items you delete to the Trash providing you with time to reconsider things (even with the Finder it is possible to bypass that safety net and have files deleted immediately).

If the storage device is a Hard Drive, then you must immediately stop using that drive so you run a third party data recovery program to attempt to recover the deleted files. Many times in these data recovery attempts you may lose the file names & folder structures and may need to sift through millions of files. Restoring from a backup is much easier & more reliable.

Not sure what happened; I could not use the Mac or run any apps. Restarted the Mac to see that it was a fresh start with setting up Apple account and so on. I am confused and thus unable to be clear about what happened.

Certainly sounds like you will need to start over fresh by properly erasing this system if it no longer is able to boot normally. How this is done depends on the exact model, but here is an Apple article with instructions covering both methods:

Erase your Mac and reset it to factory settings - Apple Support

Before erasing the system though, it is important to know whether you have any backups, plus the exact model of the Mac and version of macOS involved. It is also important to know if you had more than one macOS user account on this system and whether these items were deleted from an SSD or Hard Drive. You can get the exact model by using the Apple check coverage page.

If you can boot into Recovery Mode, then you can try to verify if any of the Home user folders remain and perhaps use the command line to transfer the remaining data if you have no backups.

Continued....

Any idea what I have done and what this could be? How to potentially recover the files?

Unfortunately you learned the hard way that the Terminal command line has no safety nets. Many people, even those with years of command line experience, have made catastrophic mistakes when using the command line with something as simple as a typographical error of a single character. Sometimes it is simple enough to undo some changes, but with other changes it is not so easy, and with some such as using the "rm" command it is impossible.

The only way to recover those files is by restoring them from a backup. If you have no backups, then maybe you copied a file to another location at one time, or sent the file to someone else. If you were using a cloud file syncing service, then those deletions would have affected all of the other devices syncing those files, but some file syncing services such as iCloud may allow you to recover them within 30 days.

If the storage device was a Hard Drive, then it may be possible to recover the deleted items either with a data recovery app, or by a professional data recovery service. However, many times you will lose the file/folder names & folder structures and will need to sift through millions of files.

People should always have frequent & regular backups of their computer and all external media (including the cloud) which contains important & unique data. There are a lot more new ways to permanently lose access to the data stored on the internal SSD of the recent Macs due to all of the hardware, software, and security changes. Apple provides the Time Machine app to make backups easy for people, but there are also third party options as well.

As for using the Terminal command line, people need to be very careful. Many commands found online may only apply to a very specific circumstance and would need to be properly modified for someone else's situation. If the command is correct for a particular situation.....if even a single character is mistyped, then it could have devastating consequences. It is important that a person actually understands what the command does and what each option of that command does. For people wanting to learn & use the command line it is best to do so on a spare computer or within a Virtual Machine so any mistakes won't affect your main system & user data. I actually will end up copying data & practicing on that data before taking the plunge on modifying the real data I want to change.

What has already been said about the perils of using the command line in Terminal.

The Terminal exposes the underlying UNIX operating system. When you use the rm or recursive (rm -rf) syntax, the filesytem target of that command is removed and the storage previously used is now marked available by the operating system for dynamic storage reclamation. That might happen within 5 minutes or longer duration depending on the storage allocation demands, but the likelyhood of recovery is virtually none. Certainly not from the Terminal, and the cost/results of proper recovery software may make it untenable to pursue.

Using macOS without a backup strategy is also asking for it in the neck, and I would strongly recommend that you start that as soon as you make the appropriate operating system adjustments.

Back up your Mac with Time Machine - Apple Support

Owl-53 wrote:

Recovering Deleted Files on macOS After Terminal Deletion

There may still be a way to recover the files. 

Since they were deleted using Terminal and do not appear in the Trash, the first step should be to avoid making further changes to the Mac's internal storage.

This data remanence path is applicable only to HDDs. With SSD storage, this path is not available. This because the SSD storage is erased on deletion, effectively immediately.

To the OP: With no manual backups and no automatic backups with Time Machine or other tools, these files are gone. Permanently. UNIX commands delete immediately. With no recourse.

If I’m testing paths and syntax, I’ll add the -i (interactive) switch to the rm command, which will cause it to prompt for permission to delete each file. Before deleting.

Most of us do get to learn the necessity of backups for our important data, too. Some of us by watching others lose their data. Many of us learn this lesson by losing our own data. In my own case, it took a couple of losses.

HWTech wrote:

Many people, even those with years of command line experience, have made catastrophic mistakes when using the command line with something as simple as a typographical error of a single character. Sometimes it is simple enough to undo some changes, but with other changes it is not so easy, and with some such as using the "rm" command it is impossible.

E.g. , someone wants to get rid of a bunch of files whose names start with temp, and types

    rm -f temp *

(note space between 'temp' and '*'), only to be greeted with

    rm: temp not found

and the loss of all of the files in the current directory.