How to recover deleted files from a shared volume?

Question

Level 1

12 points

How to recover deleted files from a shared volume?

Setup - Mac Mini Server (OSX 10.8.4, Server 2.2.1(169)), 256GB Flash drive, System data only. External 8TB G-Raid holds all business data, backed up to a LaCie 6TB Quadra using Intego Backup Manager Pro 1.0.9. The G-Raid has two folders 0_Clients and DATA which are shared through OS X Server.

Situation, told customer backup drive (LaCie) was almost full mid April, purge data. They didn't and backups stopped running at end of April. Yesterday, they accidentally deleted a folder / with files. User was on an iMac, connected to the share DATA when deleted. Called in a panic of course. New folder and files were created after the last back was executed.

Question - Folder and files were deleted but Trash was not "emptied". Researching, I learned about hidden trash folders. So, I was hopeful I'd find the info in the hidden /.Trashes folder on the shared Volume G-Raid. My understanding is that that's where it would go, until an "empty trash" is executed. I've shown all hidden files / folders via "defaults write com.apple.finder AppleShowAllFiles TRUE". Navigated to the volume G-Raid/.Trashes and the folder/ files are not there. Is there another location where they may possibly be??? Or, are they hosed and it's really gone "Deleted"???

Thx

Mac mini, OS X Mountain Lion (10.8.4), Server 2.2.1 (169)

Posted on Dec 11, 2014 12:28 PM

Reply

Answer 1

Dec 12, 2014 4:34 AM in response to SRobo36

With a locally connected volume e.g. a hard disk or USB flash drive, when you delete a file it does get moved to the 'Trash' folder and until the Trash is emptied can still be retrieved. However with a network volume if a logged in user deletes a file or folder it normally gets deleted immediately. (The user would get a message saying "This item will be deleted immediately. You can’t undo this action.")

So the likelihood is that the items are not in any trash folder even if you found and looked in them.

It used to be the case that even when using a network file server you still had the benefit of files first going to the trash folder but Apple stopped doing this a long time ago. The network trash folder would be at the top level of the network share. (If it exists and works.) Some NAS devices might still support it but as I mentioned I don't believe Apple themselves do.

So you could try using Terminal.app to look for an invisible folder at the top-level folder of the network share, if the network share is a folder called 'Fred' then this invisible folder would be in 'Fred' and would be called "Network Trash Folder". You can try looking for this either on the server or from a logged in client.

Do ls -la in Terminal.app the 'a' flag means show all including invisible files.

As you have probably guessed by now it is almost certainly the case these files are lost and cannot be retrieved. The users unfortunately are guilty of multiple mistakes.

They ignored your warning about the backup drive
They deleted something they should not have
They ignored the warning the Mac would have shown about "This item will be deleted immediately. You can’t undo this action."

I would add an additional error that they and perhaps you as their advisor are guilty of. Never rely on a single level of backup, ideally you should have a rotating set of backups i.e. one for each day - Monday, Tuesday, etc. and even more importantly should store these off-site unless being used so that in the even of a fire, flood or other disaster you still have intact backups.

In theory ACL permissions can be set to allow reading, allow writing but disallow deleting. Unfortunately in the real world trying to use the disallow deleting option is a waste of time. This is because many programs 'save' changes by saving a new temporary file, deleting the original file, and renaming the temporary file to the original name. This will not work if you block deleting.

Reply

Answer 2

SRobo36 Author

Level 1

12 points

Dec 12, 2014 11:55 AM in response to John Lockwood

Thank you John. Yes, data is gone. Not in the /.Trashes on the root of the share, or anywhere else, no traces of it at all.

It's a small studio, with a small budget. I have from day one been pushing them to have off site backups for exactly the reasons you have mentioned. I pushed external drives locally for Time Machine BUs, they finally did that AFTER losing an iMac HD. I pushed an onsite back up, they finally agreed after another issue. They want to keep a long history of data / files. Already at 6TB+ and will look at moving to 20TB+ devices very soon, for room to grow. Data is doubling every 1 1/2 - 2 years, so they are growing. It's a good thing. This amount of data obviously adds challenges to rotating hard drives. Assessing off-site options. Some seem to learn the hard way despite words of wisdom.

Reply