Recovering Deleted Files

Recently, I had one particular file that I’d been working on that got corrupted somehow. Unfortunately, I’d let my Time Machine backup lapse somewhat and so I didn’t have a backup.

Anyway, the file wasn’t very big but it would have taken me a little while to write it again so I tried another way of getting the file back. I knew that Xcode uses atomic saves (it writes a new file and then uses a rename) so I figured, so long as I don’t write too much to the disk, there should be an old copy somewhere on the disk. Searching the entire disk would have been tedious though, so I wrote a quick program that creates a file on a volume that uses up all the free space. If you do this by conventional means, you’ll end up with a file full of zeros, but thankfully, OS X comes with the F_SETSIZE fcntl which allows you to set the size of a file without setting the contents. Here’s the code:

#include <fcntl.h>
#include <string.h>
#include <errno.h>
#include <stdio.h>
#include <stdint.h>
#include <err.h>

int main (int argc, char *argv[])
{
  int fd = open (argv[1], O_CREAT | O_RDWR, 0666);

  uint64_t size = 4096;

  for (;;) {
    if (fcntl (fd, F_SETSIZE, &size)) {
      if (errno == ENOSPC)
        break;
      else
        err (1, "fcntl failed\n");
    }
    size *= 2;
  }

  uint64_t high = size;
  uint64_t low = size / 2;

  while (high > low + 1) {
    size = low + (high - low) / 2;
    if (fcntl (fd, F_SETSIZE, &size)) {
      if (errno != ENOSPC)
        err (1, "fcntl failed");
      high = size;
    } else
      low = size;
  }

  printf ("done: %llu\n", size);

  return 0;
}

Obviously, you want to run this whilst booted from another volume and you have to run it as root.

So then it was a simple case of firing up HexFiend which I happen to know has pretty fast search and I managed to find my file.