Recall that in Windows systems, deleting actually just removes a file from the master file table (MFT) or file allocation table (FAT) and marks those clusters as available. The file’s data is still there and can be recovered. What happens when a file is deleted on an HFS or HFS+ volume? Although the details are a bit different, a similar thing occurs. The references to the file are gone and the clusters might be used and overwritten. But, depending on how soon after the deletion you attempt to recover data, you may be able to recover some or all of the data. Even if the data is overwritten, data may still exist in unallocated space and in index nodes. When a file is deleted in Macintosh, it is moved to the trash folder—much like the Recycle Bin in Windows. The trash is represented on the file system as a hidden folder, .Trash, on the root directory of the file system. You can list the contents with a shell command, as shown here:

$/.Trash ls -al
total 764
drwx------ 7 pc pc 306 Oct 30 15:05 .
drwxr-xr-x 30 pc pc 1054 Oct 30 12:44 ..
-rw------- 1 pc pc 6148 Oct 30 14:38 .DS_Store
-rw-r--r-- 1 pc pc 187500 Oct 27 15:41 Resume.pdf
-rw-r--r-- 1 pc pc 108382 Oct 27 15:43 VacationPIC.jpg
-rw-r--r-- 1 pc pc 108382 Oct 27 15:43 Report.pdf

Now files in the trash directory can be recovered just by copying or moving them to any other location.

Note that the trash (.Trash folder) contains four files, each of which can be recovered by simply copying or moving it to an alternate location. There are tools that will recover files, even after the trash bin has been emptied. A few are given here:

• Mac Undelete at http://www.macundelete.com

• Free Undelete Mac at http://www.freeundeletemac.com

• MacKeeper at http://mackeeper.zeobit.com

Any of these tools can aid you in recovering deleted Macintosh files.