Get back your deleted files on a Mac with Disk Drill

Accidentally deleting an important file from your hard disk only to realize that you have no other backup copies available is usually a frustrating experience even for the most experienced computer users. If you are unfortunate enough to find yourself in this scenario, the good news is that all is not lost as you can still try several recovery solutions to get your data back, whether you are using Windows, Mac or even Linux. In this post, I will describe my experience using Disk Drill, a relatively new data recovery software made by CleverFiles supporting Mac OS 10.5 and above, to recover deleted files on my USB thumb drive, and share some interesting findings.

Data recovery basics

As with most data recovery tasks, to stand the highest chance of success, do not perform any further file/folder operations on the affected drive. Most data recovery tools assume that only the file system entries for the affected files have been removed and will scan the file system for the sectors containing the actual data which hopefully have not been overwritten. As a result, any further disk activities on the affected drive may overwrite the actual data of the deleted files and remove any hope of a successful recovery.

The above can be easily achieved if your deleted files are on a portable drive, for example, a thumb drive – just stop using that drive except for the purpose of data recovery. However, if the deleted files are on the internal hard drive, it is best to create an image of the active disk partition, mount it in Disk Drill and attempt data recovery on this image instead, to minimize any further risks of data loss. To make the process more user friendly, I hope that Disk Drill could release a bootable CD image that users can use to boot up directly into recovery mode without having to worry about affecting existing drives.

Licensing types

Three types of licenses are available for the Mac version of Disk Drill: Basic, Pro and Enterprise. The Basic version, while free, only offers basic features such as recovery vault (more on that later), disk backup into DMG images and ability to preview which deleted files can be recovered from the drive. In order to perform actual recovery, users will need to purchase the Pro version ($89), which can be installed on up to three different machines, or the Enterprise version ($399) that can be installed on an unlimited number of machines.

The only distinguishing feature of the Enterprise version is the ability to export forensics disk data into CSV/SQLite for further analysis. While the exact type of exported data is not specified by CleverFiles and the sample data is not very helpful, my guess is that part of it is derived on the filesystem journal, available for NTFS/HFS as well as for ext3/ext4, which contains, in part, the list of filesystem activities and when they were performed on the drive.

If you are on Windows, you can download Disk Drill for free here. The rest of this article will be based on the Mac version of Disk Drill, activated using the Pro license key obtained from CleverFiles.

First glance

After successful installation and activation, you will be presented with the following screen, allowing you to configure some initial settings, show the introduction wizard, or launch Disk Drill in portable mode:

In my tests, launching in portable mode will still allow most data recovery operations, except for recovery vault and SMART monitoring, which is only possible once Disk Drill is installed to the local drive:

As can be seen, while not designed to be a disk monitoring tool, the SMART menu of Disk Drill provides useful information regarding your hard drive health.

This is the dashboard of Disk Drill, showing the disk drives on the system and their associated partitions:

By default, read-only media and empty drives are hidden. These can be changed in Preferences > Disk List.

Data recovery experiment

Now is the time for the moment of truth – testing Disk Drill data recovery capabilities! To do this, I connected a 2GB memory card taken from my daily phone to a USB 2.0 card reader and use it with Disk Drill to see what kinds of deleted files can be recovered. To begin the process, I clicked on the Recover button (highlighted in red in the above screenshot). After around 4 minutes, some deleted files were already identified and shown in the list of recoverable files:

The list also contains other entries, shown as Reconstructed Files:

The differences between Found Files and Reconstructed Files are explained here. Files listed as found are those which still contain their original metadata and can be recovered to their originally state with high confidence. Files that were shown as reconstructed are those which were identified using Disk Drill deep scan algorithm and may or may not contain useful data. In my case, readable files (music, documents, pictures, etc) are found in both sections and can be previewed by clicking on the ‘eye’ icon as well as restored by selecting the check boxes and click Recover. The recovered files are intact and can be opened without issues.

One comment I want to make is the speed of the scan – it takes around 45 minutes to scan my memory card. This is party due to the speed of the card (mine is a class 4 card which is only rated at 4 MB/s) and the overhead incurred when using a USB SD card reader. During my second experiment with Disk Drill, I tried on a new 1GB USB thumb drive and the scan took around 6 minutes, which is satisfactory.

Recovery vault

Disk Drill also offers recovery vault, which is effectively an additional storage mechanism for deleted files besides the standard trash bin provided by Mac OS. If enabled, files that are removed from the trash will be moved to the vault and can be recovered immediately if needed.

To enable recovery vault, click on the Protect button on the right of the target partition and you will see the following settings screen:

Take note that it may take a while to index the drive before the recovery vault feature becomes fully active. Once enabled, files that have been deleted and removed from Trash can be found immediately during a recovery session without the need for a deep scan:

I would therefore highly recommend enabling recovery vault if your drive has free space to spare in order to enjoy an additional layer of protection against accidental deletion besides the standard Mac OS system trash can.

Other features

Disk Drill also provides the ability to pause a data recovery session and resume it later, which can be useful for large storage media which may take some time for a complete scan. It also allows you to scan non-mountable disk images (from the File > Attach non-mountable images menu), which may be useful to scan disk images generated by other backup utilities. Due to time constraints, I will leave the task of exploring this feature to the next few articles.

The General tab of the Preferences screen of Disk Drill also provides an option to remove the application:

This feature is very much appreciated given that most Mac applications only focus on providing a simple installation experience and leaving the hard task of uninstalling to the user to find out, usually by resorting to hard-to-find command lines.

The verdict

Having spent a few days playing around with the application, I must say that Disk Drill for Mac is a well-designed, neat and feature-rich solution that provides a seamless recovery experience for most users without requiring any prior knowledge in data recovery. While Disk Drill and most other similar applications understandably cannot guarantee that you will get your data back with a hundred percent certainty, having it installed on your machine will definitely be useful, not just for data recovery but also for other useful features offered by Disk Drill such as SMART monitoring and DMG backup. I would therefore recommend downloading Disk Drill to try out for yourselves.

In my next few articles I will explore the Windows version of Disk Drill, which is free, as well as more communicated scenarios such as recovering from media with lost partition structures or from portable devices such as iPod. Stay tuned for more updates!

See also

Data recovery after using ‘dd’ on the wrong partition