When a file gets overwritten on a Mac, it means that new data has been written over an existing file, completely replacing the original contents. This commonly happens by accident when saving changes to a file without realizing the original will be erased. For example, if you open an existing document, edit it, and then save the changes using the same file name, the original version will be overwritten by the edited one. The previous contents are wiped out and no longer accessible through normal means. While unsettling when important files are overwritten, there are ways to try recovering the lost data on a Mac.
File Saving in Mac OS
The Mac operating system uses a file system called HFS+ (Hierarchical File System Plus) to organize and store files on a drive. When you save a file, the file system assigns it a unique identification number called an inode. This inode points to the actual data blocks on the drive where the file contents are stored. The file system also maintains a file allocation table that keeps track of which data blocks are allocated to which files.
In addition to the inode and data blocks, each file has a file path that describes its location in the file system hierarchy. For example, a file stored in the Documents folder of your Home directory would have a path like /Users/yourname/Documents/filename. The path describes the sequence of folders leading to the file.
When you overwrite an existing file in Mac OS, the inode for that file is updated to point to newly allocated data blocks that will contain the new file contents. The old data blocks are marked as free space and may be overwritten in the future. So while the original file contents are deleted, the raw data blocks may still exist on the drive until they are recycled and rewritten.
The Mac file system keeps track of all of this behind the scenes, so users simply see files as objects that live in folders. But the inode and data block system is how the OS is actually able to keep track of files and allocate disk space.
File Overwriting
When an existing file is overwritten with new data, the old data is not actually deleted from the storage device. Instead, the operating system marks the space occupied by the old file as available for new data to be written. The new data is then written over the old data at the bit level on the storage device.
For example, let’s say you have a text file called notes.txt on your Mac. This file takes up 500 bytes of space on your hard drive. If you then open notes.txt in a text editor and write new text over the existing contents and save the changes, the new text will be written over the old text in that 500 byte space on the drive. The old text is not moved or erased, it is simply overwritten with the new data you entered.
At the lowest level, a hard drive is made up of platters coated in magnetic material that store bits – 1s and 0s – by changing the polarity of the magnetism. When a file is overwritten, the magnetic bits flip to store the new data. So the old data is technically still there magnetically, it just can’t be read anymore because the magnetic polarity has been changed.
The important takeaway is that overwriting a file does not delete the old data, it simply allows new data to be written over the old. The old data remains intact but inaccessible until it is overwritten.
File Recovery
When a file is overwritten on a Mac, the original contents are not actually erased from the storage drive immediately. The space containing the old data is simply marked as available for new data to be written over it. This means that overwritten files can potentially be recovered, at least for a certain window of time, using data recovery software.
Data recovery programs like Disk Drill can scan a Mac’s hard drive and find files that have been recently overwritten. They do this by looking for traces of the original file data that may still reside in the free space where the new data was written. The sooner data recovery is attempted after overwriting a file, the greater the chances of recovering it fully. After too much new data is written, overwritten file fragments will begin to be permanently destroyed.
Data recovery techniques like file carving can piece together an overwritten document if enough of the original binary data remains intact. However, highly fragmented overwritten files may only be partially recoverable. The free space on a drive also plays a role. The morespace available, the longer an overwritten file can potentially be retrieved before new writes wipe it out for good.
While data recovery software provides the best DIY overwritten file recovery option for average Mac users, a professional data recovery service may have more advanced tools to work with heavily overwritten or corrupted files. But these services can get quite expensive with no guarantee of success.
Secure Deletion
Macintosh computers include a built-in secure deletion tool to permanently erase files so they cannot be recovered (source). This tool is accessed through Disk Utility and can securely wipe unused disk space or erase specific files and folders.
To securely delete a file or folder on Mac so it cannot be recovered, follow these steps:
- Locate the file or folder you want to securely delete in Finder.
- Drag the file/folder to the Trash. This removes it from the file system but does not securely erase it.
- Open Disk Utility, typically located in Applications > Utilities.
- Click the Erase tab.
- Under Erase Free Space, select the disk you want to erase (usually Macintosh HD).
- Click Erase Free Space.
This overwrites the unused and free space on your Mac’s hard drive, including any previously deleted files, with zeros. Overwritten files cannot be recovered by data recovery software.
You can also securely erase specific files/folders that are already in the Trash by selecting them and clicking Erase from the Finder menu bar while viewing the Trash. This will immediately overwrite the deleted files so they cannot be recovered.
For maximum security, most experts recommend doing at least a 3-pass erase which overwrites the data multiple times (source). Some paid utilities like WhiteCanyon’s WipeDrive can do up to 35-pass overwrites for classified data disposal.
Time Machine Backups
Time Machine is the built-in backup software in macOS that provides continuous backups of your Mac’s files, applications, and system settings. When enabled, Time Machine will periodically make incremental snapshots of your Mac’s hard drive and save them to an external storage device, such as an external hard drive or Time Capsule wireless router.
One of the key features of Time Machine is that it stores previous versions of files that have been modified or deleted over time. This allows you to restore overwritten or deleted files by going “back in time” to an earlier backup version.
When a file is overwritten on your Mac, the older version of that file does not disappear right away from your Time Machine backups. Time Machine keeps hourly backups for the past 24 hours, daily backups for the past month, and weekly backups until your backup drive is full. This means overwritten files can typically be recovered easily from a Time Machine backup as long as the overwrite happened relatively recently.
To recover a previous version of an overwritten file using Time Machine:
- Open the Time Machine application.
- Navigate to the time frame when the original version of the file still existed.
- Locate and select the file.
- Click “Restore” to retrieve the older version of the file and copy it back to its original location.
By leveraging Time Machine’s file versioning, you can often recover overwritten files on your Mac, providing a safety net against accidental changes or deletions. Just be sure to maintain regular backups so older file versions do not get permanently deleted from your Time Machine storage.
Sources:
https://www.cleverfiles.com/howto/recover-overwritten-file-mac.html
iCloud Backups
iCloud automatically backs up your Mac’s data and settings to Apple’s cloud servers on a regular basis. This is done silently in the background when your Mac is connected to the internet and powered on. iCloud stores previous versions of files and folders from your Mac, which can be a useful way to recover overwritten files.
When a file is overwritten on your Mac’s local storage, the previous version will still exist in your iCloud backup for up to 30 days as long as you have sufficient storage available. You can access previous versions of documents stored in iCloud Drive by right clicking on the file, selecting “Browse All Versions”, and choosing a previous backup date. This lets you recover the older version before it was overwritten.
For other types of files not stored in iCloud Drive, you can restore your entire Mac from an iCloud backup which will retrieve older versions of overwritten files. To do this, reboot your Mac into macOS Recovery mode, select “Restore from Time Machine backup” and choose your iCloud backup as the source. This will restore your Mac’s data to the state it was in during the last iCloud backup.
One limitation with iCloud backups is that they do not continuously backup files as they are edited. Snapshots are only taken periodically such as once per day. So you may not be able to recover all versions of overwritten files if they were changed multiple times between iCloud backups. But for recovering accidentally overwritten files from your most recent backup, iCloud can be quite useful.
Source: https://setapp.com/how-to/recover-an-overwritten-file
Third-Party Backups
In addition to Apple’s built-in Time Machine and iCloud backup solutions, there are many third-party backup applications available for Mac OS. Some popular options include:
Carbon Copy Cloner – This software allows you to make bootable backups of your Mac’s hard drive. It can create incremental backups to retain previous versions of files, including ones that have been overwritten or deleted. (Source)
SuperDuper – Similar to Carbon Copy Cloner, this app clones your hard drive and saves previous versions of files. It has a feature called Smart Update which skips copying identical files to save space and time. (Source)
Backblaze – This popular online backup service supports Mac OS and retains previous versions of files for 30 days after deletion or changes. So it can recover overwritten files within that window. (Source)
Acronis True Image – This full-disk imaging software creates backups allowing you to restore previous versions of files, including those that were overwritten. It also offers cloud storage integration. (Source)
Overall, most third-party Mac backup solutions have versioning or snapshot capabilities to some degree. This allows recovering copies of files from before they were overwritten. But the retention duration can vary.
Best Practices
Here are some tips to help prevent accidental data loss from file overwriting on a Mac:
Use Time Machine to regularly back up your Mac. Time Machine will save hourly backups for the past 24 hours, daily backups for the past month, and weekly backups for everything older. This allows you to restore previous versions of overwritten or deleted files.1
Enable cloud syncing services like iCloud or Dropbox to keep an online copy of your files. Overwritten or deleted files can often be recovered from the cloud even after being removed locally.
Be careful when moving or renaming files in Finder to avoid accidentally overwriting an existing file. Finder will warn you before overwriting, so pay close attention to these warnings.
Avoid using the “Empty Trash” command in Finder to permanently delete files. Files in the Trash will be automatically overwritten over time, but Empty Trash permanently removes them.
Use caution when installing software or drivers, as they may overwrite system files. Only install software from trusted sources.
Make use of thelocked file attribute to prevent accidental changes to critical files. Locked files have to be manually unlocked before they can be overwritten.
Be wary of force-quitting apps, as unsaved changes can be lost. Save frequently to minimize lost work.
Overall, leveraging backups, cloud syncing, and taking precautions when renaming/deleting files will help avoid data loss from accidental overwrites on a Mac.
Conclusion
When a file is overwritten on a Mac, the previous version of the file is generally not recoverable through the operating system. However, overwritten files may still exist in a few places:
– Time Machine backups allow you to go back to previous versions of your entire Mac system.
– Some third party apps like Dropbox or Google Drive may retain earlier versions of synced files.
– Against common perception, overwrite operations do not always fully replace all old data, so recovery software can sometimes recover remnants of overwritten files.
To avoid losing important files when overwriting, make sure you have a good backup system in place. Use Apple’s built-in Time Machine feature or a third party backup utility. Additionally, avoid overwriting files unless you are certain you want to remove the previous versions. When needed, use the Finder’s Move to Trash option instead of Save to prevent overwriting files.