Now what actually happened? On last Monday I visited the overly expensive King Tutankhamun exhibition. They have impressive stuff there, but the most famous golden mask is missing - and you are not allowed to take any pictures. But it was a nice evening and on the way home I took the one or the other picture. At home I wanted to copy them to my MacBook and here the story actually starts.
Mac OS X has some really strange features. The first one is the mentioned above: I'm not able to delete files directly. Of course I want to delete the pictures from the memory card after having them copied to the hard disk. Here we get to strange feature 2: Deleting them on the memory card does not free the memory since they are still on the card's trash bin. But you neither can selectively delete items from the trash bin - it's an all or nothing and strange feature 3. I want to keep stuff in the trash bin where it makes sense, being forced to empty the trash bin completely is rather stupid.
Now I found a workaround which seemed quite comfortable. I use CocoViewX for viewing and managing my pictures. It's not as good as IrfanView which I used to use on Windows, but much better than iPhoto. The latter is kind of unacceptable for me since it insists on managing them in its own directory structure and creates 3 copies (originals, data, modified) of all of them - I have 3.5 GB photos! Anyway, CocoViewX notices when there is a memory card with photos and offers to import them with the 3 options of keeping the photos on the card, moving them to trash or deleting them directly on the card. The last one is what I'm looking for and used. So far, so good. It creates an import folder where it puts the new pictures.
After I sorted the pictures and moved them to my folders I wanted to delete the import folder. Again CocoViewX offers the three possibilities to keep it, to move it to trash or delete it. I knew this folder is empty and I'm very, very sure that I want to delete it. But I was to lazy to switch to the mouse and wanted to switch the buttons with the keyboard. I played around with Tab and left key to which I'm used from Windows, with different combinations of the modifier keys. I only found Apple+Left changing the directory in the background but nothing moved the focussed button. Apple seems to be completely unusable without a mouse!
Anyway, in the second screen shot you see were I ended and I selected "Yeah, throw it away". And what happened? Due to the changed context in the background it threw away my complete "Bilder" (meaning pictures in English) folder! Despite the question is still for the import folder! It took some seconds until I noticed what happened.Then I slowly started to think about what I really lost: 200 pictures of my last two months here in Philadelphia, so since I arrived in the US. Beneath them pictures of my trips to Washington D.C. and New York City. Some I sent already to friends, so I could get at least little variants of those ones, 12 to be exact.
Then I thought about what and how to rescue. Undelete for Mac OS X! Everything I found was anything but promising. I found references to tools like Stellar Phoenix, File Salvage, Data Rescue II and Virtual Lab Data Recovery, but none of them was free. But wait, there is still the memory card! I have a second notebook here running on Windows XP. I knew there are free undelete tools for Windows and with one of them, FreeUndelete 2.0 I could recover most pictures from my NYC trip.
And the rest? All 4 Mac OS X tools offered evaluation versions where you can search your disk for recoverable files, but not actually recover them. I tested all by downloading them directly to a second 1 GB memory card. Stellar Phoenix did not even found my logical drive, Virtual Lab could not (potentially) restore my pictures to the memory card if I remember correctly. Both File Salvage and Data Rescue II worked at least and I scanned my disk. They found more than 5,000 JPEGs. Wow! Paying $100 and then additionally the work of filtering files? I nearly gave up and only wanted to ask a colleague of mine the next day who has more experience with Mac OS X. Unfortunately he has never been in need for such a tool.
But in the evening I started again to search for a tool. A Unix/Linux operating system but no open source tool for undelete?! I finally found one called PhotoRec by CGSecurity. It's rather low-level, started from the shell, but provides a menu. Unfortunately, it can not just scan the free space but only the whole hard disk. It groups restored files by 500 in one directory. Since I knew I would run out of space on my 1 GB memory card I cleaned up the directories as soon as they were "finished", i.e. had 500 files in them. PhotoRec found thousands of useless operating system files, mostly very small, some bigger ones like the background images. I had no problem to keep the space usage on the card rather low. As soon as it got to my actual pictures I could not keep up, the card filled more and more. When the free space reached 10 MB I stopped the process in hope I could continue afterwards - unfortunately not. Anyway, after more than 5 hours and scanning around 55% of the sectors of my hard disk and restoring 19,000 (!) JPEGs I also had most of my pictures from Washington D.C. and Philadelphia back - and was quite happy.
I sent Christophe Grenier (that's what CGSecurity stands for) an email about my observations with the tool. He responded pretty fast. Regarding scanning the whole disk instead of only the free space he wrote
Currently this feature is only available for FAT and NTFS. I hope to provide it for Ext2/ext3, HFS/HFS+ isn't planned.
He also told me how to start from a specific sector by modifying photorec.ses. This file contains a huge list of scanned sector ranges starting from 0. All entries up to those ones that should be scanned must be dropped. This worked pretty well on evening 3. It took only another hour for scanning the rest and restoring another 1,000 JPEGs, nearly all to be deleted anyway.
Yeah, so overall I had to filter out around 120 pictures out of 20,000. First criteria was of course the size, which should have sorted out around 80% of the pictures. Since my hard disk is rather new it is also not that fragmented yet and my pictures came mostly in groups. I could easily delete the ones I had on my backup and keep the other groups. All in all it were 2.5 days because of annoying features in Mac OS X and bugs in CocoViewX - where I consider the first one worse than the latter.
It really annoys me that Mac OS X does not allow me to delete things directly especially since I can't delete stuff selectively from the trash bin. This might be good in general since it is so hard to restore deleted files. But I usually know what I'm doing and don't want to be patronized by my operating system. Since there are more issues I have with Mac OS X (about which I might blog in the near future as well) it might even happen that I switch to another one (with Linux more likely than Windows).
