Recover Files Deleted Using RM Command on Mac

[wasabi]

Is It Possible to Undo RM Command on macOS?

The short answer is yes—but with some conditions. First, let’s clarify exactly what the RM command was used for:

RM Command	Description	Is recovery possible?
rm	Deletes specified files without prompts (unless permissions prevent writing and input is a terminal)	Yes—Files are unlinked but data remains until overwritten.
rm -d	Removes directories as well as other types of files	Yes—Data can be recovered if not overwritten.
rm -f	Forces deletion without prompts, regardless of permissions	Yes—Similar to rm, data remains until overwritten.
rm -i	Prompt for confirmation before you delete each file.	Yes—Same as rm, but with a confirmation step.
rm -I	Prompts once if you delete more than three files	Yes—Same as rm, with less intrusive confirmation.
rm -P	Has no effect; kept for backward compatibility	N/A—Does not affect data recovery.
rm -R or rm -r	Recursively deletes files and directories; implies -d	Yes—Data can be recovered if not overwritten.
rm -v	Display each file as it is deleted.	Yes—Same as rm, with additional output.
rm -x	When deleting recursively, does not cross mount points	Yes—Same as rm, limited to the current filesystem.

As you can see, when you delete files using the rm command, they are unlinked from the filesystem, but the actual data remains on the disk until it’s overwritten by new data. This means recovery is possible with specialized software. But that’s not the whole story. There’s more to consider if you don’t have any backups:

• What kind of drive was it deleted from? Was it a hard drive? or SSD? This detail matters because of TRIM. TRIM is a feature SSDs use that tells the drive to clear data blocks right after deletion. This makes recovery tough because the space gets wiped almost immediately. With HDDs, the data usually stays until new data overwrites it, which gives you more time to recover.

• If it’s SSD was it an internal or external SSD? If you deleted files from an SSD connected through a hub to your Mac or MacBook, your chances are higher. If it uses a USB Type-A or Type-C connection, macOS doesn’t send the TRIM command to the SSD at all. Even in some cases with Thunderbolt connections through cheaper hubs, TRIM doesn’t run.

• What happened after the deletion? Did you write new data to the drive? Saved any new files? Any new data can overwrite deleted data and make recovery impossible.

Important. In cases of accidental deletion, we strongly recommend avoiding any activity on the drive from which files were deleted. This means no new files, no downloads, and no other actions until you’re ready to begin the recovery process.

No Backups? Use a Data Recovery App to Recover Files Deleted with RM on a Mac

Unfortunately, most people don’t think about backups until it’s too late. So, we’ll start with data recovery software. Backup methods will be covered later.

Data recovery apps scan the drive’s file system for fragments or records of deleted data, which remain until they are overwritten. There are many options available—check out our list of the best data recovery apps for macOS to find one that fits your needs.

Our preferred tool for recovery is Disk Drill. We’ve successfully used it in many similar situations, and if there’s still recoverable data, Disk Drill can retrieve it. Here’s how to use Disk Drill to recover files deleted with the RM command:

Head to the official Disk Drill site and download the app. Install it on a different drive than the one where you deleted the files to avoid overwriting data.

1. Open Disk Drill and pick the drive or partition where the RM command deleted your files. If it’s an external drive, make sure it’s connected.

   

2. Click on Search for lost data. Disk Drill will automatically run through Quick Scan (finds recently deleted files using the existing file structure), Deep Scan (looks for file fragments and raw data when the file structure is damaged or missing), and Signature Scan (searches for known file types based on their unique binary signatures).

   

3. As Disk Drill runs the scan, you can click Review found items at the top to check out files it’s already identified. You can also click on any of the categories shown in the screenshot—like Pictures, Videos, Audio, Documents, Archives, or Other—to jump straight to those file types. This way, you can start looking for what you need even before the full scan finishes.

   

4. Take a look at the list of found files. You’ll see them sorted into subcategories like Existing files, Deleted or lost, and Reconstructed. If there are a lot of files, you can use the search bar at the top to find specific files by name or extension, like .pdf or .jpg.

5. When you click on a file, you’ll see a preview on the right side. Disk Drill also shows recovery chances for each file, so you’ll know how likely it is to get the file back in good shape.

6. Finally, once you’ve selected all the files you want, click on the Recover button. Keep in mind that the Basic version of Disk Drill lets you scan and preview files, but to actually recover them, you’ll need to upgrade to the PRO version.

Disk Drill is a powerful tool, and we’ve successfully recovered data from all kinds of situations with it—formatted drives, corrupted SD cards, even iPhones. If any tool can get your files back, it’s Disk Drill. That said, not every case ends happily. If the data has been overwritten, no app, no matter how advanced, can perform a miracle. Acting quickly improves your chances, but some situations are simply unrecoverable.

Tip. To prevent future issues, use Disk Drill’s data protection features. It includes tools like Recovery Vault and Guaranteed Recovery, which act as safety nets for your files. Recovery Vault logs file metadata so deleted files have a higher chance of being fully restored. Guaranteed Recovery automatically saves copies of deleted files, making them easy to restore later.

How to Recover Files Deleted with RM on macOS with Backups

Now, as promised, let’s go over backup options. macOS includes built-in features like Time Machine and iCloud. If these were set up beforehand, you can effectively undo the RM command. Here’s a quick guide:

1. Time Machine Backup

If Time Machine was active before the deletion, recovery is straightforward. Connect your backup drive, click the Time Machine icon in the menu bar, and select Browse Time Machine Backups. Use the timeline on the right to navigate to the date when your files existed, locate the deleted files, and click Restore. Time Machine will return them to their original location, essentially undoing the RM command.

Tip. Time Machine also keeps local backups, which it updates every 24 hours. So, even if you don’t have your backup drive handy, you can still recover recent versions of deleted files directly from your Mac.

2. iCloud Backup

Another built-in option is iCloud. Just like Time Machine, iCloud needs to have been set up in advance to help with file recovery. iCloud backs up data across your devices, and lets you restore certain files if they were saved to iCloud Drive or other synced locations. Here are the main locations iCloud typically backs up:

• iCloud Drive. Files saved here sync automatically across all Apple devices linked to your account, like documents, folders, and any files you’ve added to iCloud Drive.

• Desktop and Documents folders. If enabled, macOS can back up files from your Desktop and Documents folders to iCloud Drive, which makes them accessible on other devices.

• Photos and videos. If you use iCloud Photos, all photos and videos sync across devices linked to your iCloud account, so they’re available even if deleted from one device.

• App Data for iCloud-enabled apps. Some apps store data in iCloud, so settings, files, and app-specific data are accessible on any device where you log in.

If the files you need fall into one of these categories, you may be able to restore them directly from iCloud. How to restore files with iCloud:

1. Open a browser, go to iCloud.com, and sign in with your Apple ID.

2. Click on Drive to view your files.

   

3. Look in the Recently Deleted folder on the left sidebar. iCloud keeps deleted files here for up to 30 days, so it’s a good place to find files that were removed.

   

4. Browse through the list, choose the files you want, and click Recover. iCloud will put the files back in their original spot in iCloud Drive.

Is There Only DIY Options?

The DIY methods we’ve covered here often deliver excellent results. Many people have successfully undone the RM command on a Mac using these tools. However, if you’re not comfortable doing it yourself or if the deleted data is too valuable to risk, professional data recovery services are an option.

These services can be expensive, but they have access to specialized equipment and tools that home users typically don’t. They can tackle challenging cases, including physically damaged drives. Keep in mind, though, that even professionals cannot recover data that has already been overwritten. Once new data occupies that space, recovery is impossible, even with top-tier equipment.

Many trusted data recovery services operate under a “no data, no charge” policy—if they can’t recover your files, you don’t pay a thing.