Deleted System Files from Mac OS? Here’s How to Get Them Back
Have you ever wondered what to do if you delete a system file from a Mac? Or maybe you’re wondering how you can get those system files back after they were deleted from the computer? While most Mac users should never modify system files in Mac OS and Mac OS X, some do anyway, and in that process of digging around in system contents, it’s possible to delete a system file or system folder either unintentionally, accidentally, or intentionally but without knowing what exactly the impact would be. Well, spoiler alert; usually the impact of deleting system files from Mac OS is that something that should work on the Mac suddenly no longer works. So what should you do in such a situation? How can you get back a system file that you have deleted from Mac OS? What should you do if you deleted an entire system folder from the Mac? This article attempts to answer that question.
If you have accidentally deleted a system file and now something is clearly not working as it should, you have two realistic options: restore the Mac from a backup you made prior to deleting the system file, or reinstalling Mac OS system software.
If you have Time Machine setup to backup your Mac and you do so regularly (and you should), then using a Time Machine restore can be the best approach for some users. Of course Time Machine rolls back to whatever the state was when it was last backed up, so if the backup is a week old then you’d lose data between then and now unless you specifically make copies of that data.
If you don’t want to use Time machine, or if Time Machine is not an option for whatever reason, you can also choose to reinstall Mac OS system software. Note that reinstalling macOS system software should not impact any data, as it will attempt to only reinstall the operating system itself without mucking about any personal documents, apps, or other data. But “should” is not a guarantee, and it’s always possible that reinstalling system software or starting any other recovery, restore, or reinstallation process may result in permanent data loss. Thus you should have a backup of your data made before attempting to reinstall Mac OS system software.
How to Get Deleted System Files Back on a Mac
Both of these approaches will rely on using Mac Recovery Mode, you’ll either restoring from a previously made backup, or reinstalling the operating system:
- Reboot the Mac, then immediately hold down COMMAND + R keys concurrently
- Continue holding COMMAND + R keys until you see the “MacOS Utilities” screen
- If you have a Time Machine backup, choose “Restore from Time Machine Backup”
- If you want to reinstall Mac OS system software, choose “Reinstall MacOS” (or “Reinstall OS X”, verbiage may be slightly different)
- Follow the onscreen instructions to complete the backup restore, or the macOS system software reinstallation process
Whether you choose to restore from a backup, or to reinstall MacOS, the process will take a while to complete (can be many hours if a large backup file is being restored). But when finished, either the restored version of system software will be back and running as it was before, or the new fresh version of Mac OS system software will be installed and running as intended.
If you want full detailed tutorials for these steps, you can see those and learn how to use Time Machine to restore a Mac from a backup, or read about reinstalling MacOS High Sierra and macOS Sierra, or reinstalling OS X El Capitan and Yosemite – in either case, the process is reinstalling is largely the same despite the naming conventions being different and some verbiage being slightly different.
If the above reinstall approach fails for whatever reason, another option is to attempt to use Internet Recovery to reinstall Mac OS X but that requires a consistent and reliable high speed internet connection, and the version of system software reinstalled may be different than what is currently on the Mac.
How does a system file get deleted from a Mac in the first place?
If you’re wondering how on earth someone could possibly delete a system file in the first place, well it can happen fairly easily.
For starters, the various System folders in Mac OS are easily accessible through Finder as well as the command line by going to the root directory of the Mac file system. While most people will leave that stuff alone if it’s over their head, some novice users can either be extraordinarily adventurous, or confused, and wind up where they shouldn’t be.
For the most common example, novice Mac users might mistake the user Library folder for the System Library folder, and vice versa. Perhaps they think they’re trashing individual user files, but they’re actually trashing system level files – something that can happen if someone is attempting to clean caches and temp files from Mac OS. Or perhaps a novice command line user is experimenting with the unforgiving rm and srm commands for the first time, and they accidentally delete an entire directory that is critical for Mac OS to function properly. Or maybe someone noticed that temporary items in /private/var/folders/ are taking up a lot of storage and they went about addressing that the wrong way. Whoops!
The bottom line is that deleting system files is possible and it can happen either accidentally, unintentionally, or intentionally, by both novice users and advanced users alike.
It’s worth pointing out that modern Mac OS versions use a feature called System Integrity Protection (SIP) to attempt to prevent modification and deletion of system files, but System Integrity Protection can be disabled in Mac OS (and often is by advanced users for various reasons), and older versions of Mac OS X do not have SIP protection at all.
Hopefully this guide has been helpful to you in understanding how to restore and recover deleted system files in Mac OS and Mac OS X, a process which hopefully you won’t have to undertake (in other words, don’t delete system files!). If you know of any other helpful tips, tricks, or methods to achieve the same effect, share them with us in the comments below!
due to what seems a bug in the mv command my /System/Library directory was replaced. I recovered by installing a fresh copy of the same Mojave on another partition, and then copying the files from there back.
Copying the files directly from the mojave installar (they are there if you dig into the package) does not work for some reason. Maybe because the xattr settings there are not correct.
# Funny fact:
if you change your system date inside System Preferences, then the filesystem will align with the its state at the date you set.
I made a screenshot, set the date to 2 days ago, and the screenshot was gone.
Setting back the date to today, the just-shot screenshot came magically back 😯🤔
Yours is the first article I have managed to find concerned with deleted files. However, in my case I discovered up to 50% of the data stored in my 2017 iMac had disappeared between the backup made to Time Machine on 19th May and the next backup on 26th May. I have manually gone through every single folder to restore its contents and also restored photos and videos. Time Machine did not restore the actual contents of the folders until I opened up each one individually. I think I have now recovered all the missing data but I would like to know what caused so much data to be lost from the iMacs own hard drive and how to prevent the same thing happening again. I do hope you can help. Many thanks, Y Fuller, Cornwall UK
Excellent explanation and very clear instructions.
Thanks
Thank you for the tip. But how can I get rid of some system files i.e. Chess?
You can delete preinstalled applications via the command line if desired, but exact syntax is necessary otherwise you can really mess things up.
https://osxdaily.com/2012/02/05/delete-safari-mail-facetime-other-default-mac-os-x-apps/
Backup first. Then make sure the backup is complete. The command line has near zero forgiveness for typos or error, it will permanently delete anything/everything to the point of rendering a system unusable and losing personal data permanently.
Generally I would recommend against it, Chess.app is quite small and there is no practical benefit to removal.
Thanks for this. Another subject close to my heart is deleting files form the server which have been moved from server to server over the years and now refuse to budge. I have now worked this out by using terminal and dragging the file into terminal to get the location address. This usually works but some fool proof instructions from you would be great.