Question

How to enable undelete for files in my Downloads folder? How does this undelete works?

$ rm backupstore.files.tar.gz 
$ rm -W backupstore.files.tar.gz
rm: backupstore.files_.tar.gz: Operation not supported
$ ls -W
AdBlock.safariextz          launch (1).ica              mysql-connector-java-2.0.14.tar.gz      launch.ica              mysql-connector-java-5.1.41.tar.gz
$ rm launch.ica 
$ rm -W launch.ica
rm: launch.ica: Operation not supported

Infos about the filesystem

$ diskutil info /dev/disk1
   Device Identifier:        disk1
   Device Node:              /dev/disk1
   Whole:                    Yes
   Part of Whole:            disk1
   Device / Media Name:      APPLE SSD SM0512G

   Volume Name:              Macintosh HD
   Mounted:                  Yes
   Mount Point:              /

   Content (IOContent):      Apple_HFS
   File System Personality:  Journaled HFS+
   Type (Bundle):            hfs
   Name (User Visible):      Mac OS Extended (Journaled)
   Journal:                  Journal size 40960 KB at offset 0x11991000
   Owners:                   Enabled

   OS Can Be Installed:      Yes
   Recovery Disk:            disk0s3
   Media Type:               Generic
   Protocol:                 PCI
   SMART Status:             Not Supported
   Volume UUID:              D27270EB-9784-3B29-A1EE-D26DBC2BD22E
   Disk / Partition UUID:    FC74BE3D-F4EA-4FD1-B362-D651EB68CFA1

   Disk Size:                499.0 GB (499046809600 Bytes) (exactly 974700800 512-Byte-Units)
   Device Block Size:        512 Bytes

   Volume Total Space:       499.0 GB (499046809600 Bytes) (exactly 974700800 512-Byte-Units)
   Volume Used Space:        104.3 GB (104267853824 Bytes) (exactly 203648152 512-Byte-Units) (20.9%)
   Volume Available Space:   394.8 GB (394778955776 Bytes) (exactly 771052648 512-Byte-Units) (79.1%)
   Allocation Block Size:    4096 Bytes

   Read-Only Media:          No
   Read-Only Volume:         No

   Device Location:          Internal
   Removable Media:          Fixed

   Solid State:              Yes
   Virtual:                  Yes
   OS 9 Drivers:             No
   Low Level Format:         Not supported

   This disk is a Core Storage Logical Volume (LV).  Core Storage Information:
   LV UUID:                  FC74BE3D-F4EA-4FD1-B362-D651EB68CFA1
   LVF UUID:                 544B362A-53F4-41FF-B1AD-BE52860C04CA
   LVG UUID:                 C92FBB59-95F2-4E6B-AABA-39267836FCE3
   PV UUID (disk):           6C0409A0-8BBB-4BFC-B422-37782F7EA2B5 (disk0s2)
   Fusion Drive:             No
   Encrypted:                No
Was it helpful?

Solution

From man rm:

 -W    Attempt to undelete the named files.  Currently, this option can only be 
       used to recover files covered by whiteouts.

So it can't be used to recover files deleted by the usual means.

For a (rather short) explanation of whiteout see https://askubuntu.com/questions/39826/what-does-whiteout-mean-in-a-copy-on-write-filesystem. A slightly better explanation I found on discussions.apple.com:

A whiteout node is used are part of a union file system mount, where a 2nd file system is mounted over a base file system, and the files in both file systems appear to be merged.

When you delete a file in the union file system which happens to be in the bottom layer (which is effectively read-only), the top layer gets a whiteout node created to indicate that the bottom layer file should not be returned on a directory lookup.

So while I did not find anything about deleting a whiteout node, my theory is that maybe if you create a real file or directory with the exact same name as the whiteout node you created, the file system will automatically remove the whiteout node. Or try renaming a file to the same name as the whiteout node.

Licensed under: CC-BY-SA with attribution
Not affiliated with apple.stackexchange
scroll top