File Recovery on MacOS

[#1]

Hello Folks,
Subject says it all really, I have a  machine running 10.3.9 and had until a few days ago 3 user logins and 1 admin login setup.
Well somebody logged in as admin and deleted one of the user logins! Along with that went all the files in 'Documents' this was letters to banks, spreadsheets for home budget/accounts, etc ... things I'd like to get back.
Anybody have views/experience of good file recovery tools on MacOS?
Is deleting a user account really permanent in so much as all files in that area are overwritten as a part of the account deletion making them irrecoverable?
regards,
SW.

[#2]

Quote from: godsell4

Well somebody logged in as admin and deleted one of the user logins!...

I would have a word with someone!
Have you any backups?
You could try creating a new user, create a few files and then deleting the user and see what disappears.

[#3]

I was in the process of making backups when I have the time to do so, the number of iPhoto CD's  with backups is now rediculous even by my standards, of course it takes longer when I have to make 2 discs, one for keeping at home and one for keeping at the parents in case of major catastrophy.
I had not got as far as backing up the documents kept in 'Documents' ...
I am trying to use the machine as little as possible at the moment to keep changes to the HDD as little as possible in case the data I want becomes overwritten.
Now looking at buying a NAS I think.
SW.

[#4]

you may find testdisk in the repository you use for mac.  this has recovery options.  i've not used it, but it has good reports.

[#5]

Quote from: axisofevil

I would have a word with someone!

I would too, but of course my wife can do no wrong in this particluar version of reality! 
SW.

[#6]

How did the person delete the user accounts? If they did it via System Preferences > Accounts then you're given the option of removing it immediately or creating a disk image (.dmg) file of the user's Home folder. If there's a chance they clicked the disk image approach, then you might find disk images for each of the missing user's here:
Macintosh HD > Users > Deleted Users
If they simply removed them immediately, then you'll have to get some data recovery software to retrieve the files (or rely on a backup, which you don't have unfortunately).
Before going any further, though, avoid using the Mac, as the chances of recovering the files decreases if you save any files to the hard drive - even leaving the Mac switched on could, in theory, overwrite the files that are now flagged as being free, as the OS uses Virtual Memory (that's free disk space) all the time. These missing files are now being flagged as free, so they could easily be overwritten at any time as files are saved to disk.
It might be worth buying Data Rescue II, CLICK HERE - it's about £65, but is worth paying that to recover files. There's nothing free, or even cheap, when it comes to data recovery, but I've heard good things about Data Rescue - though thankfully I've never yet had to use it myself *touches wood*. You can buy Data Rescue II in most high street Mac retailers (Apple Retail Stores, Micro Anvika, John Lewis etc). I think the boxed version comes on a bootable DVD, and you'd be best restoring the files to a hard disk other than your internal drive (or flash stick), then copy the files back. If you restore to the same disk as you're trying to retrieve data then the newly restored files could overwrite the "missing" files - meaning if it doesn't work, the chances of retrieving the files using another method could be harder.
I must stress again that if you continue to use the Mac, the chances of retrieving the trashed data will decrease though.
Good luck.
Once you (hopefully) get these files back, I'd highly recommend you invest in an external hard drive - ideally a Firewire model, so you can create a bootable clone of your whole hard drive. I'm assuming you have a PowerPC processor Mac (G3, G4, G5 etc), as you're running 10.3 Panther. If that's the case, then to boot from an external hard drive you need a Firewire connection (USB2 is only bootable on an Intel Mac). Once you get that, download either Carbon Copy Cloner or SuperDuper to clone your entire hard drive across to the external HD. You can then boot from this clone in an emergency and clone (or simply copy) files back again. To change the disk your Mac boots from, go to System Preferences > Startup Disk, select the external HD there and restart.

[#7]

You can also buy Data Rescue II on Amazon... CLICK HERE (£55, with free delivery)

[#8]

Thanks for your very detailed reply, it confirms most things I have been doing to try and 'recover' from this.
Afraid, the person who did this chose the remove files immediately rather than create a .dmg file as a backup.
I have just bought a copy of FileSalvage and a 500GB external NAS (connects via Ethernet and USB) to which I will a) use to copy recovered files to and b) use in the future for storing backups of photos, videos and documents so this little fiasco does not happen again. It is a shame the NAS does not have Firewire, but not being able to boot from the NAS is not a big problem, as long as the NAS has a backup of the files, I will just nuke/format the HDD of the iMac G4 each time something similar happens and make the person who created the problem go through the reinstallation process themselves.
I have the trial version of DataRescueII which I will also try, so far FileSalvage seemed to find more files.
FYI, the machine I have is a iMac G4 1.2GHz 15" 1GB RAM 80GB HDD CDRW/DVDROM + External DVDRW drive.
SW.
[Moderator's note by Barry Zubel: Fixed stray tag for you]

[#9]

Quote from: godsell4

iMac G4 1.2GHz 15" 1GB RAM 80GB HDD CDRW/DVDROM + External DVDRW drive.

I have a 700MHz iMac G4 that only came with a CD writer drive and want to be able to play bought DVDs on it. I've tried a couple of USB2 DVD writers, but none of them work properly - that is, you can write to CD/DVDs using Toast but they won't play DVDs using DVD Player - I assume I probably need either a Firewire model or an internal Superdrive to do that.
Just out of interest, what make and model of external DVD writer do you use on your iMac, and does it works with Apple's DVD Player app?
Thanks!

[#10]

Can you play a DVD that you have previously recorded with the drive?
It might be a piece of nasty DRM ("Digital Rights Management") which prevents you making backups of that DVD that you thought you owned.
Perhaps you need to read http://en.wikipedia.org/wiki/Libdvdcss

[#11]

Quote from: MacOS10

... what make and model of external DVD writer do you use on your iMac, and does it works with Apple's DVD Player app?

It is a Freecom model with Lightscribe, USB and Firewire, I use it for backing up files (ironically!) and do not watch DVD's on my iMac so would not know if it works with iDVD.
If you have problems with DRM, then MacTheRipper is your friend.
SW.

[#12]

Thanks for the info, SW! Will check out that model. I've tried two different LaCie models from work, but none of them work with DVD Player - I think it's a restriction with Apple's DVD Player - it looks for an internal DVD drive, which mine hasn't got. Replacing the internal drive is hard to do on this Mac as you have to practically dismantle the whole computer, so that's not really an option for me. Anyway, thanks for the advice.