Mac recovery advice on the internet is mostly out of date. It describes HFS+ behaviour, on spinning disks, before System Integrity Protection and before every Mac shipped with an encrypted SSD. Almost none of that applies to a current machine, and following it wastes the short window in which recovery is possible.
Three things that changed the odds
APFS behaves differently from HFS+. It uses copy-on-write, so modifying a file writes new blocks rather than overwriting old ones. That occasionally works in your favour, leaving older versions on disk. It also means the file system reorganises itself constantly, so deleted content is referenced and released in less predictable ways than on HFS+.
Your internal drive is an SSD with TRIM enabled. This is the big one. When you delete a file, the operating system tells the SSD those blocks are free, and the controller erases them in the background — typically within minutes. Once erased, the data is not recoverable by any software, because it is not there. Not by us, not by a lab.
The drive is encrypted. Apple silicon Macs encrypt the internal SSD at hardware level whether or not you turned FileVault on. A drive removed from a dead Mac is not readable elsewhere, because the keys live in the Secure Enclave on that logic board.
Together: internal-SSD deletion on a modern Mac is often unrecoverable within minutes. That is an unwelcome message and it is better delivered now than after you have paid for three tools. External drives, memory cards and USB sticks are an entirely different and much more hopeful story.
Check these before running anything
- The Trash. Genuinely. Including the per-volume trash on external drives.
- Time Machine. Enter Time Machine and browse the folder as it was. If a backup ran before the deletion, this is over in two minutes.
- iCloud Drive’s recently deleted area, which keeps files for 30 days and is separate from the Trash. If Desktop and Documents syncing is on — and it is on by default — a large share of what people lose is here.
- App version history. Pages, Numbers, Keynote and many others keep versions independently of the file system. Use File then Revert To.
- Local snapshots. Time Machine keeps snapshots on the internal drive between backups.
tmutil listlocalsnapshots /in Terminal will show them, and one may predate your deletion even if no external backup drive has been connected in weeks.
That last one is underused and costs nothing to check.
The gaps in Time Machine
Time Machine is good, and people assume it covers more than it does.
It backs up hourly, so a file created and deleted between backups was never captured. It excludes caches, temporary files and some application support directories by default. It thins older backups aggressively, keeping daily backups for a month and weekly beyond that — so a file deleted six months ago may exist only in a weekly snapshot, or not at all. And if the backup drive was disconnected during the period in question, there is simply nothing there.
Check what actually exists before assuming the backup has you covered.
When scanning is worth it
Scanning is worth your time on external drives, memory cards, USB sticks, and older Macs with spinning internal disks. On those, ordinary recovery expectations apply and results are frequently good.
EaseUS Data Recovery Wizard offers a Mac recovery workflow, but support can differ by macOS version, file system and device. Check compatibility for your exact setup and inspect the scan results before buying. If an external drive is unstable, create an image first with an appropriate disk-imaging tool and work from the copy.
For a Mac, compare the current compatibility information for EaseUS Data Recovery Wizard and Wondershare Recoverit. PhotoRec also runs on macOS and costs nothing, though it normally discards original filenames and folder structure.
Two Mac-specific practicalities: you will need to grant the tool Full Disk Access in System Settings under Privacy and Security or it will see almost nothing, and you should never install the tool onto the volume you are recovering from.
If the Mac will not boot
On Apple silicon, do not attempt to remove the SSD. It is soldered and encrypted to that logic board. Instead, boot into recovery by holding the power button, and consider Mac Sharing Mode to expose the drive to another Mac over cable. If the machine will not boot at all but is otherwise undamaged, an Apple repair that preserves the logic board can preserve the data; a board replacement will not.
On older Intel Macs with removable drives, target disk mode or pulling the drive into an enclosure both work as they always did.
Worth doing this week
- Confirm Time Machine has actually run recently rather than assuming it.
- Add a second backup that is not Time Machine and not in your house.
- Leave iCloud Desktop and Documents syncing on. It quietly resolves a lot of these situations.
- Accept that on an internal SSD, backups are the recovery plan. There is no software fallback worth relying on.
Short version: check Trash, Time Machine, iCloud and local snapshots first. Scan externals and cards. On a modern internal SSD, if those four come up empty, the honest answer is usually that it has gone.
Mac recovery tools to compare
These are paid-product links from active UrRecover affiliate relationships. Use the free scan or preview first where available, compare what each tool actually finds, and do not buy if the files you need are not visible.
- EaseUS Data Recovery Wizard — Offers a Mac recovery workflow with scan and preview.
- Wondershare Recoverit — A cross-platform option for files and media.
- MiniTool Power Data Recovery — Useful as a comparison option where its supported platform fits.
Recovery results depend on the device, the failure and whether new data has overwritten the missing files. Save recovered files to a different drive. For physical damage, unusual noises or an unstable RAID, stop and consult a professional recovery laboratory.
For APFS volumes specifically
APFS snapshots and the Time Machine gaps between them are where most Mac recoveries succeed or fail. EaseUS reads APFS natively and will show you what it can see before you commit.