Start with Trash and backups. For an internal startup drive, stop creating new files as soon as possible. SSD block reuse and TRIM, continued system writes, encryption, and the remaining file-system metadata all affect recovery. APFS by itself is not the reason deleted blocks are cleared.

For a stable external drive, a read-only software scan may be reasonable. Internal startup storage has a different risk profile and usually offers fewer do-it-yourself options.

Official Tools and Guides#

PhotoRec is a free signature-based recovery tool. R-Studio offers a Mac version with a demo scan and preview.

Check Trash and Cloud Recovery#

  1. Open Trash.
  2. Find the item.
  3. Right-click and select Put Back.
  4. Check iCloud Drive’s recently deleted files if the folder was synced. Apple normally keeps eligible iCloud Drive files there for 30 days unless they are permanently removed sooner.
  5. Check the application’s own recently deleted area.

Photos, Notes, and cloud applications may keep deleted items separately from Finder’s Trash.

Restore an Earlier App Version#

Some macOS applications support File > Revert To > Browse All Versions. Use it when the file still exists but its content was overwritten or damaged.

Restore a copy to a new filename first when the application allows it. This preserves the current version for comparison.

Restore with Time Machine#

  1. Connect the Time Machine backup disk.
  2. Open the folder that originally contained the file.
  3. Open Time Machine.
  4. Move through the backup timeline.
  5. Select the file or folder.
  6. Choose Restore.

Apple returns restored items to their original location. If a current file has the same name, read the replacement prompt carefully.

Decide Whether the Source Is Internal or External#

If no backup contains the file:

  • stop downloads and application installs;
  • avoid copying files to the source disk;
  • prepare another drive for recovered files;
  • do not install recovery software on the affected external disk;
  • do not erase or reformat the disk.

For deleted files on the internal startup SSD, every continued system operation can overwrite data, and installing a tool adds more writes. Shut down when the files are critical. Professional evaluation is an escalation option, but modern encrypted internal SSDs may remain unrecoverable even in a laboratory.

Scan a Stable External Drive#

For an external drive, SD card, or USB device that remains stable:

  1. Download PhotoRec or R-Studio to the Mac’s internal disk or another drive.
  2. If macOS blocks disk access, open System Settings > Privacy & Security > Full Disk Access, enable the selected recovery application, and restart it. Remove that permission after recovery.
  3. Select the source by model and capacity.
  4. Run a read-only scan.
  5. Preview files when the tool supports it.
  6. Recover files to a different physical drive.

PhotoRec may recover content without original names and folders. R-Studio may preserve more file-system information when that metadata remains readable.

Stop for Hardware Failure#

Do not continue scanning an external drive that clicks, disconnects, reports the wrong capacity, or becomes unusually hot. Try one known-good cable and power source. If instability remains, disconnect it.

Software recovery is for readable media. Hardware failure requires specialist equipment.

Check Every Important File#

  1. Open every critical document.
  2. Inspect full-resolution photos.
  3. Play recovered media through the end.
  4. Compare dates and contents with another record.
  5. Create two backups of verified files.