Recover Deleted Files on Mac — Complete Guide & Tools

Why deleted files are still recoverable on Mac

When you delete a file on macOS, the operating system typically removes the file’s directory entry and marks its storage blocks as free — it doesn’t immediately overwrite the data. On APFS and HFS+ volumes the data often remains intact until the system needs the space. That moment is the difference between an easy recovery and one that’s impossible.

Knowing how deletion works matters because it changes the recovery approach: stop using the affected volume to avoid overwriting, check backups (Time Machine, iCloud Drive), and choose a recovery method that matches the deletion scenario — Trash-emptied files, formatted drives, or corrupted partitions.

This guide covers quick recoveries, disk-imaging best practices, recommended data recovery software (including Disk Drill), and advanced techniques for permanently deleted files. Read the short voice-search friendly answer below if you want a rapid next step.

Quick answer: How to recover deleted files on Mac (fast steps)

If you want a short, spoken answer (useful for voice search): stop using the Mac, open Time Machine or iCloud to restore, or run a trusted recovery tool like Disk Drill on a second drive. If the file was simply moved to Trash, open Trash and use Restore.

For people who prefer a rapid checklist that can be read aloud or used as a featured snippet, follow the numbered steps below.

1. Stop writing to the drive (quit apps, disconnect external backups if needed).
2. Check Trash, Time Machine, and iCloud Drive — restore if available.
3. If not backed up, create a disk image of the volume and run recovery software (e.g., Disk Drill) targeting the image, not the live disk.

These steps prioritize data preservation: the single best tip is to avoid further disk writes. Creating a disk image is a small time investment that dramatically increases recovery success and removes the risk of accidental overwrites by the recovery software itself.

If you prefer an automated approach, a reputable recovery app can scan and recover files directly. Choose tools that support APFS and HFS+ and that let you save recovered files to a different physical drive.

Recovering deleted files on Mac: options and when to use them

Option 1 — Trash / Undo: If the file is in Trash, right-click and choose Put Back (or restore from the app if it supports versioning). This is instant and safe. Use Undo (Command + Z) immediately after accidental deletion when available.

Option 2 — Backups: Time Machine is the most reliable macOS method. Connect your Time Machine disk, launch Time Machine, navigate to the folder and time where the file existed, then click Restore. iCloud Drive and other cloud backups (Dropbox, Google Drive) can also restore previous versions.

Option 3 — Data recovery software: When Trash and backups fail, use recovery software that supports deep scanning and APFS metadata recovery. Disk Drill is a well-known option — it offers both quick and deep scans, partition recovery, and the ability to mount scan results. For more advanced users, create a disk image first and scan that image to preserve the original volume.

Always recover to a different drive. Saving recovered files back to the same volume risks overwriting lost data. If you only have one drive, consider booting from an external macOS installer or using another Mac and target-disk mode to access the affected disk safely.

Using Disk Drill and other recovery tools (practical walkthrough)

Disk Drill supports APFS and HFS+, offers a user-friendly interface, and can preview recoverable files before recovery. The common workflow is: install Disk Drill on a different drive than the one you’ll scan, attach the affected drive (if external), run Quick Scan then Deep Scan, preview results, and recover selected files to an external volume.

Note on installation: never install recovery software on the same partition that contained the deleted files. The installer can write to that partition and reduce recovery chances. If you have only one Mac, install on an external drive or use a portable version.

For a community-driven script and additional approaches you can inspect tools and examples here: Recover-Deleted-Files-on-Mac (GitHub). For a commercial app with a polished UI, support, and frequent updates, see Disk Drill.

Pros and cons: Disk Drill is easy to use and effective for many scenarios, but no software guarantees success on overwritten data. Advanced cases (physical failure, encrypted volumes with lost keys) require professional labs.

Advanced recovery scenarios and terminal techniques

Permanently deleted files (empty Trash or formatted drive) require deeper tools. If the filesystem is damaged, first attempt a read-only repair using Disk Utility’s First Aid; do not run write-heavy repairs before imaging the disk if the data is critical.

Terminal-savvy users can use command-line tools for imaging and recovery. For example, create a raw disk image with dd or the safer ddrescue variant, then analyze that image with recovery software. Example (run from another macOS or recovery environment):

sudo dd if=/dev/disk2 of=/Volumes/Backup/disk2-image.dmg bs=4m conv=sync,noerror

Using dd without proper options can be risky; prefer ddrescue when hardware errors exist. After imaging, run data recovery on the image file to prevent further wear on the source disk. For APFS snapshots, check for local snapshots that may contain the file; use tmutil to list snapshots if Time Machine is enabled.

Prevention: backups, snapshots, and good habits

The most reliable recovery is prevention. Enable Time Machine with an external drive or a NAS. Time Machine’s hourly snapshots and versioning let you restore files quickly. For critical files, use cloud sync (iCloud Drive with Desktop & Documents enabled) and an additional offsite backup.

Make disk images before performing risky operations like reformatting or repartitioning. Use APFS snapshots (for supported macOS versions and workflows) to create quick, space-efficient restore points before large changes.

Adopt these habits: keep a current backup strategy (3-2-1 rule: three copies, two media types, one offsite), avoid installing large apps on the system partition, and enable FileVault only if you understand your recovery key strategy — encryption without the key prevents software-based recovery.

Common pitfalls and how to avoid them

First pitfall — continuing to use the Mac after deletion. Every write operation risks overwrite. Second — installing recovery tools on the same drive. This single action can reduce recovery success significantly.

Third — trusting free, unknown utilities that ask for full-disk access and then try to sell a license: check reviews, vendor reputation, and whether the software supports read-only imaging. If data is extremely valuable, stop DIY attempts and contact a professional recovery lab.

Finally, don’t trust one scan. If a quick scan fails, perform a deep scan or image the disk and try multiple reputable tools. Combining methods increases the chance of a successful, complete recovery.

Recommended workflow checklist (copyable)

Use this short checklist when you discover deleted files on a Mac. Read it out loud for voice-assist clarity:

• Stop using the Mac immediately.
• Check Trash, Time Machine, and cloud backups.
• Create a read-only disk image of the affected volume.
• Scan the image with trusted recovery software (Disk Drill suggested).
• Recover files to a different physical drive.

Following these five steps will cover the majority of recoverable scenarios while minimizing the risk of permanent data loss.

If speed is essential and a backup exists, restore from backup first — it is faster and far more reliable than a deep forensic scan.

FAQ

Semantic core (keyword clusters)

Primary keywords

Secondary keywords

Clarifying / long-tail queries & LSI phrases

Use these phrases naturally in headings, paragraphs, and alt text. Focus on intent: immediate recovery (how-to), software choice (commercial), and prevention (backups).