How to Restore Deleted Files Mac: A 2026 Recovery Plan
· how to restore deleted files mac, mac data recovery, recover mac files, time machine restore, macos sonoma
You emptied the Trash, or hit delete in the wrong folder, or ran a command you wish you could take back. Now you need the file back and your Mac is still on, still indexing, still writing tiny bits of data in the background.
That detail matters more than it might seem. If you're trying to figure out how to restore deleted files on Mac, the biggest mistake isn't choosing the wrong tool. It's continuing to use the machine like nothing happened.
Mac file recovery is a ladder. Start with the safest, native options first. Check Trash and app-level Recently Deleted folders. Then use Apple's built-in recovery paths such as Time Machine and the often-missed APFS snapshots. Only after those fail should you move to third-party recovery software, and only with strict rules about where you install it and where recovered files get saved.
Table of Contents
- The Most Important First Step Before You Do Anything
- Your First Look The Trash and Recently Deleted Folders
- Using macOS Built-in Recovery Time Machine and APFS Snapshots
- Advanced Native Methods Terminal and Target Disk Mode
- When to Use Third-Party Data Recovery Software
- The Last Resort Calling Professional Data Recovery Services
- Frequently Asked Questions About Mac File Recovery
The Most Important First Step Before You Do Anything
You delete the wrong file, your stomach drops, and the instinct is to start clicking. Resist that instinct. Stop using the Mac immediately.
On a modern Mac, deletion usually removes the file's directory entry first. The underlying data may still be sitting on the SSD, but only until macOS needs that space for something else. Open a few apps, install a recovery tool, let Photos sync, download mail, or even keep browsing around in Finder, and you increase the chance that recoverable blocks get reused.
This is the part many guides understate. The biggest mistake is not choosing the wrong recovery app. It is continuing to use the same drive after the deletion happened.
Why stopping matters
macOS is always writing in the background. Spotlight updates its index. Apps write caches and logs. Cloud services sync. Browser tabs create temporary files. On SSD-based Macs, those small writes are enough to reduce your odds.
A reboot can also work against you. So can installing anything to the internal drive. If the file matters, treat the Mac like evidence. Leave it as untouched as possible until you try the safest recovery steps.
Use these rules right away:
- Do not install recovery software on the Mac's internal drive
- Do not copy new files to the same disk
- Do not edit, export, or save documents
- Do not empty the Trash
- Do connect an external drive if you need a place to save recovered files later
If you have another Mac available, use that for research and downloads. Keep the affected Mac quiet.
The recovery order that gives you the best odds
Start with methods that do not write new data and do not hand your files to a third party.
- Check the Trash and app-level Recently Deleted folders
- Check Time Machine backups if you already had them
- Check APFS snapshots before you jump to recovery software
- Use third-party recovery tools only if native options fail
- Call a professional lab if the data is irreplaceable or the drive shows hardware trouble
That APFS snapshot step deserves more attention than it usually gets. On many Macs, snapshots can preserve an earlier state of the file system even if you never set up a full Time Machine workflow. It is one of the best privacy-first options because recovery can stay entirely within Apple's own tools.
If your disk is nearly full, leave cleanup for later. Freeing space the wrong way can overwrite the very file you're trying to get back. After recovery, you can deal with storage properly using this guide to MacBook storage management.
Your First Look The Trash and Recently Deleted Folders
Panic makes people skip the obvious. Start with the places macOS and Apple apps use as safety nets.
Check the Trash properly
Open the Trash from the Dock. Don't just glance at the top few items. Use Finder search inside the Trash window if you remember part of the filename, file type, or date.
When you find the file, right-click it and choose Put Back. That sends it to its original location. If Put Back is greyed out, drag the file to your Desktop or another folder manually.
A few things to verify before you move on:
- Sort by Date Added: Recently deleted files often sink out of view in a crowded Trash.
- Check file extensions: A document may still be there under a generic icon or unfamiliar extension.
- Look for duplicate names: macOS can append numbers to filenames, which makes the original easy to miss.
Recently Deleted in Apple apps
The Dock Trash isn't the only holding area. Several Apple apps keep their own Recently Deleted section, separate from Finder.
Look in these places:
- Photos: Open Photos and check Recently Deleted in the sidebar.
- Notes: Open Notes and inspect the Recently Deleted folder.
- Files stored in iCloud Drive: Sign in through a browser and review deleted items there.
- Pages, Numbers, and Keynote: Check document browsers and any app-level deleted area if the file lived inside iCloud-backed storage.
Some “deleted” files aren't deleted from the disk at all. They're just waiting in an app's own holding area.
This matters even more after a Mac migration or reinstall. Cloud-backed services can preserve recoverable copies that local disk scanning would never need to touch.
If you can't see what you expect
Sometimes the file isn't gone. It's hidden, moved, or buried in a folder you don't usually browse. If you're trying to distinguish between hidden and deleted files, this quick guide on how to show hidden files on Mac can save you a lot of wasted recovery work.
Use that only to confirm file visibility issues. If you're reasonably sure the file was deleted, move on to native recovery before you install anything.
Using macOS Built-in Recovery Time Machine and APFS Snapshots
If the file vanished an hour ago and you've already checked Trash, native recovery is still your best shot. Stop using the Mac first. Every download, browser tab, and app launch increases the chance that recoverable data gets replaced.
Apple gives you two built-in recovery paths that matter here: Time Machine and APFS snapshots. Time Machine is the familiar one. APFS snapshots are the option many Mac users miss, even though they are often the right next step when no backup drive was set up.
Restore from Time Machine
Time Machine is the cleanest recovery method if it was already backing up your Mac before the file disappeared. It restores the file with its original name, folder path, and usually its metadata intact. That is a much better outcome than a raw recovery scan that returns dozens of generically named files.
Use it like this:
- Connect the Time Machine backup drive if it is not already attached.
- Open the folder where the deleted file originally lived.
- Open Time Machine from the menu bar or Applications folder.
- Move back in time to a version of that folder from before the deletion.
- Select the file and click Restore.
Time Machine has one hard limit. It only helps if the backup already contained the file. If the file was created and deleted between backups, move to APFS snapshots before you install anything else.
Check APFS snapshots before you reach for third-party software
On modern Macs, this is often the smartest native recovery step.
APFS supports local snapshots, which are point-in-time records of the file system. If the deletion was recent, a snapshot may still contain the file even when you never configured full Time Machine backups. From a privacy standpoint, this is the best middle path. You stay inside macOS, avoid uploading data, and do not hand disk access to recovery software unless you have to.
The catch is retention. Snapshots can disappear as the system reclaims space, and heavy Mac use after deletion works against you. That is why stopping activity matters so much. A lot of guides treat that as a footnote. It should be the headline.
How to check APFS snapshots
If your version of macOS exposes snapshot browsing in Disk Utility, start there:
- Open Disk Utility.
- Select the APFS volume that held the deleted file.
- Look for APFS Snapshots or a snapshot view option.
- Check the available timestamps.
- Restore from a snapshot created before the file was deleted.
If Disk Utility does not show snapshots clearly, do not start experimenting with random cleanup or repair actions. Leave the disk alone and move to the advanced native methods in the next section, where Terminal can confirm whether snapshots exist.
APFS snapshots are often the best first serious recovery step when there is no Time Machine drive and the deletion happened recently.
Here is the practical trade-off:
| Method | Best when | Main limitation |
|---|---|---|
| Time Machine | A backup exists from before deletion | No help if the file was never backed up |
| APFS snapshots | The deletion was recent and the Mac uses APFS | Snapshots may be gone already |
| Third-party tools | Native recovery paths fail | More risk, more noise, and less privacy |
If you want a walkthrough before touching your Mac, this short video is useful:
<iframe width="100%" style="aspect-ratio: 16 / 9;" src="https://www.youtube.com/embed/CSwy_thSXow" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe>What native recovery does well and where it stops
Built-in recovery works best when macOS still has a structured copy of the file inside a backup or snapshot. In that case, recovery is orderly. You get the original folder structure, filenames, timestamps, and a much lower chance of making the problem worse.
It works poorly once the deletion is old, the Mac has been used heavily since, snapshots have expired, or the storage itself is failing. At that point, native tools may still help confirm what exists, but they stop being enough on their own.
Advanced Native Methods Terminal and Target Disk Mode
If the normal interface isn't helping, macOS still gives you a few power-user options before outside software enters the picture.
Look inside hidden Trash locations with Terminal
Finder's Trash view isn't the whole story. macOS also uses hidden .Trash directories, and removable volumes can have their own trash locations too.
If you're comfortable in Terminal, start by listing hidden files in your home directory and checking trash-related paths. Typical places to inspect include your user Trash and the .Trashes folder on external volumes. The goal isn't to run destructive commands. It's to locate files that Finder may not be surfacing cleanly.
A safe approach is:
- Inspect first: Use read-only listing commands before moving anything.
- Work by path, not guesswork: Confirm filenames and dates before copying.
- Copy out to another location: If you find the file, duplicate it somewhere safe rather than manipulating the original entry in place.
If you aren't comfortable reading Unix-style paths, stop here. Terminal is powerful, but a typo in the wrong command can turn a recoverable mistake into a permanent one.
Use Target Disk Mode or disk sharing when the Mac won't boot normally
If your Mac won't boot, the files may still be intact. In that case, treating the Mac as a storage device can be safer than repeatedly forcing startup attempts.
On supported Macs, Target Disk Mode or newer disk sharing workflows let you connect the troubled Mac to another Mac and browse its storage like an external drive. That's useful when macOS is corrupted but the internal drive itself is still readable.
If the Mac won't start but the drive still mounts from another Mac, copy data first and troubleshoot macOS second.
Use this route when:
- the startup volume won't boot
- Finder crashes before you can search locally
- you want to avoid writing more data to the original system
- you need to copy user folders to another drive before deeper recovery attempts
This isn't magic. If the drive doesn't mount at all, or disconnects randomly, you're moving out of software territory and closer to a hardware problem.
When to Use Third-Party Data Recovery Software
Use third-party recovery software only after you've checked the native paths first and stopped writing to the affected drive. That order matters. On a Mac, recovery often fails because the file was impossible to find, but because normal use kept writing new data over the space where it used to live.
This is the stage for tools like Disk Drill, EaseUS Data Recovery Wizard, or Stellar Data Recovery. The important decision is not which app looks best. It is whether the Mac's storage is stable enough for software recovery, and whether you can run the scan without making the original volume worse.
How a deep scan works
A normal scan reads the file system's directory records and looks for entries that still point to deleted items. A deep scan goes lower. It reads raw storage blocks and searches for recognizable file signatures, headers, and fragments, which is why it can still find files after the Trash has been emptied or a Terminal command removed them.
As noted in Stellar's Mac data recovery guide, deep scanning works best when the deleted file's data blocks have not yet been overwritten, and recovery is safer when you scan from one drive and save to another.
That overwrite risk is the whole story.
If you deleted a file on your internal SSD, then kept using the Mac, installed apps, downloaded files, or even let Spotlight and background tasks keep running, you reduced the odds of a clean recovery. Many guides bury this point. They should not. If the file matters, stop using that disk and work from external storage.
Rules for using recovery software safely
Follow these rules every time:
- Run the recovery tool from another drive: If possible, boot from or install the app to an external drive.
- Use one disk to scan, another disk to receive recovered data: Never recover back to the source volume.
- Use deep scan when the quick scan finds nothing: Deleted APFS entries may be gone even though file data still exists.
- Grant Full Disk Access if macOS blocks the scan: Without it, the app may miss folders or fail to read protected locations.
- Preview before recovering: A valid preview usually tells you the file is intact enough to be worth saving.
That second rule is the one people break in a panic. The software finds recoverable files, then the act of saving them onto the same disk overwrites the exact blocks you were trying to preserve.
When software fits, and when it does not
| Situation | Software is a good fit | Software is a bad fit |
|---|---|---|
| Trash is empty | Yes | |
| No Time Machine backup exists | Yes | |
| APFS snapshots aren't available | Yes | |
| Drive is physically failing | Yes | |
| Drive makes unusual noises or disappears | Yes | |
| Data is legally, financially, or personally irreplaceable | Maybe, if the drive is stable and you can work carefully | Often better to stop and call a pro |
Third-party tools are best for logical deletion. Files removed from the Trash, deleted from an external drive, or lost after a partition mistake can still be recoverable if the storage device stays readable.
They are a poor fit for hardware trouble. If the drive drops offline, freezes the Mac during reads, or shows signs of physical failure, stop there. Recovery software is not designed to handle unstable media safely.
One more practical filter helps. If a tool can preview the file you need, that is more useful than any feature list. A preview tells you the app is seeing real file data, not just a filename entry with nothing usable behind it.
The Last Resort Calling Professional Data Recovery Services
There are times when the correct move is to stop touching the Mac and hand it to specialists.
Stop DIY work if hardware failure is on the table
If the drive clicks, grinds, vanishes from Disk Utility, or disconnects during reads, don't keep experimenting. Software can't repair damaged heads, unstable controllers, or failing flash storage. Repeated retries can make a bad situation worse.
A professional lab can clone unstable media with specialized hardware and work from the clone rather than the original device. That's the kind of setup home recovery tools don't replicate.
Watch for these signs:
- The Mac sees no drive at all
- The drive mounts and disappears
- You hear mechanical noise from an external drive
- Read attempts stall, freeze, or throw repeated errors
How to decide if a recovery lab is worth it
This is a value decision, not a technical purity test.
If the lost files are replaceable, DIY recovery usually makes sense. If the data is business-critical, legally significant, or emotionally irreplaceable, the cost of a lab can be easier to justify than the regret of failed self-recovery.
The more valuable the data, the less sense it makes to “practice” on the original device.
Professional recovery also makes sense when you've already tried the safe native steps and don't want to risk sector overwrite through trial and error. Ask the lab about evaluation process, whether they work from clones, and how they handle encrypted Mac storage.
Frequently Asked Questions About Mac File Recovery
Can I recover files after reinstalling macOS or upgrading an SSD
Sometimes. The answer depends on what happened to the original storage.
If you reinstalled macOS without securely erasing the drive, some recoverable data may still exist. If you replaced the SSD, recovery usually depends on whether the old drive is still available and readable. Check iCloud Drive, Photos, Notes, and any app-specific Recently Deleted folder first. Then check Time Machine and local APFS snapshots. Those native paths are faster, more private, and less likely to make things worse than jumping straight to scan tools.
Can I recover a file deleted with Terminal
Yes, sometimes. rm skips Trash, but it does not instantly make recovery impossible.
What matters most is what happens next. Stop using the Mac immediately. Do not install recovery software, copy files, or keep browsing around on the same drive. On APFS, deleted data can become harder to recover quickly once new writes start landing, which is why inactivity buys you time.
Is it safe to keep cleaning system junk while I recover files
No.
Cleanup jobs create writes, and writes can overwrite the exact blocks you are trying to get back. Leave temp files, caches, and app leftovers alone until recovery is finished. If you want a clearer breakdown of what is usually safe to remove later, read this guide on whether it's safe to delete temp files after the recovery attempt, not during it.
What's the safest overall workflow
Start with the methods that do not write new data to the affected drive. Stop using the Mac. Check Trash and app-level Recently Deleted folders. Then check Time Machine and APFS snapshots before you touch third-party software.
If you need to scan, boot from another drive or connect the Mac to another system and recover files to a different destination disk. If the drive shows signs of hardware failure, stop there and hand it to a lab. That sequence gives you the best chance of getting files back without turning a simple deletion into permanent loss.
If you spend time cleaning up a Mac after app installs, removals, and storage bloat, Crufti is a smart tool to keep around. It removes leftover app files locally on your Mac, uses zero telemetry, and gives you a review-first workflow instead of aggressive blind cleanup.