How can I restore deleted files from macOS?
Increased security has always been the hallmark of Apple's Macintosh computers. Still, being much less vulnerable to malware when compared with PCs, Macs remain equally exposed to the consequences of inaccurate human actions. Mistaken deletion of necessary files or folders clearly ranks first in the list of user errors. Though in most instances they can be easily dragged out of the Trash can located at the end of the Dock, this macOS "undelete" feature doesn't cover all cases of deletion. The items can be removed with the help of the Command-Shift-Delete or Command-Shift-Option-Delete shortcuts, the "Delete Immediately" option from the Finder file menu. Also, one should mention the situation when the Trash has been eventually emptied, either automatically or by the user command. The good news is that even under such circumstances it may be still possible to recover deleted files. Just follow the right path and get them back before they are gone for good.
Restore deleted files from Time Machine backup
Time Machine is a built-in backup feature of macOS. Once configured, it automatically creates backups of Mac's internal drive to an external disk or a Time Capsule device. To find and restore the files you've mistakenly deleted, follows the steps given below:
To launch Time Machine click the Time Machine icon in the menu bar and choose "Enter Time Machine". If such an icon is missing, open System Preferences, select Time Machine and tick "Show Time Machine in menu bar".
Find the file you want to recover in the Time Machine folder. Use the up/down arrow keys to navigate through time and the Space Bar to preview items.
Select the required file and click "Restore".
However, the main disadvantage of this method is that Time Machine can restore deleted files only if a timely backup has been made. Also, using this utility, it is not possible to recover deleted files from an external hard drive, USB flash drive or a memory card.
Recover deleted files from the file systems of macOS
At present, macOS applies three types of file systems: HFS+ is used on older Macs up to macOS 10.12 Sierra, APFS – on modern ones with macOS 10.13 High Sierra and later while FAT/exFAT can be found on portable devices. Although each of them employs different deletion algorithms described in Peculiarities of data recovery depending on the OS, in most cases, files deleted from macOS do not get immediately erased from the hard disk. Only the information describing them is partially destroyed by the system while the actual data remains intact. Still, the space occupied by a file gets marked as available for new data, which may be generated either by the user or by the system. In general, as long as no information is written to the released room, files remain recoverable, with only a few exceptions:
If the files were deleted from a Macintosh SSD, they are usually beyond recovery due to the TRIM command which wipes their content as part of the system disk management routine. However, the copy-on-write feature of APFS may make the situation a little bit less hopeless.
Modern Mac computers that rely on custom Apple’s M1 (Apple Silicon) or T2 security chips use special hardware keys to encrypt the content of the system drive. Unfortunately, on such machines, data recovery software is able to work only with external digital media while access to the internal drive is blocked on the hardware level. If you are not sure whether your Mac employs one of this chips, please, refer to Unblocking access to macOS drives.
Files destroyed with the help of shredding software cannot be recovered as they get zeroed out or overwritten with some random data.
If the volume was encrypted (by APFS or FileVault 2), but the decryption password got lost, it becomes impossible to access it for data recovery.
In other cases, SysDev Laboratories recommends UFS Explorer Standard Recovery and other UFS Explorer and Recovery Explorer products as effective solutions capable of analyzing the APFS, HFS+ and FAT32/exFAT file systems and restoring files present on both simple and spanned Apple volumes before the deletion was performed.
Note: Recovery of files deleted from more advanced storages, like Fusion Drive, disks encrypted with FileVault or encrypted APFS volumes can be handled by UFS Explorer Professional Recovery and is described in separate guides.
Note: Recovery of deleted files is possible as long as they are not overwritten with some other information. For this reason, it is highly recommended to stop all operations with the storage from which the data has been deleted and immediately start recovering files.
If the files were deleted from Mac's system partition, it is strongly recommended to remove the drive and connect it to another computer as a secondary device. If the data was lost from a non-system partition, the data recovery procedure can be performed on the same Mac.
Note: If the files were deleted from the system startup drive in macOS 10.13 High Sierra and later and despite the recommendations you are not willing to take the disk out, to allow the program to read this storage, you have to disable System Integrity Protection as demonstrated in Unblocking access to macOS drives.
Download the compressed DMG file of UFS Explorer Standard Recovery choosing the "Download for macOS" option and open it in Finder. Don't use the partition which contains the deleted data to avoid its overwriting.
Hint: If you have any difficulties with the installation of the utility, please refer to the installation manual for UFS Explorer Standard Recovery.
Run the program with elevated privileges as described in Unblocking access to macOS drives and if necessary, modify the software settings available in the settings pane.
UFS Explorer Standard Recovery automatically detects partitions available on a device and displays them in the left pane of the main window. Choose the needed HFS+, APFS, FAT32 or exFAT partition from the list and scan it for lost data using the "Start scan" button, the "Scan this storage" tool from the toolbar or the corresponding storage context menu option.
Define the desired scan parameters. If you want the process to be completed faster, you may deselect all file systems except the one applied on your partition and disable InelliRAW. After that, click "Start scan" and wait until the process is accomplished.
Hint: More information about configuring the scan can be found in the instruction on scanning a drive with UFS Explorer.
Check the found files and folders. They can be sorted by name, date, type or previewed in the internal viewer. Quick and advanced search options can also be used to find specific files.
Hint: The information provided in Evaluation and saving the results of data recovery may facilitate your work with the obtained folders and files.
Press the "Define selection" button, select the files and folders you want to recover and press "Save (recover) selection". Don't save the files to the storage from which they are being recovered.
Hint: If you are going to save the recovered data to a network storage, please check the provided instruction.
The following video guide demonstrates the overall process step by step:
Note: If the data was lost from the system partition and there is no possibility to extract the disk and attach it to another computer, you can boot the Mac using UFS Explorer Backup and Emergency Recovery CD for safe data recovery. For more details, please, refer to Data recovery from a system partition.
Last update: August 09, 2022