Guide / recover deleted files Mac

What to do first when you need to recover deleted Mac files

A calm Mac file recovery guide: stop writing to the drive, check Trash and backups, then scan only when recovery is still possible.

Sources checked: Apple restore files with Time Machine, Apple delete files and Trash.

Deleted-file recovery on a Mac depends on where the file still exists. If it is in Trash, recovery is simple. If Time Machine or an APFS local snapshot has a copy, you may be able to restore it. If the file was truly deleted from an encrypted internal SSD and no backup has it, recovery is often impossible. Good recovery advice starts by setting expectations early.

Act quickly and stop writing new data

If the deleted file matters, stop using the disk as much as possible. New downloads, app updates, exports, and cache writes can reuse storage that once held deleted data. On modern Macs, encryption, APFS behavior, SSD wear leveling, and TRIM make classic undelete less reliable than people expect. Your best odds usually come from Trash, backups, local snapshots, external drives, SD cards, or disk images.

Check the easy recovery paths first

Open Trash and put back the file if it is still there.
Open the folder where the file used to live, then use Time Machine to browse older versions if you have backups.
Check cloud version history for iCloud Drive, Dropbox, Google Drive, or the app that owned the document.
Look for exports, email attachments, Messages attachments, build artifacts, or copies on external drives.
If the file was on an external drive or SD card, stop using that device and scan a disk image or the device itself.

What a recovery tool can and cannot do

MacTidy does not include recovery tools. A dedicated recovery tool can list Trash items across volumes, browse APFS local snapshots read-only, and carve files from drives and disk images. On internal encrypted SSDs, carving rarely finds anything once the space has been trimmed.

That is the right claim level. A recovery tool can help when a recoverable copy remains. It should not promise to recover any file, recover securely wiped data, or reverse every empty-Trash event. Recovery is a probability problem shaped by backups, disk type, encryption, and time. The steps above are the ones that work most often.

Use carving only for the right media

File carving looks for known file signatures in raw data and writes recovered results to another location. It can help with SD cards, USB drives, disk images, and some external media. It is less useful on encrypted internal SSDs after deletion. Always recover to a different drive or folder so the scan does not overwrite the very data you are trying to save.

Expect recovered carved files to lose names, folders, and some metadata. Sort results by type and preview them before trusting the recovery. A clean backup restore is usually better than carving when both are available. When a file matters for work or legal records, keep the original media untouched until you have a verified copy elsewhere.

Best prevention. Turn on Time Machine before you need it. Apple's restore workflow is much more reliable than emergency carving after a file is gone.

Related guides

After recovery, read Mac disk cleanup before deleting more files. If you need permanent deletion for sensitive files, review the separate secure wipe workflow rather than ordinary Trash cleanup.

FAQ

Can I recover files after emptying Trash?

Sometimes, if Time Machine, an APFS snapshot, cloud version history, or another copy still has the file. Without a copy, internal SSD recovery is often not possible.

Can MacTidy recover deleted files?

No. MacTidy is a cleanup and security tool and does not recover files. Whatever tool you use, no recovery is guaranteed: it depends on whether readable data still exists.

Where should I save recovered files?

Save them to a different folder or drive from the source being scanned to avoid overwriting recoverable data.

What should I do immediately after deleting an important file?

Stop writing new data, check Trash, check Time Machine or cloud version history, and scan recoverable media before using it again.