I accidentally emptied the Trash on my Mac and lost important files from an APFS drive. I haven’t written much new data since then, but I’m not sure if macOS snapshots, Time Machine, or recovery software can help. What are the best ways to recover deleted APFS files safely?
user 1
Yeah, there’s still a chance, but it really comes down to two things: what kind of drive it was, and how much the drive has been used since the deletion.
The big thing is to stop touching that drive right away. Don’t install recovery apps on it, don’t copy anything to it, don’t run cleanup tools, and I’d hold off on Disk Utility repairs for now too. Anything that writes to the drive can overwrite the deleted data you’re trying to get back.
If this was a quick format in Disk Utility, that does not automatically mean the files are gone forever. A quick format usually resets the file system structure rather than wiping every bit of the old data immediately. If you haven’t saved much to it afterward, recovery may still be possible.
SSDs are the rougher case, especially internal Mac SSDs. Most modern Macs use TRIM on the internal SSD, and once TRIM clears those deleted blocks, normal recovery software can’t restore them. External SSDs are a little less predictable because TRIM depends on the connection and enclosure. Some pass TRIM commands through, some don’t. So an external SSD may still be recoverable if you stop using it fast enough.
I had a similar thing happen with an APFS drive after I deleted a folder and emptied the Trash. What helped me most was Disk Drill, but I made sure not to install it on the drive I was trying to recover from.
What I did was basically this:
- Installed Disk Drill on a separate drive.
- Plugged in the APFS drive that had the deleted files.
- Allowed Full Disk Access when macOS asked for it.
- Scanned the whole APFS volume, not just a small folder.
- Let the scan finish completely before recovering anything.
- Previewed the files first to check that they actually opened.
- Recovered the files onto another drive.
The useful part was that a lot of the folder names came back intact, so it wasn’t just a giant pile of random file names to sort through afterward.
If you don’t have a Time Machine backup, recovery software is probably the next best thing to try. Also check for APFS snapshots before you give up. macOS can keep local snapshots even when your Time Machine drive isn’t plugged in. They may or may not exist in your case, but it’s worth checking.
I’d save Disk Utility First Aid and other repair attempts for after you’ve recovered the files you care about. Recover first, fix the drive later. That order matters.
If the drive is acting physically bad, like it won’t mount, keeps disconnecting, clicks, or freezes every scan, I’d stop with the DIY attempts. At that point a recovery lab is safer. A lot of decent labs will evaluate it for free and only charge if they recover data, usually called “no data, no fee.” It costs more than software, but if the drive is failing, it’s the less risky route.
6 Likes
If the files were on your internal Mac SSD, I’d treat this as a race against TRIM and background writes, not a normal undelete job. Check Time Machine/local snapshots first because that’s the cleanest recovery, but if nothing is there, shut it down and scan from another Mac or external boot setup rather than installing anything on the same drive.
Whether those files lived in iCloud Drive, Desktop, or Documents matters a lot, because “emptying Trash” might not be the only place to check. Before doing scans, check iCloud.com’s Recently Deleted and any app-specific trash, especially for Photos, Notes exports, Pages files, etc. That won’t save normal local APFS deletes, but it is a fast check and it doesn’t write to the damaged drive. I agree with the others on avoiding installs and repairs on the same disk, but I’d be careful not to jump straight into a long recovery scan if there’s a cloud/snapshot copy sitting there. If it was truly local-only on an internal SSD, set expectations low. If it was on an external APFS hard drive, the odds are much better.
Do not scan the only copy if you can avoid it.
People are right about stopping writes, but the missing piece is that recovery scans are not completely risk-free on a questionable drive. If this is an external APFS drive and you have another disk with enough space, make a byte-for-byte image or clone first, then scan the clone/image. That way if the original starts acting weird, disconnecting, or getting worse, you still have a second shot. If the lost files matter more than the cost of another drive, that is usually worth doing.
For an internal Mac SSD, I would keep expectations pretty low after Trash was emptied. APFS itself is not the magic problem. The problem is the SSD, TRIM, encryption, and macOS constantly writing little things in the background. If FileVault was on, you also need the volume to be properly unlocked for any software to make sense of what it is scanning. Without the key/password, “recovering deleted APFS files” turns into recovering encrypted noise.
Snapshots are the first thing I would check because they preserve the file system state instead of trying to carve pieces out of free space. Try Time Machine’s interface first if it was enabled. If you are comfortable with Terminal, you can check local snapshots with tmutil listlocalsnapshots / for the startup disk. For an external volume, don’t assume there are snapshots unless you actually enabled backups or snapshotting for that volume. A lot of people think APFS automatically means “version history,” and it doesn’t.
If you do use software like Disk Drill, treat the preview as the truth, not the file name. A recovered file with the original name can still be corrupted, especially with larger documents, videos, archives, virtual machines, or package-style files. Recover a few sample files to a different drive and open them before spending hours sorting through everything.
So yes, there is hope, but it splits pretty hard: external spinning hard drive, decent chance if untouched; external SSD, maybe; internal Mac SSD after Trash empty, often bad unless snapshots or backups exist. Don’t run First Aid, don’t reinstall macOS, don’t “clean up space,” and don’t save recovered files back onto the same APFS volume.