Recover Deleted Files on Mac: Proven Methods + Disk Drill Guide

Fast, practical recovery instructions for macOS users—covers Trash and Time Machine fixes, when to run a deep scan, SSD/TRIM realities, and a step-by-step Disk Drill walkthrough.

Quick answer: To recover deleted files on Mac, first check the Trash, use Cmd+Z if you just deleted, restore from Time Machine or iCloud backup, and if those fail run a reputable data recovery tool like Disk Drill for a deep scan.

How deleted file recovery works on macOS

When you delete a file on macOS, the operating system typically removes the pointer to the file in the file system but doesn't immediately overwrite the data blocks on the drive. That means the actual bytes of your documents, photos, or videos may still exist until the space is reused. Recovery tools locate those orphaned file records and reconstruct the files from raw data or saved filesystem metadata.

APFS and HFS+ behave differently. APFS reduces the window for recovery on SSDs because of TRIM: the SSD controller can zero out freed blocks, making recovery impossible after TRIM has cleared them. On HFS+, the file system retains more metadata, which sometimes allows quicker, more complete recovery—especially when the drive hasn't been heavily used since deletion.

Backups (Time Machine, iCloud Drive, or other snapshot-based systems) are your most reliable route. If you have a snapshot or backup that predates the deletion, restoring the file from backup is safer and faster than running scans. If not, a targeted recovery scan can often restore files—provided you act quickly and minimize writes to the affected disk.

Immediate steps to try now (before running recovery software)

Act fast. Every write to the volume containing the deleted files increases the chance of permanent data loss. If the files were on your internal drive, stop using that Mac for new file creation; if possible, shut it down and boot from an external macOS installer or use Target Disk Mode.

1. Check the Trash: Open the Trash and search; right-click the file and choose Put Back if found.
2. Undo deletion: If the deletion was recent, press Cmd+Z or use Edit → Undo in the app or Finder window where the deletion occurred.
3. Restore from backup: Open Time Machine or iCloud Drive and restore the file/version if available.

These steps recover the majority of accidental deletes. They are fast and risk-free compared to scanning. If none work, prepare to run a recovery tool. Read-only scans are safe; avoid attempting to recover files to the same physical disk—always recover to an external drive.

Also check other places the file might exist: email attachments, Downloads folder, cloud-synced folders (Dropbox, OneDrive), and app-specific caches. Sometimes the "deleted" copy is still cached elsewhere.

Using Disk Drill: when to use it and how it helps

Disk Drill is a well-known Mac data recovery software that runs deep and quick scans, supports APFS/HFS+/exFAT, and can recover a wide range of file types. Use it when Trash, Undo, and backups fail. Disk Drill offers a read-only scan mode, which means it won’t write to the affected disk during analysis—important for safety.

Typical Disk Drill workflow: connect an external drive for recovered files, run a Quick Scan first (it looks for recently deleted file records and is faster), then run a Deep Scan if Quick Scan doesn’t find what you need. Deep Scan analyzes file signatures and can reconstruct files even when metadata is gone, though filenames and folder structure may not be preserved.

Important: always recover to a separate drive. If you need a walkthrough, follow the app’s guide and export recovered items to an external SSD or USB. For a practical guide and tips specific to macOS, see this Disk Drill walkthrough: Disk Drill recovery steps.

Deep scan, SSDs, and TRIM: what to expect

Deep scans are powerful but slower. They scan the entire disk for file signatures (headers and footers) and attempt to rebuild files from raw blocks. Deep Scan is your option if file metadata is gone or the filesystem is damaged. Expect many recoverable items with generic names (like file0001.jpg) that you'll need to preview to find the ones you want.

On SSDs with TRIM enabled (default on modern macOS for internal SSDs), recovery success drops dramatically. TRIM tells the SSD to erase freed blocks immediately, so the original data bytes may be unrecoverable. If you suspect TRIM has run, your realistic expectations should be modest: some small fragments may be recoverable, but whole files often are not.

External HDDs and non-TRIM-enabled SSDs offer much better recovery windows. If the deleted files were on an external drive, disconnect it immediately and start recovery from another machine if possible. If the internal SSD is your only copy and TRIM is active, prioritize backups and accept that software-based recovery may fail.

Choosing data recovery software and safety tips

Pick recovery software based on these criteria: read-only scanning, APFS/HFS+ support, preview feature (so you can confirm files before paying), and active developer support. Disk Drill meets these needs and is widely used in the Mac community; however, other reputable tools exist. Look for recent updates and clear documentation rather than flashy marketing claims.

Safety rules: never install the recovery app on the affected volume, don't recover files to the same drive you're scanning, and avoid running multiple recovery programs over the same disk (they can create conflicting writes). If the disk shows hardware symptoms—clicking sounds, failing SMART status—stop and consider a professional data recovery service.

Keep expectations realistic: some file formats and fragmented files may be partially recoverable only. Photos and office documents often recover well; complex databases or encrypted containers are harder. If the data is critical (legal, medical, irreplaceable photos), consult specialists early.

Prevention and backup best practices

The simplest "recovery" is prevention. Use Time Machine with an external drive and enable local snapshots; keep a redundant cloud backup for critical files. For professionals, versioned cloud services or offsite backups remove nearly all headache when accidental deletion occurs. Backups are inexpensive insurance compared to data loss.

Enable FileVault for encryption if privacy matters, but remember that encryption complicates recovery if you lose the keys. Store your recovery keys or use iCloud Keychain to avoid being locked out. For extra safety, adopt the 3-2-1 backup rule: 3 copies, 2 media types, 1 offsite.

Finally, make a habit of pausing before mass deletes and using Finder's search and preview features first. Create an "archive" folder or use version control for active work. The right habit reduces the need to recover deleted files mac users dread.

Concise Disk Drill step-by-step (for quick copy-paste)

1. Stop using the affected volume; connect an external drive for recovered files.
2. Install Disk Drill on a different disk or boot from external macOS and install there.
3. Launch Disk Drill, select the affected volume, run Quick Scan; preview found files.
4. If Quick Scan misses files, run Deep Scan; preview and select items to recover.
5. Recover selected items to the external drive; verify recovered data integrity.

That sequence minimizes write activity on the damaged volume and maximizes your recovery chances. Replace Disk Drill with any trusted recovery tool if you prefer—but follow the same safety sequence.