I accidentally deleted an entire folder from an APFS-formatted drive on macOS and need help recovering the files. I’m trying to figure out the safest APFS data recovery steps before anything gets overwritten, including whether snapshots, Time Machine, or recovery software can restore the folder.
If this is APFS data loss, the main thing is to stop touching the drive right away. Don’t install apps on it, don’t copy new files to it, and don’t try a bunch of random repair commands first. The more you use the disk, the more chances macOS has to overwrite the stuff you’re trying to get back.
I ran into this a few months ago after deleting a whole project folder from my MacBook with no Time Machine backup. I assumed it was gone, but I ended up getting almost all of it back.
Before paying for anything, check the easy stuff:
- Look in the Trash.
- Check Time Machine if you have it set up.
- Open Time Machine even if your backup drive wasn’t connected. APFS can keep local snapshots, so there may still be a recent copy sitting on the Mac. Those usually only stick around for about a day if there’s enough free space.
If that doesn’t turn anything up, I’d go straight to recovery software rather than messing with repairs first.
I used Disk Drill because it actually understands APFS and doesn’t only depend on raw file signature scanning.
What I did was:
- Downloaded Disk Drill to a different drive, not the one I was recovering from.
- Went to System Settings > Privacy & Security > Full Disk Access and gave Disk Drill permission. Without that, it may not be able to scan APFS system volumes properly.
- Picked the affected APFS drive and ran a full Search for Lost Data scan.
- Waited for the scan to finish instead of stopping it early.
- Used preview to check that the files were actually readable.
- Recovered the files to an external SSD, not back onto the Mac’s internal drive.
The nice part was that a lot of the recovered files still had their original folder names and structure. That matters a lot when you’re dealing with a project folder, because sorting thousands of unnamed files by hand is miserable. Disk Drill also has SMART monitoring, which is useful if you think the drive might be failing. If the disk seems unstable, it’s better to make a disk image first and recover from that image instead of repeatedly scanning the original drive.
If the issue is a lost APFS partition, I’d still recover the files you care about before trying to rebuild or repair the partition. TestDisk can sometimes fix damaged partition structures, but it’s text-based and not very forgiving if you don’t know your way around it. Get the data first, then worry about repair.
Also, SSDs have one nasty catch: TRIM. Modern Macs use it in the background to clear deleted blocks. Once TRIM has wiped those blocks, recovery software can’t magically restore them. That’s why speed matters. Stop using the Mac as soon as you realize the files are gone. Traditional hard drives don’t work the same way, so accidental deletions from HDDs are often more recoverable.
If Disk Drill can find the files and the previews look right, that’s usually a good sign.
But if the Mac no longer recognizes the drive, it keeps disconnecting, you hear clicking, or the APFS container looks seriously corrupted, I wouldn’t keep poking at it. At that point, a professional data recovery lab is the safer move. Most decent ones will evaluate the drive for free, and many work on a no data, no fee basis. It costs more than software, but physical drive problems are where DIY attempts can make things worse.
Hopefully it’s only deletion or a damaged partition. Those are the cases where software recovery usually has the best shot, especially if you catch it quickly.
4 Likes
Don’t run “Erase,” “Restore,” or partition fixes just because Disk Utility offers them. Mike’s right about stopping writes, but I’d be extra careful if the missing folder was inside Desktop, Documents, or iCloud Drive, because syncing can muddy the situation. Check iCloud.com’s Recently Deleted and the Files app Recently Deleted before doing a long scan, since that may be faster and safer than hammering the APFS volume. If it was only on the local disk, scan from another drive and recover to another drive. Disk Drill is fine to try, but don’t judge recovery by file names alone. Preview/open a few important files first, especially packages, libraries, photos, and project files, because APFS recovery can show a nice-looking folder tree while some contents are already zeroed or partial.
Shut it down if the deleted folder was on the internal SSD. Leaving macOS running can still create logs, Spotlight writes, iCloud activity, cache files, and other junk even if you “aren’t doing anything.” If you can, connect the Mac to another Mac using Share Disk/Target Disk Mode or boot from an external drive, then scan the affected volume from there and save recovered files somewhere else. Disk Drill or any similar tool is only worth using after you’ve made the machine stop writing to that volume. And don’t waste hours restoring everything blindly: recover a few critical files first, open them, then decide whether a full recovery is worth the time.
Freeing up space so you have room to recover files can be the thing that destroys the files you’re trying to recover. People panic, empty Trash, delete downloads, uninstall apps, run CleanMyMac-type tools, or remove old local snapshots, and all of that creates new writes on the same APFS volume.
I agree with the “stop using the disk” advice, but I’d be a little more blunt about the order of operations: do not make the damaged drive nicer, cleaner, smaller, or more organized first. Leave it ugly and untouched. If you need a recovery app, download it somewhere else. If you need space for recovered files, plug in an external drive. If macOS says it wants to repair the disk, update the disk, sync something, or “optimize” storage, don’t let it unless you have already copied off what matters.
A missed cheap check is local snapshots from Terminal. If you are comfortable with it, you can run:
tmutil listlocalsnapshots /
If there’s a snapshot from before the folder was deleted, that may be better than file carving because you’re getting the normal file structure back instead of whatever a scanner can reconstruct. Don’t delete those snapshots to “make space.” That is exactly the kind of cleanup that can remove your easiest recovery path.
For recovery software, Disk Drill is fine to try, but I would treat its results as a catalog of possibilities, not proof. APFS can leave enough metadata behind to make a deleted folder look recoverable while the actual file contents are gone or partly zeroed, especially on an SSD with TRIM. Previewing a JPEG or PDF is helpful, but for project folders you should test the real files in the real app. A recovered Final Cut library, Photos library, Xcode project, Lightroom catalog, or music session can look complete in Finder and still be missing internal pieces.
Small practical detail: recover the parent folder if the software offers it, not just the individual files you recognize. A lot of macOS “files” are really packages or folders pretending to be single files. If you cherry-pick only the obvious documents, you can miss sidecar files, databases, cache folders, thumbnails, project settings, and linked assets that make the main file usable. Use a separate external drive with more free space than you think you need, then sort it out after the recovery is finished.