I accidentally deleted important files from an HFS-formatted drive and haven’t saved anything new to it yet. I’m trying to figure out the safest way to recover HFS data without making things worse. What tools or steps should I try first?
Deleted files on HFS or HFS+ are usually not gone right away, even if you emptied the Trash. macOS mostly just marks that part of the drive as available again. The actual data can still be sitting there until something else gets written over it.
So the big thing is simple: stop using that drive as much as possible. Don’t install apps on it, don’t save new files to it, and don’t keep poking around if you can avoid it. New activity is what can turn a recoverable deleted file into a permanently overwritten one.
If it’s your Mac’s internal drive, that’s annoying because you can’t completely avoid using it unless you boot from another drive. But at least keep activity to a minimum and install recovery software somewhere else.
And yes, it’s usually worth trying even if you don’t have a backup. If the drive is physically failing, like clicking, not spinning up, or not appearing at all, then software probably isn’t the answer and a recovery lab is the safer route. But for normal deletion, emptied Trash, accidental formatting, or a drive that still shows up in Disk Utility, recovery software is exactly what you’d try first.
A straightforward option is Disk Drill. It has a normal visual interface, and you can scan and preview files before deciding whether to recover them.
Basic approach:
1. Install Disk Drill somewhere other than the drive you’re recovering from.
If the lost files were on the Mac’s internal drive, install it on an external USB drive or another external disk. If the lost files were on an external drive, install Disk Drill on the Mac itself. Don’t write anything new to the drive you’re trying to rescue.
2. Open it and select the problem drive.
Pick the drive that had the deleted files.
3. Run “Search for lost data.”
The scan can take a while, especially on bigger drives. You can check found items before it finishes, but letting the scan complete usually gives you the best shot.
4. Preview the results.
Disk Drill sorts found files by type, like photos, documents, and videos. Use the preview option, the little eye icon, to see whether the files are actually intact before recovering anything.
5. Select the files you want and recover them.
Check the files you need.
6. Save them to a different drive.
This part matters too. Don’t recover files back onto the same drive you scanned. Use another disk or another safe location.
One thing with older Macs and HFS+ is that journaling can sometimes help recovery tools keep more of the original file info, like names and folder locations. But that journal gets reused over time, so waiting too long or continuing to use the drive can make recovery messier.
If Disk Drill’s scan can preview the files and they look intact, that’s a very good sign. At that point, the main job is just getting them copied off to a safe place without writing anything else to the original drive.
5 Likes
Your chances are decent only because you stopped writing to the disk, but I’d avoid treating the original drive as the thing to experiment on. If the files matter, make a sector-by-sector image or clone to another drive first, then scan the copy with Disk Drill or whatever recovery tool you choose. Don’t run First Aid, repair utilities, reformat, or “fix” the HFS volume before recovery, since those can change the directory records and make file names or folder structure harder to recover. If you can’t make a clone because the drive throws errors or disconnects, that’s when I’d stop and consider a lab instead of letting software grind on a failing disk for hours.
Don’t keep mounting the drive normally and clicking around in Finder just to “check” what is still there. macOS can write little bits of housekeeping data to a volume when it mounts, especially things like Spotlight, Trash, and filesystem event folders. That is not the same as copying a movie onto it, but when you are trying to recover deleted files, unnecessary writes are still unnecessary writes.
I agree with the clone-first advice, but I’d make the clone or image before running any recovery app if the files are important. Then scan the clone with Disk Drill or another recovery tool and recover the files to a third drive. If you skip the clone, at least make sure the recovery destination is not the same HFS drive. People still mess that up because the software lets them pick any location, and recovering back to the same disk can overwrite the exact files you are trying to save.
The annoying caveat is that “I haven’t saved anything new” does not always mean “nothing has changed.” If this was an external spinning hard drive, your odds are usually decent after a simple delete. If it was an SSD and TRIM was involved, recovery can be much worse even if you stopped using it right away. Either way, don’t run First Aid, don’t reformat, don’t rebuild directories, and don’t let macOS offer to “initialize” anything. Scan a copy if you can, preview before paying for recovery if the tool supports it, and only trust files that actually open after being copied out.
A deleted folder on an external HFS+ hard drive is a very different problem from deleted files on the Mac you are currently booted from. The external drive case is usually much easier to control: unplug it, stop mounting it, make an image, scan the image. The boot drive case is messier because macOS keeps writing logs, caches, browser data, swap files, Spotlight stuff, and whatever else while you are trying to be careful.
Before running recovery software, check the boring recovery paths first, but do it without writing to the problem drive. Look at Time Machine, another backup disk, cloud sync history, email attachments, old exports, phone copies, etc. That sounds obvious, but people sometimes spend hours scanning a disk when the file is sitting in iCloud Drive’s recently deleted section or an old Time Machine snapshot. A backup restore is cleaner than file carving.
If you do use a tool like Disk Drill, I’d treat the preview as a filter, not a promise. If it shows the file with the right name, folder, size, and it previews correctly, that is encouraging. If it only finds “file12345.jpg” under a generic reconstructed folder, that may still be usable, but you may lose original names, folders, creation dates, or partial contents. With HFS+, recovery can range from “everything comes back neatly” to “here is a pile of unnamed files,” depending on what directory records and file extents are still intact.
The safest workflow is still: stop using the drive, make a full image or clone to another disk, scan the copy, recover onto a third location. If you don’t have enough spare storage for both an image and recovered files, buy or borrow another drive before you start. Running scans against the original because you are short on space is how a simple deletion can turn into a worse problem.
And don’t ignore drive health. If the disk is clicking, repeatedly disconnecting, taking forever to read, or showing I/O errors, recovery software can make it work harder at exactly the wrong time. In that case, I’d either clone it with a tool meant for bad drives or stop and consider a recovery shop. For a normal accidental delete on a healthy HFS drive, though, yes, recovery is absolutely worth trying as long as you avoid writing anything back to that same volume.