Recover deleted files on Mac (macOS 2026 methods)

On macOS Sonoma 14 and Sequoia 15, a deleted file is almost never wiped instantly: it travels through the Trash, a local APFS snapshot, or the 30-day iCloud Drive Restore Files queue. The real danger is to keep writing to the SSD while you search — every Safari download, every Xcode update, every Photos export can overwrite the block that held your file. This guide ranks the 6 recovery paths that actually work in 2026, fastest first.

The APFS file system, shipped with macOS 10.13 High Sierra in September 2017, makes recovery trickier than HFS+: copy-on-write (COW) writes a modified copy elsewhere rather than overwriting in place, which multiplies orphan fragments but confuses classic tools. On an Apple Silicon Mac with Secure Enclave, hardware encryption adds another layer that no consumer software can bypass. So your method changes with your hardware and FileVault status.

1. The macOS Trash (the forgotten reflex)

A standard delete via the Delete key or Cmd + Delete sends the file to ~/.Trash. As long as the Trash has not been emptied, the file is back in three seconds.

Quick procedure:

1. Click the Trash icon in the Dock (bottom right by default).
2. Sort by Date Added by clicking the column header in list view.
3. Control-click the file → Put Back. The file returns to its exact original path.

Limits to know:

• Since macOS 10.12 Sierra, a Remove items from the Trash after 30 days option auto-purges anything older than 30 days. Find it in Finder → Settings → Advanced. Make sure it is off if you want long-term recall.
• Files deleted from a USB stick, a non-Time-Machine external drive or an SD card do not go through ~/.Trash: they land in an invisible .Trashes folder on the external volume and vanish on eject.
• Cmd + Option + Delete deletes immediately, bypassing the Trash — the Mac equivalent of Shift + Delete on Windows.

If the Trash is empty or does not hold your file, jump to Time Machine.

2. Time Machine: Apple's built-in time machine

Time Machine has been the native macOS backup tool since Mac OS X 10.5 Leopard (2007). Its logic: a snapshot every hour for 24 hours, then a daily snapshot for 1 month, then a weekly snapshot until the external disk fills up.

Since macOS 10.15 Catalina, Time Machine prefers APFS as the destination format, making restores 3 to 4 times faster than with the old HFS+ format. On Big Sur (11) and later, local snapshots are also kept on the internal disk — handy when the external drive was not plugged in at backup time.

Restoring a single file

1. Plug in your Time Machine drive (USB-C, Thunderbolt 3 or 4).
2. In Finder, open the parent folder of the lost file.
3. Click the Time Machine icon in the menu bar → Enter Time Machine. On Sonoma/Sequoia, this shortcut replaced the old starry galaxy interface.
4. Use the timeline on the right: each tick is a snapshot. Step back to a date before the deletion.
5. Select the file → Restore. macOS puts it back at its original path and asks whether to keep both versions if there is a conflict.

Full restore after a crash

On an Apple Silicon Mac, boot by holding the power button until you see Options. On an Intel Mac, restart with Cmd + R. In macOS Recovery, pick Restore from Time Machine and follow the wizard. A full restore of a 512 GB Mac takes about 90 to 120 minutes on a Thunderbolt 3 external SSD.

Apple documents the full procedure with hardware compatibility notes. If your Time Machine disk is a Synology or QNAP NAS, plan for 2 to 3 times longer because of network throughput.

3. iCloud Drive: 30 days of history on Apple's side

Many users do not realize that iCloud.com offers a Restore Files feature that keeps 30 days of iCloud Drive deletions. It is the silent counterpart of an extended Trash.

Procedure:

1. Sign in at iCloud.com with your Apple ID.
2. Open the iCloud Drive app, then click Recently Deleted in the sidebar (or Account Settings on the older interface).
3. Select the file → Recover. It returns to its original folder on every synced device within 30 to 60 seconds.

iCloud Drive also keeps a version history on Pages, Numbers and Keynote files, accessible via File → Revert To → Browse All Versions. For compatible third-party apps, history can stretch to 30 days.

For a full overview of cloud backup options with versioning, see our automatic backup guide for Windows and Mac 2026.

4. Terminal: commands that save the day

When the GUI shows nothing, Terminal often offers a better view. Three commands to know.

List the raw Trash

ls -la ~/.Trash

This shows every file, including those Finder hides (.DS_Store, orphan metadata, files with broken extended attributes).

Search with mdfind (the Spotlight index)

mdfind -name "report2026.docx"
mdfind "kMDItemContentType == 'com.adobe.pdf' && kMDItemFSContentChangeDate > $time.today(-7)"

mdfind queries the Spotlight index maintained by mds and finds files that drifted out of your normal hierarchy. The second syntax filters PDFs modified within the last 7 days.

Raw find on the file system

sudo find / -name "*project*" -type f 2>/dev/null

find traverses the tree independent of Spotlight, useful when the index is corrupt (a common scenario after a Sequoia 15.2 upgrade). The 2>/dev/null redirection swallows permission errors.

Mount a local APFS snapshot

tmutil listlocalsnapshots /
sudo mount_apfs -o nobrowse -s com.apple.TimeMachine.2026-05-30-180000.local /Volumes/snap

This mounts a local APFS snapshot read-only, letting you copy pre-deletion files to your desktop. Unmount with sudo umount /Volumes/snap when done.

5. Comparison: Mac recovery software in 2026

When none of the native methods work, dedicated recovery software is required. Here are the 3 most-used options in 2026.

The deep scan mode is the critical feature: it reads the APFS volume sector by sector and rebuilds files from their binary signatures (JPEG FF D8, PDF 25 50 44 46, etc.). On a 1 TB internal SSD, a deep scan takes 45 to 90 minutes on average. On a 4 TB USB 3.0 external drive, expect 4 to 6 hours.

For a detailed comparison with Windows-side tools, see our EaseUS vs Recuva 2026 guide and our pick of the best data recovery software for 2026.

Why EaseUS leads on APFS

EaseUS supports decrypting APFS when you supply the FileVault password, while some competitors fail silently. The engine recognizes over 1,000 file formats and rebuilds damaged headers. The two-pass scan (quick then deep) avoids waiting 4 hours when the file sits near the surface.

6. APFS, FileVault, Apple Silicon: what changes everything

APFS and copy-on-write

APFS never overwrites an existing block: it writes a modified copy elsewhere and updates the pointer. Recovery consequence: a deleted file may survive longer than on HFS+, but it is also more fragmented — software has to manually reassemble the chunks. The APFS block size is 4 KB on SSD.

APFS containers group several volumes (System, Data, VM, Preboot, Recovery) that share free space. Since macOS 10.15 Catalina, the System volume is read-only and cryptographically signed — you will never recover a system file from there, only from the Macintosh HD - Data volume.

FileVault: XTS-AES-128 with a 256-bit key

FileVault 2, enabled by default on every Mac sold since 2018 during initial setup, encrypts the entire APFS container with XTS-AES-128 and a key derived to 256 bits. Without the user password or the 28-character recovery key, no software can recover anything. That is a cryptographic guarantee, not a technical puzzle.

If you lose the password:

• If the recovery key was stored in iCloud, Apple can provide it after identity checks (24 to 72 hours).
• If the key is personal, it was displayed once on activation — without it, the disk is permanently unreadable.

Apple Silicon and the Secure Enclave

M1 (2020), M2 (2022), M3 (2023) and M4 (2024) chips ship with a Secure Enclave that hardware-encrypts the internal SSD even when FileVault is off. The Secure Enclave stores keys that never leave the chip. Result: if the logic board fails, the soldered SSD becomes unrecoverable, even if you desolder it for forensic bench reading.

That is why on a MacBook Air M2 or a MacBook Pro M3 Max, Time Machine on an external SSD is no longer a comfort feature but an absolute necessity. As with classic hard drives, see also our guide to recover a corrupted external drive if your Time Machine SSD stops responding.

7. Sonoma 14 vs Sequoia 15: what moved

macOS Sonoma (14, released September 2023) and Sequoia (15, released September 2024) tightened the application sandbox. In practice, recovery software must now explicitly request access to each volume via System Settings → Privacy & Security → Full Disk Access.

On Sequoia 15.2, the signing policy now rejects binaries not notarized by Apple — so download your recovery software straight from the vendor, never via a third-party mirror, otherwise Gatekeeper will block execution.

Practical changes Sonoma → Sequoia:

• The System Settings pane (formerly System Preferences) moved Time Machine under General → Time Machine starting with Ventura 13.
• Full Disk Access permissions must be re-granted after every major update.
• Apple Intelligence mode (Sequoia 15.1+) indexes some documents for local language models — no impact on recovery, but it consumes up to 7 GB of extra SSD space.

8. Mistakes to avoid at all costs

1. Writing to the source disk. Safari downloads, App Store updates, screenshots — every write can overwrite the block to recover. Switch off Wi-Fi if needed.
2. Installing the recovery tool on the source disk. Always to an external USB-C or Thunderbolt SSD — a 1 TB Samsung T7 at $109 does the job fine.
3. Running the scan without Full Disk Access. The tool will see only a fraction of the volume and miss 70% of recoverable files.
4. Repairing the disk with Disk Utility before scanning. The First Aid command rewrites APFS structures and can destroy the fragments you want to recover.
5. Forgetting Time Machine after the rescue. Once your files are back, configure a backup right away — the next loss is coming.

9. Prevent the next loss: 3-2-1 rule

For production Macs (video, photo, code), follow the 3-2-1 rule popularized by Backblaze:

• 3 copies of every important file.
• 2 different media types (internal SSD + external SSD for instance).
• 1 offsite copy (Backblaze cloud, 2 TB iCloud Drive, 2 TB Dropbox).

A Backblaze Computer Backup subscription at $99 per year backs up your whole Mac, externals included, with no volume cap. Combined with daily Time Machine on a 2 TB T7 SSD ($159) and 200 GB iCloud Drive ($2.99 per month), you get a full 3-2-1 setup for about $14 a month.

For photos in particular, see also our iPhone and Android photo recovery guide — iCloud Photos backup crossed with Time Machine covers 99% of scenarios.

10. When to call a professional service

If the internal SSD of an Apple Silicon Mac is physically damaged (drop, electrical surge, liquid spill), no software will work. Clean-room recovery services (DriveSavers, Ontrack, Secure Data Recovery) charge between $500 and $3,500 on average depending on severity, with success rates ranging from 60 to 85% on encrypted APFS SSD.

Before you call, check whether Find My Mac was enabled: if yes, and the Mac was stolen or lost, Apple can trigger Activation Lock remotely — which kills any recovery attempt without the Apple ID.

11. Edge cases: soldered SSD, Fusion Drive, RAID

Fusion Drive (2012-2020)

21.5-inch and 27-inch iMacs from 2012 to 2020 shipped with a Fusion Drive: a 24, 32, 64 or 128 GB SSD paired with a 1 to 3 TB hard disk, merged by CoreStorage. Recovery is trickier because hot blocks live on the SSD and cold blocks on the HDD. Disk Drill 5 and EaseUS see the Fusion Drive as a single logical volume; otherwise dismantle it with diskutil cs delete (irreversible) before scanning.

Mac Pro with MPX and internal RAID

On a 2019/2023 Mac Pro fitted with an MPX module and two SSDs in RAID 0 via SoftRAID, losing one member destroys the array. The APFS scan must then run on each physical SSD separately, doubling the scan time but doubling the chances of finding a copy of every file thanks to striping.

Boot Camp / Asahi Linux shared APFS volume

On dual-boot Intel Macs, the NTFS Boot Camp partition is invisible to macOS tools. Use a dual-OS tool such as EaseUS Data Recovery Wizard (Mac and Windows versions bundled in the Pro license starting at $109 per year). On Apple Silicon, Asahi Linux installs its own APFS volume — back it up separately with asahi-bless.

12. Recovering Mail emails and iMessage threads

The Mail app stores its databases in ~/Library/Mail/V10/ (V10 on Sonoma, V11 on Sequoia). To recover an email deleted from an IMAP folder, first check the Recoverable Items folder server-side (Gmail keeps 30 days, iCloud 30 days, Outlook 14 days). If the local database is corrupted, delete the Envelope Index* files in ~/Library/Mail/V10/MailData/ and relaunch Mail — the rebuild takes 5 to 20 minutes depending on the number of accounts.

iMessage threads are stored in ~/Library/Messages/chat.db, a SQLite database. An accidentally deleted conversation can be recovered if you enabled Messages in iCloud: sign in on another Apple device with the same Apple ID and the conversation re-syncs. Without iCloud Messages, only the last Time Machine saves you.

If your need is rather on PC, compare with our Windows guide for recovering deleted files which details the Windows Recycle Bin and File History.

Conclusion: the order that saves

On macOS 2026, the recovery sequence that maximizes your odds is: Trash → Time Machine → iCloud Drive → Terminal (APFS snapshots) → recovery software. Do not skip a step — each method takes under 5 minutes to try, except the deep scan which needs 1 to 6 hours.

The key factor remains time: act within 30 minutes of the loss, do not write to the disk, and install your recovery tool on an external drive. And above all, configure Time Machine before you need it — that is the difference between 3 seconds of stress and 3 hours of deep scanning.