How to Recover Deleted Files on Mac — Fast Guide (Disk Drill & More)

This guide covers practical, reliable methods to restore deleted files on macOS, from Trash and backups to advanced undelete tools and terminal techniques. It’s written for users who need actionable steps—technical enough for power users, readable for everyone.

Immediate steps: what to do first when you delete a file on Mac

When a file is deleted, macOS usually moves it to the Trash or simply marks the storage space as free. The most important rule is: stop using the drive where the file lived. Every write operation (saving, installing apps, even browsing) creates disk activity that can overwrite the sectors containing your deleted data, reducing recovery probability.

Start with the low-effort checks. Open the Trash and search; if you find the file, right-click and choose Restore or drag it back to its original folder. Next, check iCloud Drive and any synchronized folders—sometimes deleted files persist in cloud versions or in the “Recently Deleted” folder for a limited time.

If the Trash is empty and there are no cloud backups, avoid saving new files to the same disk. Unmount external drives safely and, if possible, disconnect the Mac from the network to prevent automatic updates or syncs that may write to disk. Then move to controlled recovery using backups or software.

Use backups first: Time Machine, iCloud, and snapshots

Backups are the fastest, safest recovery method. Time Machine (Apple’s built-in backup) stores hourly, daily, and weekly snapshots. If you have a Time Machine drive, connect it and enter Time Machine from Finder; navigate to the folder and time where the file existed and click Restore. Time Machine restores file metadata and permissions correctly in almost every case.

For iCloud Drive users, go to iCloud.com > Account Settings > Recently Deleted to restore files removed in the last 30 days. Likewise, enterprise or third-party backup solutions often keep versioned copies—check Dropbox, Google Drive, or any NAS backups before attempting disk-level recovery.

If you use APFS, macOS can maintain local snapshots even without an external Time Machine drive. Use the Time Machine interface to browse snapshots. These snapshot-based restores are non-invasive and do not require disk scanning, so they should be attempted before any recovery software.

Recover deleted files on Mac with data recovery software

If backups aren’t available, use a trustworthy data recovery tool. Disk Drill and other recovery apps run file-carving and directory reconstruction scans to locate and restore deleted files. The procedure typically scans the disk at the block level and attempts to assemble files based on headers, footers, and known file signatures.

Recommended workflow: 1) Install the recovery app on a different drive (not the affected disk). 2) Run a quick scan, then a deep scan if needed. 3) Preview recoverable files and export recovered items to an external drive. This avoids writing to the source disk and increases successful restoration odds.

One convenient resource is the Recover Deleted Files on Mac project repository, which aggregates methods and scripts that can help automate parts of the workflow. See the project here: Recover Deleted Files on Mac. If you prefer a GUI product, search for Disk Drill and other reputable tools; always read reviews and verify the vendor before granting full-disk access.

Advanced techniques: Terminal commands and forensic recovery

Power users can use Terminal for some recovery tasks, but note that macOS does not provide a built-in undelete command. You can use diskutil to create a byte-for-byte image of the affected volume and run scans against the image—this preserves the original disk and is standard forensic practice. Example: use sudo diskutil unmount /Volumes/Target && sudo dd if=/dev/disk2 of=/path/to/image.dmg bs=1m conv=sync,noerror

Run recovery tools against the image file instead of the live disk. This approach is slower but much safer. Forensic utilities (like photorec or testdisk) can recover many file types via signature-based carving. They can be run from a Linux or macOS environment and are particularly useful for non-standard file systems and corrupted catalogs.

Professional data recovery services are appropriate when the disk has physical damage, odd noises, or when the recovered file integrity is critical (legal or business records). These services open drives in clean rooms and use specialized hardware; they are expensive, but they maximize recovery chances for physically failing media.

Prevent future loss: best practices and routine maintenance

Prevention beats recovery. Implement at least one redundant backup: Time Machine to an external drive, plus cloud backups for critical documents. Use versioned backups so you can roll back accidental edits or deletions. For teams, a centralized backup policy paired with access controls reduces accidental deletes by users.

Enable safeguards: use a secure Trash retention policy (don’t empty Trash automatically), confirm deletes in Finder for critical folders, and consider a file-watcher/archiving tool for frequently modified content. Regularly verify backups by performing restores—many users set backups and forget them until it’s too late.

Finally, maintain good disk health: keep macOS updated, monitor SMART status on internal drives, and replace drives that show signs of wear. An SSD failure still presents data recovery challenges, especially if TRIM is enabled; on such drives, backups are the only reliable safeguard.

What recovery tools should you consider?

• Disk Drill — user-friendly with deep scan and preview features (search vendor site and reviews before use).
• TestDisk/PhotoRec — open-source utilities for file carving and partition recovery (power-user oriented).
• Professional services — for physically damaged drives or when integrity is critical.

Always download recovery software from the official vendor or trusted repositories. When possible, run a trial or a free scan to preview recoverable files before paying, and save recovered items to a different physical disk.

Summary and quick checklist

To summarize: stop using the affected drive, check Trash and cloud backups, restore from Time Machine if available, then use reputable recovery software (running scans against a disk image if you know how). If the disk is physically failing, consult a professional service immediately.

Recovery success depends on how quickly you act and whether the deleted data has been overwritten. The sooner you follow the steps above, the higher your chances of success.

If you want a compact walkthrough and scripts that can help automate parts of the process, consult this repository: Recover Deleted Files on Mac.

FAQ