How to recover deleted files on a Mac
Emptied the Trash too soon, or formatted the wrong drive? Don't panic — and importantly, stop writing new files to that drive. Here's how to get your data back.
First: stop using the drive
Deleted files aren't erased immediately — the space is just marked reusable. Every new file you save can overwrite them. So the single most important step is to stop writing to the affected drive right away. If it's an external drive, unmount it until you're ready to scan.
Before recovery software: check Time Machine and iCloud
This costs nothing and is faster than any scan, so it's worth two minutes before anything else.
- Time Machine: open the folder the file lived in, then enter Time Machine from the menu bar and browse back to a date before the deletion. A restored backup is a perfect copy, which is more than any recovery tool can promise.
- iCloud Drive: iCloud.com has a "Recently Deleted" section that keeps files for 30 days — separate from the Trash on your Mac, and often overlooked.
- App-level history: Photos, Notes, and Mail each keep their own Recently Deleted for around 30 days. If you deleted from inside one of those apps, look there first.
Recovery software is for when those come up empty. It's the harder path, and it's worth knowing you tried the easy ones.
APFS vs HFS+ — why it changes your odds
Modern Macs use APFS, which behaves differently from the older HFS+ in ways that matter here. APFS is copy-on-write and heavily snapshot-oriented, so deleted data can sometimes persist inside a local snapshot even when the file is gone from the filesystem — occasionally good news. But APFS on an internal SSD also sits on top of TRIM, which works hard against you.
The practical summary: on an external HFS+ or APFS drive, your odds are good. On an internal SSD, they drop sharply within seconds of deletion. We explain why in the SSD recovery explainer, and the honest answer there is often "no."
Step 1 — Download and open Cinder
Install Cinder Data Recovery and launch it. Scanning and previewing are free — you don't need a license or an account to see what's recoverable.
Step 2 — Pick the drive and a scan type
Quick Scan reads filesystem metadata that's still on disk, including files sitting in the Trash. It's fast and catches recently-deleted files. Deep Scan also carves raw sectors for files the filesystem has already forgotten — slower, but far more thorough for files deleted a while ago or lost to a format.
Step 3 — Preview before you pay
Results show up with their original filenames and folder paths, not generic reconstructions. You can preview photos, audio, and video inline. This is the moment to confirm the files you care about are really recoverable — before spending anything.
Step 4 — Recover to a different drive
When you save files, write them to a different drive than the one you're recovering from. Recovering onto the same drive can overwrite other deleted files you haven't gotten to yet.
What "recoverable" really means in the results list
A file appearing in a scan means its data was found — not that every byte of it survived. A partially overwritten file can list at full size, show a thumbnail generated from its first few kilobytes, and still fail to open once recovered.
This is why previewing matters, and why we let you do it for free. Open a handful of the files you actually care about before paying for anything. If the previews render fully, the rest of that batch is very likely fine. If they render half an image and then garbage, that tells you something important at no cost.
The one case that won't work: your startup disk
Deep recovery of already-deleted data from your Mac's own startup disk is blocked by macOS System Integrity Protection — for every recovery tool, not just Cinder. To deeply recover a startup disk, you boot from another drive (or macOS Recovery) and scan it "from outside." Quick Scan still works on the startup disk for files the filesystem remembers.
When to stop and call a lab
Software recovery works on drives that are electrically healthy but logically damaged. It cannot help — and repeated attempts actively make things worse — when the hardware itself is failing. Stop and consider a professional service if:
- The drive clicks, beeps, or grinds. That's mechanical, and every spin-up risks more damage.
- It disappears from the Mac mid-scan, or never appears electrically at all.
- It was dropped, flooded, or exposed to heat.
- The data is genuinely irreplaceable and worth more than a few hundred dollars to you.
A lab is expensive — often several hundred to a few thousand dollars — and we'd rather tell you when you need one than take money for a scan that can't help. The same honesty applies to a FileVault volume with no password: no tool recovers that, by design.