A recovery lab reviewing data recovery software is either a conflict of interest or the most honest review you will read: at a recovery lab, we see what these tools leave behind. Here are some tools for macOS, one Apple-specific fact that changes everything, and the cases where no download helps.
macOS immediately erases “free” space by trimming deleted blocks. There is nothing left to “scan”. External hard-drives, memory cards/sticks: those types of devices are the places where scanners really shine. However, the Mac’s internal solid-state drive has the “bins” (the Trash) and “backups” (Time Machine) as the recovery strategy.
Apple provides three backstops that work together to quietly solve most “I deleted this on my Mac” type problems without having to run a scan. First there is the Trash. Less well-known is that it has an automatic empty after thirty days. Check that setting before assuming the worst. Then there are two other backup systems provided by Apple. First is iCloud Drive’s Recently Deleted, located both in the iCloud section of the Finder app and at iCloud.com. This feature keeps files from synced folders (Desktop & Documents included on many configurations) for thirty days. Secondly, if the user has set up their computer to automatically backup using Time Machine, then simply go into it from the folder where the file lived and travel back through time to find the missing file(s). It will take no longer than five minutes to check all three methods, rather than five hours of scanning. Given the fact that the operating system will erase “free” space on the internal drive immediately, using these three methods to find the missing file(s) is not only faster, but probably the only way to recover them.
PhotoRec + TestDisk (free). These are the tools we would hand our “tech savvy” friends. PhotoRec extracts photographs, videos and documents from memory devices (external hard drives, SD cards, USB flash), regardless of how the folders were organised; TestDisk reconstructs missing partitions. Terminal style interface, no limitations, no upsells. Disk Drill (freemium). The most well behaved of all the Mac based applications. This application fully scans all files on your computer and previews every file at no charge. It only charges money when you decide to retrieve a file, this way you can see if any files are retrievable without having to spend money. APFS native support, easy to use. EaseUS Data Recovery Wizard for Mac (paid). A good quality and well designed application. Remember the “Free Edition” has restrictions on recovered files, therefore consider it a demonstration version. Stellar Data Recovery for Mac (paid). Similar to EaseUS, also has a long history of recovering APFS/HFS+ files. Regardless of which tool you choose to use, the rules remain the same: Recover the files to a different drive. Never install the recovery tool on the device you are trying to recover. Judge the effectiveness of the recovery process by successfully opening files rather than by the number of files recovered.
A MacBook that will not turn on, an external drive that is dimmed in Disk Utility or simply makes soft clicks, a Mac displaying the flashing question mark folder, a Mac with a dead logic board using encryption through its T2 chip or Apple silicon technology: these are examples of hardware/firmware issues masquerading as software. Scanning does not accomplish anything but wearing down whatever part of your system is failing. Professional services image the storage first (including any necessary board level imaging as required by the system architecture and with your FileVault key included where applicable), then recover from the copied information: essentially describing the content of our Mac and MacBook recovery service and the subsequent step after our guide to what Apple itself will and won’t do.
Next to the Trash and Time Machine sits a somewhat less dramatic mechanism: The operating system stores local APFS snapshots (point-in-time freezes) of all volumes prior to system updates. In addition, the computer will also take hourly snapshots of all volumes on the machine when Time Machine is set up, even while you’re using your computer away from the external backup drive. If a file existed at the time a snapshot was taken then it should be recoverable by entering Time Machine from the original location and viewing the timeline for these local snapshots or use tmutil listlocalsnapshots / in Terminal. APFS snapshots have an expiration date and will eventually give way to disk pressure so they will typically last no longer than several days, but will often be the one “door” open during the “I deleted it yesterday afternoon on my MacBook Pro” crisis, and nearly always the only door open after all other doors have been closed via TRIM.
PhotoRec, alongside its companion TestDisk for lost partitions: both are free, there are no restrictions and function equally well on the macOS platform compared to any commercial product, as long as you’re comfortable working within a Terminal. Of all the user-friendly products available, Disk Drill’s free version is the most beneficial for finding files on a Mac due to its preview functionality of found data before requiring payment, which gives it an honest “scouting out” purpose regardless of whether you end up purchasing it.
It usually cannot, and it’s best to know that before you waste an entire day trying to find what you think was deleted. All current generation Macs boot off of their internal SSD storage devices and issue TRIM commands once they delete something, essentially deleting blocks of memory instantly rather than simply flagging them as “free”. Always check your trash bin, iCloud Drive’s Recently Deleted items and your Time Machine backups first, because those three locations are really the only places your Mac deletes get retrieved.
On a failing hard disk drive, no software is safe: a full scan will be hours of continuous scanning of a disk that has already failed and needs to be imaged on a bench. Drives that click, dismount frequently or stall Finder should have their data captured through imaging, rather than scanning at your house. Software only applies to media that is healthy and has only logical errors such as deleted files, corrupted files, or formatted partitions. That is the entire difference.
Open the folder in which the missing file existed in the Finder application. Then locate Time Machine by clicking the clock located in the menu bar --> Browse, or use Launchpad. Time Machine opens a new window listing the contents of that folder backwards in time. Use the arrow buttons or Timeline button on the right side of the screen until the missing file appears in Time Machine. Select it and press “Restore”. The missing file will be restored to its original location and retain its original metadata. If the backup disk is not available, Time Machine still lists the local snapshots, sometimes providing sufficient information to recover recent lost files.
When a scan comes back empty on a Mac it most likely means one of three things: TRIM, encryption, or hardware. All three are honest responses given by our free diagnostic before you pay anything.