APFS Data Recovery on Mac: The Complete 2026 Guide

If you've lost files on a modern Mac, you've almost certainly lost them on APFS. It's the filesystem Apple has used by default since macOS High Sierra, and it sits underneath your startup disk and most Mac-formatted external drives. APFS is fast and clever, but those same design choices make recovery more nuanced than it was on the older HFS+ — and a lot more nuanced than the breathless promises some recovery tools make.

This guide is the calm, complete version. It explains what APFS actually is, why deleted data on it behaves the way it does, the free things to try first, and the deeper recovery methods — including a couple that are specific to APFS and that most recovery tools simply don't do. The most important rule comes before any of it: stop writing to the drive that held your lost files. Every saved file, app install, and background task can overwrite the data you're trying to get back. If the loss was on your startup disk, work quickly and avoid large downloads or installs until you're done.

APFS — the Apple File System — isn't laid out the way people often picture a disk. Instead of one rigid partition per volume, an APFS disk has a container that pools all the free space, and inside that container live one or more volumes that share it dynamically. On a typical Mac, that's why your "Macintosh HD" and "Macintosh HD - Data" volumes both report the same free space: they're drawing from the same container. Modern macOS even splits the system into a sealed, read-only system volume and a separate writable Data volume — the one that holds your actual files — both living inside that single container. Knowing this matters for recovery, because the data you care about almost always lives on the Data volume, and a recovery tool has to find and read that specific volume inside the container rather than treating the whole disk as one flat partition.

Two features matter enormously for recovery. The first is copy-on-write. When APFS changes a file, it doesn't overwrite the original blocks in place — it writes the new data to fresh blocks and updates its pointers afterward. The old blocks aren't immediately reused, which is part of why recently changed or deleted data can still be sitting on the disk after the filesystem has "moved on." This is also what makes APFS resilient to crashes: because a change isn't considered final until the pointers are flipped, a power loss mid-write leaves the previous, consistent version intact rather than a half-written mess. That same property is what checkpoint recovery, further down, takes advantage of.

The second is snapshots. APFS can capture a read-only, point-in-time image of a volume that records exactly what every file looked like at that moment. Crucially, a snapshot doesn't duplicate your data — thanks to copy-on-write, it simply preserves the old blocks and stops them from being reused, so it costs almost nothing to take and can be created in an instant. Snapshots are the backbone of Time Machine on modern Macs, and — just as importantly — your Mac often keeps temporary local snapshots even when no backup drive is attached, taken automatically before certain operations and on a rolling schedule. A snapshot can be the single fastest, cleanest way to get a deleted file back, with no carving or repair involved, which is exactly why it's the first thing to check.

On the older HFS+ filesystem, recovery was relatively linear: a single catalog file tracked where everything lived, and when you deleted something the data usually lingered until it was overwritten. APFS is more dynamic. Its copy-on-write behavior, multiple volumes sharing one container, and its metadata structures (organized as B-trees rather than one flat catalog) mean a recovery tool has to understand the container layout, not just scan a partition. When a file is deleted, APFS frees the records that described it inside those B-trees, and because the filesystem is constantly rewriting its own structures, the metadata that told you a file's name and location can be reclaimed faster than the file's data blocks are. That's why a deleted APFS file sometimes recovers by name and sometimes only by carving — it depends on whether the metadata or the data survived.

That extra complexity cuts both ways. It gives APFS powerful recovery angles that HFS+ never had — snapshots and checkpoints, covered below. But it also means a naive "just carve the partition" approach misses things, such as files that only exist intact inside an older checkpoint, or a Data volume that the tool never located inside the container. And it means the single biggest factor in APFS recovery isn't the filesystem at all. It's whether your drive is an SSD, and whether TRIM has already run — a hardware reality that overrides everything clever the filesystem does. If you're working with an older external drive formatted the legacy way instead, our HFS+ data recovery guide covers that path directly.

Before any recovery software, check whether macOS already has a copy of your file in a local snapshot. This is free, built in, and often instant.

Open Terminal and run: tmutil listlocalsnapshots /. macOS prints any snapshots of your startup volume, each named with a date and time. If one is dated before you lost the file, you're in luck — that snapshot is a frozen, read-only copy of the volume from that moment, and your file is in it exactly as it was. The easiest way to browse it: disconnect your Time Machine backup drive, then enter Time Machine from the menu bar — with no backup disk attached, it falls back to these local snapshots, and you can step back through the timeline to a date before the deletion, select the file, and restore it directly. No recovery software is involved at all.

There's an important caveat: snapshots are space-limited and rotate out over time. macOS keeps them only while there's room and only for a limited window — typically they're thinned out within a day or so, and they're purged when the drive needs the space. The longer you wait, the more likely the snapshot you need has already been deleted. So check this first, today, before you do anything else. If a snapshot has your file, you're done — no scanning, no purchase, no risk to the source drive. If it doesn't, you've lost nothing by looking, and you move on to the recovery steps below.

Here's the honest part. Every Apple Silicon Mac uses an SSD, as do most recent Intel Macs. SSDs use a background process called TRIM to keep themselves fast: when you delete a file, the operating system tells the drive those blocks are free, and the SSD often physically erases them within seconds to minutes. Once TRIM has wiped a block, the data is genuinely gone — no software, ours or anyone's, can bring it back. Be skeptical of any tool that promises guaranteed SSD recovery after deletion; the physics don't support it.

So what does that leave you? More than you might think. If you act immediately — within minutes of deletion — recently deleted data may not have been trimmed yet. APFS snapshots (above) capture data independently of TRIM, so a snapshot can hold your file even after the live blocks are gone. And many external and USB drives don't pass TRIM commands through at all, which means deleted data on them can survive far longer. We go deep on exactly what survives in our companion piece on APFS, TRIM, and SSD recovery.

The practical takeaway: speed matters most on internal SSDs, and external/HDD drives give you a wider window. Either way, don't keep using the drive.

This is where APFS recovery gets genuinely interesting, and where DataRecover Pro does something most recovery tools don't. APFS continuously writes its container metadata in a series of checkpoints — periodic, consistent records of the volume's structure. When a Mac crashes mid-write, a macOS update fails partway through, or a volume becomes corrupted and won't mount, the most recent checkpoint can be damaged while older, intact checkpoints still exist on the disk.

DataRecover Pro's APFS checkpoint recovery scans for those prior checkpoints and reconstructs the volume from an earlier, consistent state — effectively rewinding the filesystem to the last point it was whole. That can bring back an entire volume's worth of files that appear lost because the current metadata is broken, not because the data itself is gone.

This is a recovery angle unique to APFS's design, and it's distinct from snapshots: snapshots are point-in-time copies you (or Time Machine) deliberately created and that you can browse, while checkpoints are the filesystem's own low-level internal records, written automatically every time it commits changes — you never see them, but they're the breadcrumb trail back to a consistent state. When the latest checkpoint is corrupt, the volume looks broken to macOS even though a perfectly good earlier checkpoint is still sitting on the disk a moment behind it.

A few real-world situations produce exactly this kind of damage: a Mac that loses power or kernel-panics in the middle of writing, a macOS upgrade that fails partway through and leaves the volume in an inconsistent state, or a sudden disconnection of an external APFS drive. In all of these, the data is intact and so is most of the structure — only the very latest metadata write got mangled. If your APFS volume won't mount after a crash or a botched update, checkpoint recovery is often the difference between "this disk is dead" and "here are your files." It's one of the clearest cases where the repair-and-reconstruct depth of DataRecover Pro pulls ahead of recovery-only tools. You can see more about it on the features page.

For everyday deletions — a file dragged to the Trash and emptied — the recovery flow is straightforward, and it's the same flow that underpins our general guide to recovering deleted files on a Mac.

Start with a quick scan. It reads the APFS filesystem directly and surfaces recently deleted files with their original names and folder structure intact, usually in seconds. Because APFS hasn't necessarily reused the file's metadata yet, a quick scan often finds exactly what you're looking for, neatly labeled.

If the quick scan comes up empty — common after a format, a corrupted volume, a failed update, or simply a long gap since deletion — run a deep scan. Deep scan ignores the filesystem's records entirely and carves files straight out of raw disk blocks by their format signatures. DataRecover Pro recognizes 47+ file types this way, including camera RAW formats, so it can rebuild a recoverable file even when APFS no longer has any record that it existed. Deep scan is slower but far more thorough, and on APFS it pairs naturally with checkpoint recovery: reconstruct the volume structure first, then carve anything the structure can't account for.

Here's the full sequence, in order, with the safety rules built in.

1. Stop using the affected drive immediately. If it's your startup disk, avoid installing apps or saving files until you're done.

2. Check for a Time Machine backup or an APFS local snapshot (tmutil listlocalsnapshots /). If either has your file, restore it and you're finished.

3. Install DataRecover Pro on a different drive than the one you lost data on — or, if the loss was on an external drive, your startup disk is fine. Never install it onto the source drive.

4. Run a quick scan of the APFS volume. Browse the results by name and folder.

5. If your files aren't there, run a deep scan. For a volume that won't mount after a crash or failed update, let APFS checkpoint recovery reconstruct the volume from a prior checkpoint.

6. Preview before committing. DataRecover Pro shows thumbnails, file metadata, macOS Quick Look, and a per-file confidence score, all completely free and with no account — so you can confirm your specific files are recoverable before paying anything.

7. Recover to a separate drive. Always save recovered files to a different volume or external disk, never back onto the source. Writing recovered files onto the source is the most common way people overwrite the very data they're trying to save.

Scanning and preview are free and read-only — they never modify the source drive. If you want to follow along on your own disk, you can download DataRecover Pro and scan before deciding anything.

A word on the preview step, because it's what makes this whole process low-stakes: don't recover blindly. For each found file, DataRecover Pro shows a thumbnail, the file's metadata, a full macOS Quick Look, and a confidence score that tells you whether the file is pristine or only partially recoverable. Use it to triage — recover the high-confidence files you actually care about first, and decide case by case whether a partial result is worth keeping for the rest. Because all of this is free and needs no account, you confirm your specific files come back intact before you ever pay, which on a TRIM-affected SSD is the honest way to know whether recovery is even possible in your situation.

Files pulled from a formatted, corrupted, or partially overwritten APFS volume sometimes come back broken: a photo that won't open, a video that won't play, a document reported as damaged. The bytes are mostly there; the structure that makes them readable is not.

This is where DataRecover Pro differs from recovery-only tools like Disk Drill. Its three-tier repair engine rebuilds corrupted photos, videos, and documents on the way out — rewriting headers, rebuilding indexes, re-stitching frames — so you end up with files that actually open instead of unreadable bytes. Recovery-only tools hand you the broken file and call it done. Repair runs in a sandboxed worker process with no network access and no ability to write elsewhere on your Mac, so even a deliberately malformed file can't compromise your system.

Software recovery — including everything in this guide — is for logical loss: deletion, formatting, corruption, failed updates. It is not for mechanical failure. If the drive is making clicking, grinding, or buzzing noises, isn't recognized by your Mac at all, or repeatedly disconnects and reconnects, stop. Continuing to power a physically failing drive can turn recoverable data into permanently lost data. Power it down and consult a professional data-recovery lab, which can work on the hardware in a controlled, clean environment.

Scanning, preview, thumbnails, Quick Look, and confidence scores are free and unlimited, with no account required — you can always confirm your files are recoverable before spending a cent. Unlocking actual recovery and repair is a paid license: $59 per year, or $89 once for a lifetime license. A single license covers up to 3 devices, and recovery is backed by a 30-day guarantee. DataRecover Pro is signed and notarized by Apple, made by GoodDev LLC, and runs 100% locally on your Mac — your files never leave your machine.

Can I recover deleted files from my Mac's internal SSD? Sometimes — if you act immediately, if an APFS snapshot or checkpoint holds the data, or if you have a Time Machine backup. But TRIM can erase deleted SSD blocks within minutes, so recovery isn't guaranteed. Speed is everything.

What if my APFS volume won't mount after a macOS update? This is a strong case for APFS checkpoint recovery, which reconstructs the volume from a prior consistent checkpoint. Run a deep scan and let checkpoint recovery rebuild the structure.

Is scanning safe for my drive? Yes. Scanning and preview are strictly read-only and never write to the source drive. The only write happens when you choose to recover — and you should always recover to a different drive.

Does this work on external drives and SD cards? Yes — APFS, HFS+, NTFS, exFAT, and FAT32, on internal and external drives, SD cards, and USB sticks. For external drives specifically, see recovering a formatted external drive, and for cross-platform sticks and cards, exFAT drive recovery.

What's the difference between an APFS snapshot and APFS checkpoint recovery? A snapshot is a copy you or Time Machine created on purpose, and you restore from it through Time Machine. Checkpoint recovery works with the filesystem's own automatic internal records to rebuild a volume that won't mount — you don't create checkpoints and you don't browse them; the software reconstructs the volume from the most recent intact one. Snapshots are your first resort for a deleted file; checkpoint recovery is for a volume that's gone unreadable.

Is my data sent anywhere when I use DataRecover Pro? No. Everything runs 100% locally on your Mac — scanning, preview, recovery, and repair. Your files never leave your machine, and repair in particular runs in a sandboxed worker process with no network access at all. The app is signed and notarized by Apple and made by GoodDev LLC.

How much does it cost, and is there a guarantee? Scanning and preview are free forever with no account. Unlocking recovery and repair is $59 per year or $89 for a lifetime license, covering up to 3 devices, and recovery is backed by a 30-day guarantee.