Data security
Protecting your Mac data: a strategy that actually holds up
A MacBook stolen on a train, an SSD that dies without warning, a folder dragged to the Trash on a Friday evening and emptied on Monday: data loss rarely happens in dramatic fashion. It happens through a small mistake at the wrong moment. The good news is that macOS already ships with most of the tools you need to guard against it. The less good news is that they only protect you if they were set up before the incident.
Here is the strategy we recommend, from the fundamentals to the finer points, with its limits stated plainly.
The 3-2-1 rule, the foundation of any protection
The 3-2-1 rule is easy to remember and remarkably effective:
- 3 copies of your data: the original on your Mac plus two backups.
- 2 different types of storage: for example the internal SSD and an external drive, so a single failure cannot take out everything.
- 1 copy off site: at home and at the office, or in an online service, so you survive theft, fire or water damage.
In practice, for most people, that means: the Mac itself, a Time Machine backup on an external drive or a NAS, and a third copy of important documents in a cloud service or on a second drive kept somewhere else. It is neither expensive nor complicated, but it is the only setup that withstands the scenarios that actually happen.
Time Machine: the cornerstone, as long as you understand it
Time Machine is built into macOS and covers most needs. Turn it on in System Settings > General > Time Machine, then choose an external drive or a compatible network volume (NAS). By default it keeps hourly backups for the past 24 hours, daily backups for the past month and weekly backups beyond that, until the disk is full, at which point the oldest ones are deleted.
On APFS volumes, macOS also creates local snapshots on the internal disk. They let you go back in time even when your backup drive is not connected, but they are not a backup: if the SSD dies, they die with it. They also reserve space, which macOS frees automatically as the disk fills up.
What Time Machine does not do:
- it does not protect you from theft if the backup drive sits next to the Mac;
- it backs up nothing if the drive has not been plugged in for three weeks;
- it cannot guarantee that a file created and deleted between two hourly backups will be in the history.
A useful habit: check the date of the latest backup from time to time, shown in the Time Machine settings.
iCloud Drive and FileVault: two protections, two roles
iCloud Drive syncs, it does not back up
iCloud Drive is convenient, but it is a sync service: when you delete or overwrite a file on one device, the change spreads everywhere. There is a safety net, but it is short: deleted files stay for about 30 days in Recently Deleted (on iCloud.com, and in the album of the same name in Photos), then they are gone. iCloud makes a good off-site copy of your documents, not a long-term versioned backup.
FileVault protects against theft, not against loss
FileVault encrypts the contents of your startup disk: without your password, a thief can read nothing. Turn it on in System Settings > Privacy & Security > FileVault. During setup, macOS offers to let your iCloud account unlock the disk or to generate a recovery key. Write that key down and keep it away from the Mac: if you forget your password without it, your data is lost, including to you.
The Trash, your first safety net
Most everyday losses come not from hardware failure but from deleting too fast. A few simple rules make all the difference:
- In the Finder, under Finder > Settings > Advanced, the option "Remove items from the Trash after 30 days" automatically clears old items. It helps with disk space, but it shortens your margin for error: your call.
- Avoid the ⌥ ⌘ ⌫ shortcut, which deletes immediately without going through the Trash.
- Before you Empty Trash, take a look at its contents, sorted by date.
Cleaning tools should follow the same logic. In MacNeat, every deletion goes through the Trash, with a delay before anything is permanently removed, and every operation is recorded in a history that lets you restore it or undo the last action. The details are on the Data protection page. To empty the Trash without regrets, see also our guide on emptying the Trash safely.
Once erased from an SSD, it is usually gone
This is the part many apps would rather not mention. On an old hard drive, a deleted file often remained readable until its location was reused. On the SSD of a recent Mac, things are different: macOS sends the controller a TRIM command that flags freed blocks, and the SSD wipes them in the background, often within seconds or minutes. Add the hardware encryption of Apple silicon Macs and Macs with the T2 chip, and once the Trash is emptied, the odds of recovering a file from the internal disk are very low, whatever the tool.
The picture is better on some external media (SD cards, USB flash drives, hard drives): that is the job of external media recovery, with its own limits. But on the Mac itself, the only real insurance is the backup you made beforehand.
Test a restore, the step nobody takes
A backup you have never tested is an assumption. Once a quarter, take ten minutes:
- Pick an unimportant file, edit it, then restore yesterday's version from Time Machine (open the folder in the Finder, then enter Time Machine from the menu bar).
- Check that your off-site copy really contains your essential folders, and that it is up to date.
- Make sure your FileVault recovery key is still where you think you put it.
- Write down the date: the next check will be quicker.
This small ritual turns a theoretical strategy into real protection. The day an SSD fails, the difference is measured in years of photos and documents.