Method
How to recover your data on a Mac, step by step
When data goes missing, the natural reflex is to try everything at once: download three apps, restart, plug the drive in and out ten times. That is often exactly what turns a recoverable loss into a permanent one. A calm, orderly method gets far better results.
This guide gives you what to do in the first five minutes, then a decision tree that points you to the right fix for your situation. For the technical background (SSDs, TRIM, encryption), also read our Mac data recovery guide.
The first five minutes: what to do (and what not to do)
These steps apply in every case, before you even know exactly what happened:
- Stop writing to the affected device. No downloads, no copying, no installing software on it. If it's an SD card or USB stick, eject it properly and put it away.
- Don't empty the Trash and don't run any automatic cleanup.
- Don't format anything, even if macOS offers to “initialize” a disk it can't read. Click Ignore or Eject.
- Write down what happened: approximate file name, folder, last modified date, app used. These details speed up every search.
- If the drive makes noise (clicking, grinding), unplug it immediately and skip to the last-resort section of this guide.
The decision tree
Answer the questions in order. As soon as the answer is “yes”, follow the suggested path.
- Could the file have been moved or renamed rather than deleted? Yes: search with Spotlight, Recents and versions (see finding lost files).
- Was it deleted in the Finder just a few seconds ago? Yes: press Cmd + Z.
- Has the Trash not been emptied yet? Yes: open it and use Put Back.
- Was the file in iCloud Drive, Photos, Notes or Mail? Yes: check their Recently Deleted folders (usually 30 days).
- Do you have Time Machine or another backup? Yes: restore from the backup.
- Was the file on an SD card, a USB stick or an external hard drive? Yes: scan the device with a recovery tool and restore to a different disk (see external media recovery).
- Was the file only on the internal SSD, with the Trash emptied and no backup? The chances are close to zero. Look for a copy elsewhere: an email attachment, a chat app, a USB stick, another computer, a colleague.
Summary table by situation
| Situation | First action | Chances |
|---|---|---|
| File can't be found | Spotlight (Cmd + Space), Recents | Very good |
| Deleted, Trash not emptied | Trash, Put Back | Certain |
| Document overwritten or changed | File > Revert To | Good |
| Deleted from iCloud Drive | iCloud.com, Recently Deleted | Good within 30 days |
| Trash emptied, Time Machine on | Restore from Time Machine | Good |
| Trash emptied, internal SSD, no backup | Look for a copy elsewhere | Close to zero |
| SD card or USB stick wiped or formatted | Stop writing, scan the device | Good to fair |
| Drive clicking or no longer recognized | Unplug, recovery lab | Variable |
Restoring from Time Machine
If a backup exists, this is the safest route:
- Connect the backup disk (or make sure the NAS is reachable).
- In the Finder, open the folder where the file used to be.
- In the menu bar, click the Time Machine icon and choose Browse Time Machine Backups. If the icon isn't shown, open the Time Machine app from the Applications folder.
- Use the arrows or the timeline to go back to a date when the file existed. Press the Space bar for a preview.
- Select it and click Restore. It returns to its original location; if a file with the same name exists, macOS asks which one to keep.
Tip: even with no backup disk connected, Time Machine keeps recent local snapshots on the internal SSD when it can. They appear in the same interface.
Using a recovery tool without making things worse
A recovery tool only makes sense on an external device that isn't encrypted, or that is encrypted with a password you know. The golden rules:
- Install the tool on the Mac, never on the device you want to scan.
- Always restore to a different disk than the source. Restoring onto the SD card itself would overwrite the files you still want back.
- Start with a read-only scan and check the previews before restoring: file names are sometimes lost while the content is intact.
- For a phone (iPhone or Android connected over USB), a tool only sees accessible files, such as the photos in DCIM. No low-level scan is possible.
That's how MacNeat's External Media Recovery module works: it reads the device, lists the files present and the deleted files that can still be recovered, and requires the restore destination to be outside the source device.
When to stop and hand the drive to a professional
Stop handling the drive if it clicks, gets unusually hot, disappears and reappears in Disk Utility, or has been dropped or exposed to water. Don't run First Aid on a physically failing drive: the repair writes to the disk and puts strain on fragile mechanics.
A data recovery lab works in a clean room, replaces read heads if needed and clones the drive sector by sector before any analysis. Ask for a diagnosis with a quote and a “no data, no fee” policy.
After the loss: set up real protection
Once the crisis is over, take ten minutes to make sure it doesn't happen again:
- Turn on Time Machine in System Settings > General > Time Machine, with a dedicated drive.
- Keep a second copy of vital files elsewhere (iCloud Drive or another service, a drive stored away from home).
- Don't keep your only copy of photos on an SD card: import them after every shoot.
- Use tools that never delete without a safety net. MacNeat sends every deletion through the Trash, keeps a restorable history and warns you if Time Machine hasn't made a recent backup (see Data Protection).