Data recovery
Mac data recovery: the honest guide
A document that vanished, an SD card that suddenly shows up as “unreadable”, a folder emptied by mistake: data recovery on a Mac follows very different rules depending on where the files lived and how they were lost. The good news is that a recent Mac comes with plenty of safety nets (Trash, versions, iCloud, Time Machine). The bad news, which few vendors are willing to put in writing, is that a file erased from the Trash on the internal SSD is, for all practical purposes, gone.
This guide separates what works, what sometimes works and what never works, so you don't waste your time or your money.
Three situations, three different answers
Before you go looking for a tool, figure out which case you're in. Almost every data loss on a Mac falls into one of these three categories:
- The file still exists, you just can't find it. It was moved, renamed, saved to another folder or to iCloud Drive. This is by far the most common case, and the fix is Spotlight, the Recents folder or version history. See how to find lost files on a Mac.
- The file was deleted, but a safety net kept it. The Trash, Recently Deleted in iCloud Drive or Photos, a Time Machine backup: as long as one of these exists, recovery is simple and complete. See how to recover deleted files.
- The file was erased and no safety net kept it. Now everything depends on the storage device: an SD card or a spinning hard drive leaves you a real chance, the internal SSD of a modern Mac almost none.
If you're not sure where to start, follow our step-by-step data recovery method, built as a decision tree.
Why a Mac's internal SSD is a special case
On an old hard drive, “deleting” a file simply marked its space as free: the data physically stayed in place until something else overwrote it. Recovery software is built on that principle. On a recent Mac, three mechanisms break it:
- TRIM: as soon as blocks are freed, macOS tells the SSD controller, which erases them in the background to keep performance up. A few minutes to a few hours is enough.
- Hardware encryption: on Macs with a T2 chip or Apple silicon (M1 and later), all internal storage is permanently encrypted by the Secure Enclave, even with FileVault turned off. Raw data read without the key is just noise.
- APFS: Apple's file system handles its metadata with copy-on-write and snapshots. Once snapshots expire, the references to the old blocks are gone.
The blunt conclusion: no software, MacNeat included, can promise to recover a file erased from the Trash on the internal SSD of a T2 or Apple silicon Mac. Anyone who claims otherwise is, at best, selling you hope.
The only realistic exception is a local Time Machine snapshot still on the disk, or a backup somewhere else.
External media: where recovery is still realistic
SD cards, USB flash drives and spinning hard drives formatted as exFAT, FAT32 or HFS+ usually don't receive TRIM commands and aren't encrypted by default. A deleted file stays readable as long as the space it used hasn't been overwritten. That's exactly the situation with a camera card wiped by mistake or a USB stick that got a quick format.
| Device | Chances after deletion | Condition |
|---|---|---|
| Internal SSD (T2, Apple silicon) | Close to zero | Unless there is a backup or snapshot |
| External spinning hard drive (HFS+, exFAT) | Good | Stop writing to it |
| SD card, CF card, USB flash drive | Good to fair | Stop writing to it |
| External SSD | Low to fair | Depends on TRIM support |
| Encrypted APFS volume without the password | None | The key is essential |
| Connected iPhone or Android phone | Accessible files only | No low-level scan |
The right moves are detailed in our guide to external media recovery.
The safety nets built into macOS
Before reaching for any third-party software, check these places, in this order:
- The Trash: Control-click the item and choose Put Back to return it to its original folder.
- Undo: right after deleting something in the Finder, Cmd + Z (Edit > Undo) reverses the move to the Trash.
- Versions: in Pages, Numbers, Keynote, TextEdit or Preview, choose File > Revert To > Browse All Versions.
- iCloud Drive: on iCloud.com, the Recently Deleted section keeps files for 30 days.
- Photos: the Recently Deleted album (under Utilities) keeps photos for 30 days.
- Time Machine: hourly backups for the past 24 hours, daily backups for the past month, weekly backups after that.
Time Machine: the only real insurance
If you remember only one thing from this guide, make it this: turn on Time Machine. An external drive with twice the capacity of your data costs less than a single visit to a recovery lab.
- Connect an external drive (or use a compatible NAS).
- Open System Settings > General > Time Machine.
- Click Add Backup Disk, pick the drive, then click Set Up Disk. Turn on backup encryption.
- Let the first backup finish (it often takes several hours).
To restore, open the Finder window where the file used to be, then choose Browse Time Machine Backups from the Time Machine menu in the menu bar (or open the Time Machine app). Go back in time with the timeline on the right, select the item and click Restore.
How MacNeat prevents loss instead of promising recovery
A maintenance utility deletes files by nature. So our approach is to make every deletion reversible rather than sell a miracle recovery:
- Everything goes through the Trash: MacNeat never erases anything directly, even during a bulk cleanup.
- Safe trash with a delay: items removed by MacNeat remain recoverable for a safety period before anything is permanently deleted.
- Deletion history: every operation is logged and can be restored from the history.
- Undoable operations: the last operation can be undone in one click.
- Time Machine check: MacNeat warns you if there is no recent backup.
For external media, the External Media Recovery module scans drives, USB sticks, SD cards and cameras, and always restores to a different disk than the source. All the safeguards are described on the Data Protection page.
When should you go to a recovery lab?
Software can only read what the hardware hands it. Stop right away and unplug the drive if:
- it makes clicking, grinding or repeated beeping noises;
- it no longer shows up at all in Disk Utility, or shows up with an absurd capacity;
- it was dropped, knocked or got wet;
- the data has serious professional or sentimental value.
Every time a damaged mechanical drive spins up, it can scratch the platters further. A specialist lab works in a clean room and quotes a price after diagnosis; expect anything from a few hundred to well over a thousand dollars depending on the failure. It's expensive, but less so than destroying the drive for good by insisting.