APFS changed how your Mac stored its data. System Integrity Protection (SIP) changed which software could access the system. And Apple Silicon changed what could even be accessed. Many tools have failed to keep pace with these changes.
APFS takes local snapshots by default. Frequently a file deleted just over an hour ago is still present in one of those, so recovering from them incurs no cost and no risk.
Local APFS snapshots are created automatically on your Mac. Even if your Time Machine drive is unconnected at the time, hourly local snapshots remain. Boot up into macOS Recovery and launch Time Machine, or in Terminal type “tmutil listlocalsnapshots /” to view what’s available. Very often, a file that was deleted recently sits somewhere in one of these.
This method doesn’t cost anything, nor does it write anything, but resolves a large portion of all the things people typically pay someone else to help them fix. Therefore, this is something that should be attempted first, yet too many times it isn’t.
Instead of having one static catalogue with all of the information (like HFS+), APFS is made up of several containers which hold many different volumes and have dynamic shared spaces, as well as copy-on-write metadata and checkpointing. Therefore, tools created for HFS+ that were merely updated superficially may be able to locate some files but will misread the container structures. A tool worth using is built so it understands containers, can follow the checkpoint to construct a volume based on the previous stable state of the system, and is able to recognise and manage sparse and clone files without either duplicating or mangling them.
The tools you will see include Disk Drill, Data Rescue, DiskWarrior and R-Studio. And then there’s PhotoRec which also works but only returns files based upon their signature (i.e., not with names or within folders). Whatever tool you use, we would always recommend running it in read-only mode and when possible from an image.
On the newer Macs, due to the System Integrity Protection feature, many software programs cannot access certain areas of the computer. While this feature can be turned off inside Recovery, turning it off on a machine you are currently attempting to recover from is rarely recommended. More fundamentally, on all new T2 and Apple Silicon Mac computers, the internal hard drive(s) have been soldered into place and are encrypted by the security chip. Thus, these drives do not appear like regular disks to other programs. If your Mac boots properly, most programs can then function normally via macOS. However, if your Mac does not boot, there is almost never any way that any program can access those drives: it is simply a hardware design constraint and not a software constraint.
The reason for such great differences in recommendations for modern Macs versus older models lies with the fact that once the board fails, all data is gone. Therefore, act while your Mac still starts.
If your Mac will not boot and has soldered storage, no software can help. If an external drive is damaged or not recognised, then since it can be accessed neither physically nor through the operating system, then even if you were able to use some form of scanning software on the drive, this would cause further damage to the drive. In addition, if your drive contains encrypted information due to FileVault and you do not know the password for the encryption, then nothing can decrypt the information, including ourselves and all other third party decryption tools.
In those cases where the drive provides physical access to the drive itself (i.e., lift-out), we charge from £300 +VAT. However, for a Fusion Drive, we charge a flat £550 +VAT for recovery. We will provide a written quote based on a free 48 hour diagnostic prior to proceeding, as well as indicate at that time when software could have provided an adequate solution.
There are very few programs capable of working with APFS container structures and checkpointing. Typically, the usual suspects include Disk Drill, Data Rescue, DiskWarrior, R-Studio, and PhotoRec. Although PhotoRec is somewhat effective at carving out files based on signatures rather than file paths, its ability to return named files within their respective folders is severely limited. Before purchasing one of these products, we strongly recommend checking to see if APFS local snapshots are available.
Typically, yes. APFS takes local snapshots on its own; Time Machine also does them (hourly) regardless of whether the backup drive is connected. Look for a snapshot of a deleted file using tmutil listlocalsnapshots /, or access Time Machine from Recovery Mode. The chances are good you will find what you want if it was deleted recently.
If you have a T2 or Apple Silicon Mac which will not boot, the internal SSD is soldered onto the motherboard & is encrypted by the security chip; therefore it is treated as ‘hardware’ & cannot be accessed like all other disks. It is a hardware limitation & not a flaw in the software.
No. A write operation performed on an installation on a single drive will always overwrite the area where your deleted files reside. Do this install to an external disk instead, or preferably read the contents of your disk on another Mac by placing the target disk in Target Disk Mode, or by adding it to an enclosure.
For drives which you can remove, we charge from £300 +VAT. We charge a flat £550 +VAT if it is a Fusion Drive, in which both devices are recovered as one single volume. We do not offer recovery from soldered storage. A free 48-hour diagnostic and a fixed quote are provided before work begins.