APFS changed how a Mac stores things, System Integrity Protection changed what software may touch, and Apple Silicon changed what can be reached at all. Plenty of tools have not kept up.
APFS takes local snapshots automatically. A file deleted an hour ago frequently still exists in one, and restoring from it costs nothing and risks nothing.
APFS creates local snapshots automatically, and Time Machine keeps hourly local ones even when the backup drive is not connected. Boot into macOS Recovery and open Time Machine, or run tmutil listlocalsnapshots / in Terminal to see what exists. A file deleted recently is very often sitting in one.
This costs nothing, writes nothing, and resolves a large share of cases that people otherwise spend money on. It should be the first thing tried and it frequently is not.
APFS uses containers holding multiple volumes that share space dynamically, with copy-on-write metadata and checkpoints rather than a single static catalogue. A tool built for HFS+ and updated superficially will find some files and misinterpret the structure. The ones worth using understand containers, can walk checkpoints to reconstruct a volume from an earlier consistent state, and handle sparse and cloned files without duplicating or mangling them.
Disk Drill, Data Rescue, DiskWarrior and R-Studio are the names that come up; PhotoRec works too but carves by signature, so it returns files without names or folders. Whichever you choose, run it read-only and against an image if you can.
System Integrity Protection restricts what software can access, and while it can be disabled in Recovery, doing so on a machine you are trying to recover is rarely wise. More fundamentally: on T2 and Apple Silicon Macs the internal storage is soldered and encrypted by the security chip, and it is not presented as an ordinary disk. If the Mac boots, software can work through macOS normally. If it does not boot, there is generally no way for any tool to reach that storage — not a limitation of the software but of the hardware design.
This is why the advice for modern Macs differs so sharply from older ones: while it still starts, act. Once the board has failed, the data is beyond everyone.
If the Mac will not boot and has soldered storage, no software applies. If a removable drive is clicking or not detected, software cannot reach it and scanning a failing drive causes damage. If the volume is FileVault-encrypted and you do not have the password, nothing decrypts it — not us, not any tool.
Where the drive lifts out, recovery is from £300 +VAT; a Fusion Drive is £550 +VAT flat. Free 48-hour diagnostic and a written quote first, and we will say when software would have done the job.
The ones that genuinely understand APFS containers and checkpoints — Disk Drill, Data Rescue, DiskWarrior and R-Studio are the usual candidates. PhotoRec works but carves by signature, returning files without names or folders. Before buying any of them, check APFS local snapshots.
Often, yes. APFS takes local snapshots automatically and Time Machine keeps hourly ones even without the backup drive attached. Run tmutil listlocalsnapshots / or open Time Machine from Recovery — a recently deleted file is frequently still there.
If it is a T2 or Apple Silicon model that will not boot, the internal storage is soldered and encrypted by the security chip and is not presented as an ordinary disk — so no tool can reach it. That is a hardware design limit rather than a shortcoming of the software.
No. On a Mac with one internal drive, installing writes into the same space holding your deleted files. Install to an external volume, or better, read the disk from another Mac in target disk mode or via an enclosure.
From £300 plus VAT where the drive is removable, and £550 plus VAT flat for a Fusion Drive, where both devices are recovered as one volume. Soldered storage is not a service we offer. Free 48-hour diagnostic and a fixed quote first.