How to Recover Deleted Files on Mac (Time Machine and Beyond)

You deleted a folder from Documents. You emptied the Trash because you were “cleaning up.” Five minutes later, you realized that folder had the only copy of something you needed. Now what?

The good news: macOS has more recovery options than people realize. The bad news: the longer you use the Mac after deletion, the worse your odds get. Here’s a full hierarchy of recovery options, from “free and easy” to “last resort.”

Step zero: stop using the Mac

The moment you realize you deleted something important, minimize disk activity. Every file write to the SSD risks overwriting the deleted file’s blocks. SSDs make this especially dangerous — they constantly rewrite blocks for wear leveling, and TRIM (which macOS enables by default) actively zeros out deleted blocks.

Practical steps:

• Don’t install any new software (including recovery software, yet)
• Don’t reboot
• Don’t run cleanup apps
• Don’t run macOS updates

The first thing to try is a recovery method that doesn’t require any new disk activity. That means starting with Time Machine, snapshots, and iCloud — none of which require installing anything.

Check the Trash first (yes, really)

Sometimes “deleted” means moved to Trash, and Trash hasn’t been emptied yet. Open Finder and look:

• Click the Trash icon in the Dock
• Look for the file
• Right-click and choose Put Back to restore it to its original location

If you have multiple Trash locations (each connected drive has its own), check each one. The Trash on a USB drive isn’t the same as your boot drive’s Trash.

If the file isn’t there, move on.

Time Machine: the obvious answer

If you have Time Machine running, this is your first real recovery option.

1. Open the folder where the file used to be
2. Click the Time Machine icon in the menu bar (or open Time Machine from Launchpad)
3. The interface shows the folder at different points in time
4. Use the timeline on the right to scroll back to before the deletion
5. Select the file (or folder)
6. Click Restore

Time Machine restores the file to its original location. If the original location no longer exists, it’ll create the necessary folders.

If you can’t find the file in any backup snapshot, either:

• The deletion happened between hourly backups (rare but possible)
• The file was excluded from Time Machine
• Your Time Machine backups have been thinned past the deletion date

For files deleted within the last 24 hours, you should always find them in Time Machine snapshots if Time Machine is enabled.

Skip the manual huntSweep clears the system caches, logs, and old installers a backup can’t reach. Download Sweep free →

Local APFS snapshots (Time Machine’s secret feature)

Even if your Time Machine drive isn’t connected, macOS keeps local snapshots of your boot drive on the Mac itself. These last 24 hours by default.

To browse them:

1. Open Applications → Utilities → Migration Assistant… wait, that’s not it.
2. Actually: open Time Machine from the menu bar with no destination connected
3. macOS will show snapshots stored locally

Or via Terminal:

tmutil listlocalsnapshots /

You’ll see entries like com.apple.TimeMachine.2026-04-28-093000.local. Each is a point-in-time snapshot.

To browse a specific snapshot, mount it:

sudo mount_apfs -s "com.apple.TimeMachine.2026-04-28-093000.local" /Volumes/Snapshot

Then cd /Volumes/Snapshot/Users/yourusername/ and copy the file you need. Unmount when done:

sudo umount /Volumes/Snapshot

This is rough but works. It’s the recovery method that works even if your backup drive is gone.

iCloud Drive: 30 days of deleted file history

If the file lived in iCloud Drive, iCloud keeps deleted files for 30 days.

1. Open Finder
2. Click iCloud Drive in the sidebar
3. Look in the Recently Deleted folder

Or via the web:

1. Go to icloud.com and sign in
2. Open iCloud Drive
3. Click Recently Deleted at the bottom
4. Find your file, click Recover

This works for anything in iCloud Drive, including Desktop and Documents if you have iCloud Drive’s “Desktop & Documents Folders” feature enabled.

Don’t wait — at 30 days, files are gone permanently from iCloud. Set a calendar reminder if you discover the deletion late.

App-specific recovery

Some apps keep their own version history independent of Time Machine:

• Microsoft Office — Word, Excel, PowerPoint keep auto-recovery copies. Check ~/Library/Containers/com.microsoft.Word/Data/Library/Preferences/AutoRecovery for Word.
• iWork (Pages, Numbers, Keynote) — versions are kept inside the document file itself. Open the file and File → Revert To → Browse All Versions...
• Photoshop / Illustrator — autosaves in ~/Documents/Adobe/[App] [Year]
• Notes — deleted notes go to a “Recently Deleted” folder for 30 days
• Mail — deleted messages go to “Trash” for 30 days, then “Recently Deleted” for IMAP accounts

Before reaching for serious recovery tools, check whether the app itself has an undelete option.

Recovery software: when to use it

If Time Machine, snapshots, and iCloud have all failed, recovery software is your next option. The usual names:

• Disk Drill ($89, free trial scans without recovering)
• Data Rescue ($99)
• PhotoRec (free, command-line, focused on media files)

How recovery software works: it scans the drive for “deleted but not yet overwritten” file signatures. The longer it’s been since deletion, the worse the odds.

Important caveats:

1. Don’t install recovery software on the same drive as the deleted file. Every install is a write that could overwrite what you’re trying to recover. Install from a different drive or a USB drive if possible.
2. TRIM on SSDs reduces success. Modern Macs have TRIM enabled, which actively zeros deleted blocks. Recovery rates on SSDs are much lower than on HDDs.
3. Time matters. A file deleted 5 minutes ago has much better recovery odds than one deleted yesterday.

For SSDs specifically, recovery software is a Hail Mary, not a reliable option. If TRIM has run (which is automatic), the file is genuinely gone.

Recovery from external HDDs

External hard drives are easier to recover from than SSDs because they don’t have aggressive TRIM. If the deleted file was on an external HDD:

1. Stop using the drive immediately
2. Connect it to a Mac with recovery software installed
3. Run a deep scan with Disk Drill or Data Rescue

Recovery rates on HDDs depend on:

• How long since deletion (less time = better)
• How much new data was written since (less = better)
• Whether the drive itself is healthy (failing drives complicate things)

For valuable data on a failing drive, consider professional recovery services. They cost $300-2000 but recover from drives that consumer software can’t touch. Look for services that don’t charge unless they recover (DriveSavers is the major name in the US).

Reclaim local snapshot spaceSweep finds APFS local snapshots Time Machine left behind. Get Sweep free →

What to do during recovery

While recovery software is scanning (which can take hours):

• Don’t do anything else on the Mac
• Don’t update macOS
• Don’t run other software that writes to the disk
• Definitely don’t run cleanup tools

Cleanup tools can be especially dangerous mid-recovery — they’re designed to clear “unused” data from the drive, which is exactly the data you’re trying to recover. Pause any scheduled cleanups before starting recovery.

Preventing the next time

Once you’ve recovered (or accepted that you can’t), set up better safety nets:

1. Time Machine on a permanently-connected drive. A USB drive that lives on your dock means hourly backups happen automatically.
2. iCloud Drive with Desktop and Documents. Anything in those folders gets cloud backup with 30-day deletion recovery.
3. A second backup destination. Time Machine supports multiple destinations. Add a second drive that lives somewhere different (work, family, off-site).
4. Cloud backup like Backblaze. $9/month for unlimited cloud backup means even your external drives are covered.

The goal is “deleted file” being a 30-second annoyance instead of a 3-day panic. Three independent backups means you’d have to lose all three plus the original to actually lose data.

What Sweep does and doesn’t do

Sweep cleans the categories of files that are safe to remove — caches, logs, old installers, app leftovers. It shows you a preview of what it’ll delete before doing anything. You can always cancel.

It is not data recovery software. If you’ve already deleted important files, Sweep can’t get them back.

What Sweep does help with: keeping the boot drive clean enough that local APFS snapshots have room to grow, and keeping Time Machine backups focused on real data instead of cache cruft. A leaner Mac means more recovery options stay available longer.

The right mental model: Sweep is the broom that keeps your Mac tidy. Time Machine is the safety net for when you delete something important. iCloud is the offsite copy for when both fail. Recovery software is the last resort for when everything else fails. Layer them and you stop worrying about lost files.

When the file is genuinely gone

Sometimes the file is just gone — no backup, no snapshot, recovery software fails, the SSD has TRIM-zeroed the blocks. Accept it.

The cost of obsessing over an unrecoverable file is high. The fix is fixing your backup strategy so this doesn’t happen again. Set up Time Machine today. Enable iCloud Drive for important folders. Buy a Backblaze subscription. The next deletion gets recovered in 30 seconds instead of 3 days, because you set things up right.

The file you can’t recover is the lesson that pays for the backup setup. Don’t waste the lesson.