Disk Utility erased my APFS drive while I was trying to fix or reformat it, and now important files are missing. I need advice on the safest APFS data recovery steps for macOS, including whether to stop using the drive, try recovery software, or contact a professional service.
First thing: stop using the drive. Seriously. The deletion itself usually isn’t the worst part. The real damage happens when macOS keeps writing new data over the space where your old files still might be sitting.
On a regular hard drive (HDD), deleted files can often be recovered as long as they haven’t been overwritten yet. With an SSD, it gets messier because of TRIM. Once TRIM wipes those deleted blocks, recovery software can’t bring them back. So if the missing files matter, shut things down and don’t keep poking around on that Mac.
I had to deal with something similar and used Disk Drill. It was more straightforward than I expected, but the way you run it matters.
What I’d do:
- Install Disk Drill on another drive, not the one you’re trying to recover from.
- Connect the APFS drive, or choose the internal drive if that’s where the files were deleted.
- Give it Full Disk Access when macOS asks. Without that, it may not scan APFS volumes properly.
- Select the APFS volume and run the full scan, usually called “Search for Lost Data.”
- Let the scan finish before recovering anything. You may see more results if you wait.
- Use preview first. Make sure the documents, photos, or whatever you need actually open.
- Recover the files to a different drive. Don’t save them back to the same APFS volume.
The useful part for me was that Disk Drill kept the original folder layout for a lot of the files. That makes a huge difference compared with getting thousands of random filenames dumped into one folder. It also shows recovery chances for many items, so you can avoid wasting time restoring stuff that probably won’t open anyway.
If you erased the drive in Disk Utility, that doesn’t always mean the data is instantly gone. A quick erase often removes the file system info without overwriting every bit of old data right away. Recovery can still work if nothing new has been written to the drive. The big exception is an encrypted APFS volume. If FileVault was on and the volume was formatted, the old encryption keys may be gone, and without those, the previous data usually isn’t recoverable.
If Disk Drill doesn’t turn up what you need, PhotoRec is another option. It’s free, but it’s much rougher. It scans by file signatures instead of APFS metadata, so you usually lose filenames and folder structure. Still, it can be useful for things like photos and videos.
I wouldn’t keep trying software recovery if the drive seems physically unstable. Stop if it:
- keeps disconnecting,
- clicks, grinds, or beeps,
- only shows up sometimes,
- or freezes every time you scan it.
At that point, it’s better to talk to a recovery lab. Powering up a failing drive over and over can make the situation worse. A lot of reputable places will evaluate it for free and some work on a “no data, no fee” basis. Logical recovery might be a few hundred dollars, while physical damage or clean-room work can easily go past $1,000.
If it’s just deleted files or a quick format, though, software recovery is often worth trying first. Just act fast and don’t recover anything back onto the same drive.
10 Likes
Recovering an erased external APFS hard drive is a different situation from recovering the internal SSD in a newer Mac. With an external HDD, you may still have a decent shot if it was a quick erase. With an internal SSD, especially on newer Macs with TRIM and encryption involved, the window can close fast or already be closed.
I agree with @mikeappsreviewer on stopping use, but I’d be a little more cautious about scanning the original drive directly if the files are important. The safer move is to make a byte-for-byte image or clone of the drive first, then run Disk Drill or whatever recovery tool against the copy. Scans are usually read-only, but if the drive is flaky, every long scan is still stress on the device. If it’s an internal Mac drive, boot from another Mac, an external macOS install, or recovery media if possible. Don’t reinstall macOS, don’t run First Aid repeatedly, and don’t create a new APFS volume on the same disk just to “test” it.
Another detail people miss: check exactly what Disk Utility erased. If you erased only one APFS volume inside a container, there may be other volumes or snapshots still around. If you erased the whole container or physical disk, recovery gets harder because the APFS structure is gone. Before paying for a lab, it’s worth checking Time Machine, iCloud Drive recently deleted, Photos recently deleted, and any app-specific cloud trash. Boring answer, but those are often faster than carving files back from a damaged APFS map.
A drive that was erased and then unplugged is a totally different case from a drive that was erased, reformatted, and used again for a few days. Before running Disk Drill or anything else, I’d first take a screenshot of Disk Utility with “Show All Devices” enabled and, if you’re comfortable in Terminal, save the output of diskutil list somewhere else. That tells you whether you’re dealing with a missing APFS volume, a wiped container, or a whole-device erase. Small detail, but it can stop you from scanning the wrong level of the disk or accidentally initializing something macOS offers to “fix.” If the drive pops up with a message like “not readable” or asks to initialize, cancel it. Don’t format it just so recovery software can see it. Scan the physical device or an image of it, and recover to a separate disk only.
If this was a modern Mac’s internal SSD, set your expectations low before spending a weekend scanning it. On T2 and Apple silicon Macs, the internal storage is encrypted at the hardware level even if you never thought much about FileVault. If Disk Utility removed the APFS container or you used Erase All Content and Settings, the old keys may be gone, and recovery tools will mostly find noise or newer system files.
For an external APFS drive, especially a spinning hard drive, the advice above is much more useful: stop writing to it, don’t let macOS “initialize” it, and recover to a different disk. But I’d be careful with the wording “erased” here. If you only erased a volume inside the APFS container, recovery might be possible. If you selected the top physical device and erased that, your odds drop. If you changed from APFS encrypted to APFS, ExFAT, or Mac OS Extended, that matters too.
A small thing people forget: don’t install recovery software on the same Mac if the lost data was on the internal drive. Even downloading Disk Drill, browser cache, Spotlight, swap, and app updates can write a surprising amount. If you’re going to try software, run it from another Mac or an external boot drive, and treat the original disk as something to read from only. If the files are worth more than the cost of a lab, don’t “test a few apps” first. Pick the least risky path once, because repeated scans and repairs don’t improve the original drive.