Recovery tools on actively used SSDs often fail. Act quickly and avoid disk-heavy work until recovered.
What you will achieve
Recover recently deleted files on Mac using Trash, Time Machine, iCloud, and last-resort tools.
Deletion on Mac flows through Trash, then filesystem free blocks, then overwrite. SSD TRIM makes undelete window small. Act fast: stop writing disk, check Trash and Time Machine, then cloud Recently Deleted, then professional recovery only for valuable spinning-rust drives.
1) Trash first
Open Trash — right-click file → Put Back. Trash auto-empties after 30 days if enabled in Storage settings.
2) Time Machine
Enter Time Machine from the original folder location; go back before deletion; Restore.
3) iCloud Drive
Visit iCloud.com → Drive → Recently Deleted — recover within 30 days. Local-only files never synced will not appear.
4) App-specific bins
Photos Recently Deleted, Mail rebuilds, and Dropbox/Google Drive version history — check the service that held the file.
5) Last resort
Stop writing to disk — new data overwrites free blocks. Tools like Disk Drill may recover unencrypted APFS trash — success not guaranteed on TRIM SSDs. Professional recovery for mechanical drives only.
6) Versions in apps
Pages, TextEdit, and Office auto-save versions — File → Revert To → Browse All Versions even if file deleted from Finder if app had it open. Save copy immediately after recovery.
7) APFS snapshots
Time Machine local snapshots may hold deleted file hours — enter Time Machine in folder without external disk attached; local snapshots appear in timeline. Not guaranteed after heavy disk write.
8) Professional recovery
Mechanical drives: power off after click of death, ship to clean-room lab. SSD: success rate low — prevention beats recovery.
Verify
File opens from original location; confirm copies on backup if primary was corrupted.
Additional troubleshooting notes
If steps above do not resolve the issue on the first attempt, reboot once, confirm System Settings → General → Software Update is current, and retry with a second administrator account to rule out profile or keychain corruption in your daily user. Document exact error text from Console.app with timestamp — vague “it still fails” without logs wastes support time. On Apple Silicon, re-test after full shutdown (not just restart) because firmware and Thunderbolt controllers reset only on cold boot. Intel Macs should repeat test in Safe Mode to bypass third-party login items. Before erase or keychain reset, verify Time Machine or clone backup completed — batch 3 guides assume Monterey/Ventura/Sonoma/Sequoia paths in System Settings; search Spotlight for renamed panes if your macOS version labels differ slightly.