I’m trying to recover files from an APFS-formatted drive after it stopped mounting properly on my Mac. Disk Utility can see the drive, but I can’t access the data, and I’m worried about making things worse. What’s the safest way to handle APFS data recovery and recover my files?
I’d stop using that APFS drive right away. That part matters more than anything else. Don’t save files to it, don’t install recovery tools on it, and don’t let macOS keep doing normal work on it if you can avoid it. Deleted data is only recoverable while those blocks haven’t been reused.
The type of drive makes a big difference here.
If it’s an external HDD, or an older Mac with an APFS-formatted hard drive, the odds can be decent as long as nothing has overwritten the missing data yet.
If it’s an SSD, it gets a lot less forgiving because of TRIM. TRIM lets the SSD know which deleted blocks can be cleared. Once that cleanup actually happens, recovery software can’t magically rebuild those files. So if this happened on an APFS SSD, don’t keep using the Mac and hope it sorts itself out. The sooner you stop, the better your chances. On newer macOS installs, you usually can’t turn off TRIM for the internal SSD anyway, so speed is basically your only advantage.
Before jumping into recovery software, check the simple stuff:
- Time Machine backups.
- Any available APFS snapshots.
- FileVault encryption. If the drive is encrypted, it has to be unlocked or decrypted before most tools can scan it properly.
For the actual recovery, Disk Drill worked best for me. It handles APFS as a file system instead of only doing raw file carving, so when the metadata is still there, it may preserve folder paths and original filenames.
The safest way to do it is something like this:
- Install Disk Drill on a separate drive, not the affected one.
- Attach the APFS drive you’re trying to recover from.
- Run a full scan.
- Use preview before recovering, so you can see whether the files are actually intact.
- Recover the files to another disk. Never write recovered files back to the same drive.
That preview step is worth doing. It saves you from wasting time recovering a bunch of broken files.
If the drive won’t mount, drops connection, or makes weird noises, I wouldn’t start running repair tools yet. Skip First Aid for now too, since repair attempts can write changes to the disk. Get the important files off first, then worry about fixing the drive.
If this is just accidental deletion or APFS corruption, you’ve got a much better shot than if the drive is physically failing.
Seeing it in Disk Utility does not mean the drive is healthy or safe to “repair.” If the data matters, clone/image the drive first and scan the clone, whether you use Disk Drill or something else. Working directly on the failing APFS disk is the shortcut that can turn a recoverable case into a mess.
Do not click “Erase,” “Initialize,” or anything that offers to make the disk usable again. macOS can be annoyingly casual about offering to reformat a drive it can see but can’t understand, and that is exactly the wrong direction if you care about the contents.
The comments above are right about cloning first, but there’s a small distinction that gets missed a lot: Disk Utility seeing the physical drive is not the same as macOS seeing the APFS container and volumes correctly. APFS has the physical disk, then the container, then the volumes inside it. Sometimes the drive is fine enough to identify, but the APFS container metadata is damaged or the volume won’t unlock/mount. In that case, “repairing the disk” can mean writing changes to the very metadata you need recovery software to read.
If this is an external drive, I would first remove the boring variables without doing anything destructive. Try a different cable, a different USB port, and if it is a bare drive in a cheap enclosure, a different enclosure or dock. Bad USB bridges can make APFS volumes look much worse than they are. Don’t spend an hour repeatedly plugging and unplugging it, though. A couple of controlled attempts is enough. If it keeps disconnecting, assume the drive is unstable and stop.
A detail I’d want clear before scanning is whether FileVault or APFS encryption is involved. If it is encrypted, the recovery tool needs the password or recovery key, and the result without that is usually just noise. Same deal if it was used as a Time Machine disk with APFS snapshots. You may see multiple volumes or snapshots, and the “missing files” might be sitting in a snapshot rather than needing a deep raw recovery.
For a non-clicky, non-dropping external HDD, my order would be:
- Get another empty drive that is at least as large as the problem drive.
- Make a byte-for-byte image or clone of the bad drive if the software you use allows it.
- Put the original drive away.
- Scan the clone/image.
- Recover to a third location, not the clone and not the original.
That sounds like overkill until the scan takes 10 hours and the original drive gets worse halfway through. Then the clone is the difference between “try again” and “well, that was the last read.”
Disk Drill is fine to try for APFS, especially if you can preview real files with names and folders intact. I would not treat any recovery app’s file list as proof until previews open correctly. A lot of tools can show impressive-looking trees full of files that are actually zero-byte, partially overwritten, or broken. If all you get is “reconstructed files” with generic names, that usually means the APFS structure was not readable and the tool is carving by file signatures. That can still save photos, PDFs, videos, etc., but it won’t be as clean.
I’d avoid using First Aid until after the important stuff is copied somewhere else. First Aid is a repair tool, not a recovery tool. Sometimes it works. Sometimes it “fixes” the filesystem into a state that mounts but has already discarded the damaged references you wanted recovered.
If the drive is making clicking noises, vanishing during scans, showing tons of read errors, or taking forever just to list basic info, software recovery is the wrong first move. That’s when a lab starts making sense, even if the price is painful. If the data is replaceable, scan a clone and see what you get. If the data is irreplaceable, every DIY attempt is a tradeoff.
Expect this to be boring and slow if it’s done safely. APFS recovery is usually not a “click repair and everything comes back” situation. Best case, the directory structure is readable and you get folders and filenames back. Worse case, you get a pile of carved files with missing names. Both can be “successful,” but they are very different outcomes.
A small thing people mess up here is imaging the wrong layer. With APFS, don’t just image the volume that used to mount if the tool gives you a choice. Image the whole physical device when possible, because the APFS container and volume metadata matter. If you only capture one visible volume, you may leave behind the exact structures a recovery program needs to rebuild the file tree. In Disk Utility terms, make sure “Show All Devices” is enabled so you can see the top-level device, container, and volumes separately.
I’d be careful with Terminal fixes from random guides too. Commands like fsck_apfs, diskutil repairVolume, or forced mount attempts can be fine when you’re fixing a disposable disk, but they’re not where I’d start for recovery. Same with trying to “convert,” “rebuild,” or “bless” anything. If the goal is data first, treat the drive like evidence: read from it, copy from it, don’t improve it.
Disk Drill is reasonable if you want a GUI path, but I wouldn’t pay for anything based only on a pretty scan result. Preview a handful of files that actually matter to you: a large video, a document, a photo, whatever you care about most. If previews work and filenames/folders look normal, that’s a much better sign than seeing a huge count of “recoverable” files. If it only finds generic JPEG0001-type results, that may still be useful, but set your expectations lower.
And don’t forget the boring destination problem: you need space for the image plus space for recovered files. A 2 TB failing drive can easily require a 2 TB clone target and another drive for recovered data. People start the scan, find files, then realize they have nowhere safe to put them. Sorting that out before touching the bad disk can save a lot of unnecessary extra reads.