My Mac’s APFS drive stopped mounting after a crash, and Disk Utility hasn’t been able to repair it. I’m trying to recover important files before I risk making things worse. What are the safest APFS data recovery steps or tools to try?
I’d stop using that APFS drive right away. That’s the part people underestimate. Saving new files, installing apps, or even letting macOS keep running normally can write over deleted data and make recovery harder.
What you do next depends a lot on the drive type.
If it’s an external HDD, or an older Mac with an APFS-formatted hard drive, recovery odds are usually decent as long as nothing has overwritten the data yet.
If it’s an SSD, it gets more annoying because of TRIM. TRIM tells the SSD which deleted blocks it can clear out. Once those blocks are actually erased, recovery software can’t magically rebuild them. So if this happened on an APFS SSD, don’t keep using the Mac and hope the files show up later. The longer it runs, the more chance TRIM has to make the deletion permanent. On newer macOS versions, you usually can’t turn TRIM off for the internal SSD anyway, so the main thing is to act fast.
Before paying for or running recovery software, check the simple stuff first:
- Time Machine backups.
- Any available APFS snapshots.
- FileVault encryption. If the drive is encrypted, it generally needs to be unlocked or decrypted before recovery tools can scan it properly.
For the actual recovery attempt, Disk Drill is the one I’d try first. It handles APFS as a file system, not only as a raw signature scan, so if the APFS metadata is still there, you may get folder structure and filenames back instead of a pile of random files.
The safer workflow is something like this:
- Install Disk Drill on a separate drive, not the one you’re trying to recover from.
- Attach the affected APFS drive.
- Run a full scan.
- Use preview to check whether the files look intact.
- Recover to another disk. Don’t save recovered files back to the original drive.
The preview step is worth doing because it tells you pretty quickly whether the files are likely usable before you waste more time.
If the drive won’t mount, drops connection, or is making weird noises, don’t start “fixing” it yet. I’d avoid First Aid or any repair tool that might write changes to the disk until the important files are copied out. Recover first, repair later.
Best case, this is just deleted files or APFS corruption. That’s a much better situation than a failing drive.
9 Likes
If the drive is physically failing, skip the repair attempts and make an image/clone first. Disk Drill or any other recovery tool should scan that copy, not the original, because a long APFS scan can be enough to push a weak drive over the edge.
A drive that shows up consistently in System Information is a very different problem from one that vanishes, clicks, or disconnects mid-scan. If it stays visible, I’d treat this as an APFS/container issue and focus on copying or imaging it before doing anything clever. If it’s unstable, software recovery is the wrong first move and a lab may be the safer call. Small caveat: don’t keep trying First Aid because “maybe the next run fixes it.” APFS repairs can change metadata, and that can make a recovery tool’s job worse. Disk Drill or similar is fine after you have a clone/image, but the boring step of proving the drive can be read reliably matters more than which app you pick.
First Aid failing does not mean the files are gone. It usually means macOS can’t make the APFS volume consistent enough to mount safely. Those are different problems, and treating them the same is how people accidentally turn a recoverable disk into a worse mess.
The warning I haven’t seen stressed enough is the macOS pop-up that says the disk is unreadable and offers to initialize it. Do not click anything that creates, erases, formats, converts, or “sets up” the disk. Same goes for trying random terminal commands from old HFS+ recovery posts. APFS containers, volumes, snapshots, and encryption add enough weirdness that a command that sounds harmless can still write to the disk.
I agree with the clone-first advice, but make sure the destination is bigger than the whole physical disk or APFS container, not just bigger than the files you hope to recover. People underestimate this when the volume used to show “300 GB used” on a 1 TB drive. Imaging may still need room for the 1 TB device. If you can make a read-only image from another Mac or a booted external system, that is a safer place to let recovery software chew for hours.
After that, Disk Drill is a reasonable tool to try, but I would not judge the scan only by whether it shows the old volume name. Sometimes an APFS recovery scan finds the data under a generic container or “lost” section, especially if the volume records are damaged. Preview a few boring files too, like PDFs, photos, and documents you know should open. A file list with filenames is nice, but it doesn’t prove the contents are intact.
If FileVault was enabled, keep the password/recovery key handy and don’t wipe the Mac thinking you can “reinstall and then recover.” Encryption changes the whole situation. Without being able to unlock the APFS volume, most consumer recovery results will be useless noise. And if the drive starts disconnecting, slowing to a crawl, or throwing I/O errors during imaging, stop there. That’s the point where persistence is not bravery, it’s just extra wear on the only copy.