Start with these three steps
Stop saving to the source
Avoid new downloads, application installs and recovery exports on the disk that held the deleted files. Use another device for research.
Inspect Trash and app recovery
Check Finder Trash for ordinary files and the relevant app’s deletion folder for app-managed data such as photographs.
Note when and where
Record the original path, approximate deletion time, whether Trash was emptied and how much the MacBook was used afterwards.
Recover files still in Trash
Finder Trash is the first place to check when a normal file was removed. If the item is present, use Put Back or copy it to a safe location, then confirm its contents. A photograph deleted within Photos follows that app’s recovery mechanism rather than necessarily appearing as a separate Finder file.
If the missing material lived on an external disk, note that fact. Avoid emptying Trash or running a cleanup utility while you investigate. For a large deleted folder, inspect a sample of the restored contents before assuming that every subfolder and linked resource is back.
Sources: [1] Apple Support [2] Apple Support
Check the cloud’s retained deletion history
For files in iCloud Drive, eligible items can be recovered on iCloud.com within 30 days unless permanently removed. Use the account that held the files. Other cloud services have their own retention and version rules, so check the specific service rather than applying Apple’s window to all providers.
A synced folder is not automatically a separate historical backup: a deletion may reach other connected devices. Preserve any independent export or attachment you find. When the cloud restores a file, download and inspect a separate copy before reorganising the shared folder.
Sources: [3] Apple Support [4] Apple Support
Look for a copy from before deletion
Time Machine can provide the earlier file if a relevant backup remains. Local snapshots may also help while the MacBook’s own storage is accessible, even with the backup disk disconnected. They are temporary and share the same physical source, so they should not be treated as a second disk backup.
Compare candidate versions with the work you remember. For an overwritten document, an app’s version history may answer the question more directly than a broad disk scan. Keep an older useful draft even if it does not contain every final edit; it may substantially reduce reconstruction work.
Sources: [5] Apple Support [6] Apple Support [7] Apple Support
Understand the limit after Trash is emptied
On an SSD, TRIM and flash garbage collection can make deleted contents unavailable. The fact that little time has passed or that no large document was saved does not guarantee recoverable remnants. A recovery application cannot reconstruct bytes the storage no longer returns.
If no retained copy exists, keep the affected source unused and seek an assessment appropriate to its model and condition. Avoid installing a scanner onto that source or saving results there. Ask what evidence supports any proposed recovery, and distinguish complete originals from filenames, fragments and previews.
Sources: [8] Kingston Technology [9] Apple Platform Security
A realistic view of recovery
- Emptying Trash removes the ordinary restore route; later recovery is not guaranteed.
- A local snapshot can disappear as the system manages space, and it cannot rescue a physically inaccessible disk.
Your questions, answered
Is permanent deletion always recoverable with software?
Should I turn off TRIM now?
Where should recovered files be saved?
Need help with the original MacBook?
Describe the model, what happened and which data matters. Data Recovery Lab NZ is an external specialist; ask it to confirm the assessment route for your exact device.
Sources & further reading
Primary and specialist guidance checked 27 October 2026. Features and instructions depend on the model and operating system.