APFS (Apple File System) is a proprietary file system introduced by Apple Inc. for macOS High Sierra and iOS 10.3, and later. This file system is specially designed for flash and solid-state drives (SSD) to fully utilize their features. As SSD devices become larger in capacity and cheaper in cost, they are more often used as external storage devices.
Only Mac computers running High Sierra and newer can read from and write to such disks. Windows and Linux computers cannot read and write to APFS disks without third-party software.
This article will show how to use R-Studio to recover files from an external SSD disk with the APFS file system that has been erased and then formated again as a new APFS device.
Before We Begin
Please note that this article explains how to recover files from an erased APFS disk. If you need to recover files from disks with other file systems, read our other articles:
The disk must show no signs of any hardware failures. Otherwise, inspection by professional data recovery specialists is necessary. Any attempts to work with a disk with serious hardware malfunctions may seriously degrade your chances of recovering the data, as it is very likely to inflict more damage to your data recovery chances, even for a data recovery specialist.
Signs that a disk has a physical failure include:
And one last reminder...
Do not connect the disk to a Mac computer that recognizes an APFS file system unless you're completely ready to start file recovery. It may effectively erase all the lost files without any visible signs of doing so.
Test Disk Setup: Initial Folder Structure and Files on the Drive
For this test, we used an external SSD disk formatted as an APFS storage device with the APFS_Old volume name. Then a file/folder typically set for an external disk was written to this disk.
Documents:
Multimedia:
Fig.1 shows the file/folder structure of our test disk:
Fig.1: Files and folders on the test disk.
Click image to enlarge
Using the Disk Utility in the macOS, we erased the old file system and created a new one with the APFS_New name. This new file system appears completely empty in Finder.
Data recovery process
Preliminary preparation:
1. Run R-Studio and locate the erased disk
Fig.2: R-Studio Main panel with the connected erased disk.
Click image to enlarge
Check the S.M.A.R.T. status of the erased disk. This can be done even if it's connected through a USB port.
Fig.3. S.M.A.R.T. status of the erased disk
Click image to enlarge
All S.M.A.R.T. attributes of our disk are OK, and we can proceed with file recovery.
2. Select the SSD device where the erased disk was located, click the Scan button, and specify scan parameters.
Fig.4. Disk scan dialog box and scan parameters
Click image to enlarge
Click the Change button and leave only the APFS file system selected to avoid searching for other file systems. Select Save to File and specify the place to save scan info. If the disk scan has to be interrupted, it can be resumed by loading the saved scan information.
Click the Known File Types button and select only those file types that may have resided on the disk. Select all file types, even those you don't want to recover. This is necessary to find the required files correctly. See the File Recovery Basics: How Data Recovery Works article if you would like to learn why.
Fig.5. Known file types selected for the erased APFS disk
Click image to enlarge
When you select all the necessary options, click the Scan button.
3. The scan will start and R-Studio will show its progress.
Fig.6. Disk scan in progress for the SSD device
Click image to enlarge
4. When the scan is over, inspect its results.
Fig.7. Scan results
Click image to enlarge
R-Studio should find the new APFS disk (Recognized4 - APFS_New in our case) and the erased APFS disk (Recognized5 - APFS_Old). R-Studio may find some other partitions that previously resided on the disk. Their size and position may give you a clue on how to find the one you're looking for. See R-Studio online help for more details: Data Recovery Using R-Studio.
It looks natural to open Recognized5, as it has the APFS_Old label, but when we double-click this partition, we see the following message:
Fig.8. Attempt to open the old APFS disk
Click image to enlarge
Clearly we must search for our lost files elsewhere.
The next candidate is the Recognized4 partition. When we open it, we can see the remnants of the erased file system and some Extra Found Files. As the new disk is completely blank, those files must belong to the erased file system.
Fig.9. Lost files on the scanned new APFS disk
Click image to enlarge
5. Inspect and preview files by double-clicking a selected file.
Some lost files are found through the analysis of the remnants of the file system on the erased disk. Their file names, paths, and some file attributes can be recovered.
Fig.10. Lost files form the erased file system
Click image to enlarge
The other files are found through the search for Known File Types (search for file signatures, or raw file recovery). Their file names, paths, and file attributes cannot be recovered. R-Studio either uses the internal file tags to create meaningful file names, or generates a random name like 0280.mp4.
Fig.11. Lost files found by the search for Known File Types
Click image to enlarge
You may search for a particular file or set of files using the advanced find and mark capabilities of R-Studio. See R-Studio help for more details: Searching for a File.
Try to preview as many files as possible to estimate chances for successful file recovery. Large picture and video files are particularly useful for this purpose.
When you're sure that chances for successful recovery of your lost files are high, you can purchase a license and register R-Studio. You can do this on-the-fly, without interrupting file recovery. See the R-Studio for Mac install/uninstall/register article for details.
When your copy of R-Studio is registered, you may start the actual file recovery.
6. Mark all necessary files and folders for recovery, click the Recover Marked button, and choose a place to save the recovered files.
Fig.12. Files and folders marked for recovery and recovery options
Click image to enlarge
If necessary, specify some other recover parameters. See R-Studio on-line help for details: Basic File Recovery. Then click the OK button.
File recovery will start and R-Studio will show its progress.
Fig.13. File recovery progress
Click image to enlarge
When the recovery is over, R-Studio will show a final report with the results.
Fig.14. File recovery results and report
Click image to enlarge
Sometimes R-Studio may throw some warnings that the files it's recovering already exist. It treats such files as specified in the Advanced tab of the Recover dialog box. By default it renames duplicate files.
Data recovery results
Results can be seen in the folder selected on the Recover dialog box.
Fig.15. Recovered Files
Click image to enlarge
Conclusions
R-Studio was able to successfully recover files from an erased APFS disk. It could restore some parts of the erased file system with file names, paths, and other attributes. The rest of the files were recovered without those attributes, but their content remained intact.
The key point of such success is the fact that nothing was written to the disk after it had been erased, and the Trim command was disabled in the system while recovering files.
R-Studio scanned the erased disk and found lost files in its demo mode, that is, without purchasing and registering the software. It was registered only when it became clear that the file recovery should be successful. Registration can be performed on-the-fly, without interrupting the recovery process.