APFS Recovery: Copy-on-Write, Snapshots and the Real Window
APFS is copy-on-write: deleting a file removes the reference, not necessarily the blocks. Snapshots can keep those blocks alive. This is the most useful fact in Mac recovery.
Start with snapshots
Local APFS snapshots exist even without an external backup drive. Check them first — restoring a file from a snapshot takes minutes and is lossless.
Then the container
APFS containers hold multiple volumes sharing free space. A volume that will not mount may still have intact metadata on other volumes' objects. Imaging the container and parsing it is safer than running First Aid repeatedly.
Encryption
FileVault volumes need the volume password or a recovery key before any block-level work makes sense. No password, no plaintext — this is not a tooling limitation.
FAQ
Are deleted files recoverable on APFS?
Often yes if not overwritten and if no snapshot has been thinned; less likely on SSDs where TRIM reclaims blocks.
Does 'First Aid' help?
It repairs metadata in place. On a failing drive, image first; First Aid can make things worse.
Can I recover from an encrypted volume without the password?
No. There is no supported bypass.
Boundary: TRIM on Apple SSDs and FileVault without a key both end recovery; snapshots are the best remaining path.
Free evaluation in our Shenzhen lab; written quotation after inspection; no recovery, no fee. Mail-in service available for Hong Kong and overseas clients.