What APFS local snapshots are and why they matter for accidental deletion
Short answer: APFS (Apple File System) stores point-in-time copies of the entire filesystem called local snapshots on the internal SSD. These are created automatically every hour when Time Machine is configured, and also before every macOS software update. Unlike Time Machine backups (which require an external drive), local snapshots live on the internal SSD and require nothing else. When you accidentally delete a file and empty the Trash, the file is gone from the live filesystem — but the previous version of the filesystem captured in a local snapshot still contains the file. The snapshot-based recovery process takes under five minutes and works on any Mac running macOS High Sierra or later (when APFS was introduced).
How to recover accidentally deleted files from APFS snapshots
Step 1: Stop using the Mac immediately
The moment you realise a file was deleted: stop all work and close all running applications. Every file write to the SSD — autosaves, browser cache, system logs — consumes space that could hold snapshot data. On a Mac with limited free space (less than 20% free), older snapshots are pruned within minutes of reaching the threshold. Putting the Mac to sleep or powering it off is the safest immediate action while you decide on a recovery approach.
Step 2: Check available snapshots with tmutil
Open Terminal (Applications → Utilities → Terminal) and run: tmutil listlocalsnapshots /. This lists all available local snapshots in the format com.apple.TimeMachine.YYYY-MM-DD-HHmmss.local. Find the snapshot taken closest to, but before, the time of deletion. If Time Machine is set up, you can also open the Time Machine app (System Settings → General → Time Machine) and click “Enter Time Machine” — it will display local snapshots in its star-field interface even without an external drive connected, and you can browse and restore through the familiar graphical interface.
Step 3: Restore the file from the snapshot
To restore a specific file using Terminal: tmutil restore -s com.apple.TimeMachine.YYYY-MM-DD-HHmmss.local /path/to/original/file ~/Desktop/recovered-filename. Replace the snapshot name and path with your specific values. The restored file appears on your Desktop. For a full folder or multiple files, navigate to the snapshot volume. Mount the snapshot: mkdir /tmp/snapshot-mount && mount_apfs -s com.apple.TimeMachine.YYYY-MM-DD-HHmmss.local / /tmp/snapshot-mount. Then browse /tmp/snapshot-mount/ in Finder by using Go → Go to Folder in Finder. Copy the files you need. Unmount with umount /tmp/snapshot-mount when done. For a related Time Machine scenario, see our Sequoia Time Machine corruption recovery guide.
Step 4: The India angle — when snapshots do not exist
On Macs where Time Machine was never configured, local snapshots may be minimal or absent. macOS does create automatic snapshots before software updates, but these are typically pruned within a day or two. For Indian Mac users who deleted a file more than 24–48 hours ago with no Time Machine history, snapshot-based recovery is usually not possible. At this point, file carving tools (software that scans raw SSD data for file signatures) can be attempted, but APFS recovery rates are significantly lower than for HFS+ (Apple’s older filesystem) because APFS uses copy-on-write — when a file is deleted, APFS updates allocation metadata without zero-filling the data blocks, but the lack of predictable signatures makes automated carving inconsistent. Our data recovery service can advise on whether carving is worth attempting for your specific file type.