APFS Data Recovery: When a Mac Won’t Boot or a Drive Won’t Mount

You go to power on your Mac and instead of the usual login screen, you get a folder with a flashing question mark, or a circle with a slash through it. You plug in your external drive and macOS tells you the disk is unreadable, or Disk Utility throws an obscure error like com.apple.DiskManagement.disenter error -119930868. You open Photos and a year’s worth of photos appears to be missing. Your Mac is running so slowly that simple tasks take minutes, and Disk Utility keeps saying something is wrong with the volume but won’t say exactly what.

All of these are situations we see regularly in our lab. This article covers what they actually mean at the file system level, why one specific drive brand accounts for a surprising number of “APFS corruption” cases, what happens when files get deleted on a Mac (and why your data might already be sitting safely in iCloud), and how recovery works when the data really has been lost.

First, check iCloud before doing anything else

If the situation is “files are missing” or “an album disappeared from Photos” rather than “my Mac won’t turn on,” the very first thing to check is your iCloud account — because there’s a meaningful chance your data is already there, untouched. iCloud Drive, iCloud Photos, and most iCloud-synced apps retain deleted content for up to thirty days in a “Recently Deleted” folder that’s separate from the regular Trash. People often don’t realize this exists.

To check, go to iCloud.com in any web browser and sign in with the same Apple ID your Mac uses. Look for “Recently Deleted” inside Photos and inside iCloud Drive (each app has its own Recently Deleted area). On the Mac itself, you can also check by opening Photos and looking in the sidebar for “Recently Deleted,” and by opening Finder → iCloud Drive → the trash-like folder at the bottom of the sidebar. If your files are there, you can restore them with one click and skip the rest of this article.

If the files aren’t in iCloud’s Recently Deleted, or your situation is “my Mac won’t boot at all” rather than missing files, keep reading.

A short tour of APFS

APFS — Apple File System — replaced HFS+ as the default file system on every Mac running macOS 10.13 High Sierra or later. The architecture is different enough from older Mac file systems and from Windows-style file systems that it’s worth a brief overview, because understanding how APFS organizes data explains both why certain symptoms appear and what’s actually recoverable when something goes wrong.

The key concept is the container. Where older file systems gave you a fixed partition with a fixed size on each drive, APFS introduces an intermediate layer: a single physical drive holds a single APFS container, and that container holds multiple volumes that all share the same free space dynamically. On a typical modern Mac, the container holds at least five volumes: Macintosh HD (the read-only, cryptographically sealed system volume that holds macOS itself), Macintosh HD – Data (the read-write volume that holds your files, applications, and user accounts), Preboot (boot loaders and FileVault unlock helpers), Recovery (the macOS Recovery environment where Disk Utility lives), and VM (virtual memory swap). None of those volumes has a fixed size; they all draw from a shared pool.

APFS is also a copy-on-write file system, meaning when you modify a file it doesn’t overwrite the old blocks — it writes new ones and updates pointers. That underpins one of APFS’s most useful features: snapshots, which are read-only point-in-time references to the state of a volume. macOS automatically creates hourly snapshots of the Data volume in the background, and Time Machine creates more whenever it runs. As long as a snapshot exists referencing a file, that file’s data blocks are preserved on disk even if you “delete” the file. This is why deletion on APFS is a more nuanced process than on most other file systems — we’ll come back to that.

Common boot-time errors on a Mac

When something has gone wrong at the file system level or the drive level on a Mac that’s trying to boot, the firmware shows you one of a small set of symbols. Each one means something specific:

Folder with a flashing question mark. The Mac’s firmware could not find a valid startup disk. This usually means one of three things: the APFS startup volume is corrupted or missing, the startup disk selection in NVRAM points to a volume that no longer exists (often after a Boot Camp or external-drive setup change), or — very commonly — the physical drive itself is failing and the firmware can’t read the boot information from it. The last category is the one we see most often, and we’ll come back to it shortly.

Prohibitory symbol (a circle with a diagonal slash). The Mac found a startup disk but determined that the macOS on it is incompatible with the hardware. Often appears after an interrupted or partially-failed system update. The data on the volume is usually intact; the boot environment isn’t.

Apple logo that hangs partway through the loading bar. macOS started loading but encountered something it couldn’t get past. The progress bar reaches a point and stops, sometimes for hours. This pattern very often signals the underlying drive is throwing read errors during the boot process — the boot is technically progressing, but each read is taking many seconds or minutes because the drive is retrying repeatedly on damaged sectors.

Kernel panic on boot. macOS started, encountered a fatal error in the kernel, and rebooted to a screen telling you something went wrong and prompting you to restart. Causes range from incompatible kernel extensions to file system corruption to memory or storage hardware faults.

Recovery Mode reports First Aid errors. You boot into Recovery (Cmd-R on Intel Macs, hold power button on Apple Silicon Macs) and run Disk Utility’s First Aid against Macintosh HD. It comes back with errors it can’t repair — sometimes a specific error like “Internal Error” with code -69610, sometimes a more generic “First Aid found errors and could not repair them.” Recovery Mode itself is running, which is reassuring, but the main volume is reporting problems.

Common APFS mount and access errors

If the issue isn’t booting but is “I plugged in my external drive and it won’t mount” or “Disk Utility shows it but Finder won’t open it,” the error messages cluster around a few specific patterns.

com.apple.DiskManagement.disenter error followed by a number. This is the most common family of APFS mount errors. The number varies and tells you a bit about what went wrong:

• error 0 — generic mount failure; macOS knows there’s a problem but can’t classify it
• error 49218 — commonly appears on encrypted APFS volumes that won’t mount, especially after an improper eject
• error 49153 — mount failed during the file system probe stage
• error 49223 / 49244 — macOS can see the drive but can’t access its contents
• error -119930868 — “no identifiable file system” — macOS couldn’t recognize what’s on the drive at all, often after a botched format conversion or partial damage to the container header

The disk you inserted was not readable by this computer with options to Initialize, Ignore, or Eject. The classic warning that means macOS couldn’t find an APFS or HFS+ container where it expected one. Do not click Initialize. Initialize means “format the drive blank,” which is exactly the opposite of what you want if your data is still on it.

First Aid Process Failed. The operation couldn't be completed. (com.apple.DiskUtility error 1.) or with internal error code -69610. Disk Utility’s repair tool encountered something it can’t fix. Often this is a file system layout inconsistency that Apple’s tools simply weren’t designed to handle — APFS’s on-disk format documentation has historically been limited, and Disk Utility’s repair capabilities are correspondingly limited.

com.apple.StorageKit error 118. Often seen during attempts to convert a HFS+ volume to APFS that don’t complete. The volume can end up in a state where neither file system is fully valid.

An important honest point about all of these errors: in most of the cases we see in our lab, the underlying data is still recoverable. The error messages reflect Apple’s tools refusing to proceed on a structure they don’t fully trust — which is the right behavior for a tool that might otherwise make things worse. The data itself is usually still readable, just not through normal macOS pathways.

The hidden culprit: a failing drive (especially a Seagate)

One of the more useful things we can share from our lab’s case data is this: a large fraction of “APFS corruption” cases that come in aren’t actually file system problems at all. They’re drive failures producing symptoms that look like file system corruption from the user’s perspective. When the underlying drive is replaced or its read errors are worked around, the APFS volume mounts normally and the “corruption” symptoms disappear entirely — because there was no file system corruption to begin with.

The single most common drive model we see this on is Seagate, particularly the Seagate Backup Plus and Seagate Expansion external drives in the 2 TB to 8 TB range, and certain internal Seagate hard drives used in older iMacs and Mac minis. The pattern is consistent enough to be diagnostic. Symptoms include:

• The drive appears in Disk Utility but takes 10 to 20 minutes to mount in Finder, if it mounts at all
• File transfers start at normal speed and then drop to a few KB/sec, or stall entirely partway through
• Disk Utility’s First Aid reports container errors it can’t fix, but the errors are different each time you run it
• The drive disconnects and reconnects on its own, sometimes triggering “disk was not ejected properly” warnings
• On an internal drive: the entire Mac runs slowly, beachballs constantly, takes 5+ minutes to boot, and Activity Monitor shows high “kernel_task” CPU usage
• You hear faint clicking, ticking, or repeated spin-up sounds from the drive

What’s actually happening: the drive’s read heads are having difficulty with specific regions of the platter, either because of bad sectors that are getting worse, weakening head signal, or mechanical degradation. macOS asks the drive to read a block; the drive’s internal firmware tries the read once, fails, retries (each retry can take 5 to 30 seconds), eventually succeeds or gives up. APFS, sitting above, sees those long delays or read failures and reports them as “errors.” Disk Utility then sees those errors and reports “corruption.” The file system itself is fine. The drive isn’t.

Why this matters for recovery: the worst thing to do in this situation is to keep running Disk Utility against the failing drive, because every First Aid pass causes thousands of read attempts that accelerate the degradation. The right move is to stop using the drive immediately and image it through hardware designed to read damaged drives safely — which is exactly what data recovery labs do as the first step. In a meaningful percentage of these cases, once we have a clean image of the drive’s contents read with proper imaging hardware, the APFS volume on that image mounts cleanly the first time we try it, and the customer’s files come out intact.

What happens when a file is deleted on APFS

Deletion on APFS has a few more layers than people generally assume. There are four stages, and the data’s recoverability differs at each one.

Stage 1: moved to Trash. When you drag a file to the Trash in Finder or hit Cmd-Delete, macOS doesn’t actually delete anything. It moves the file’s directory entry into the hidden .Trashes folder on the same volume. The file is fully intact and fully recoverable — just open the Trash and drag it back out.

Stage 2: Trash emptied. When you empty the Trash (or use Cmd-Option-Delete to skip the Trash entirely), the directory entry is removed, the inode is freed, and the data blocks the file occupied are marked as free in APFS’s allocation maps. At this point the file no longer exists from macOS’s perspective — but importantly, if a snapshot exists that references those blocks, the blocks are preserved on disk. Because macOS creates automatic hourly snapshots of the Data volume, there’s a real chance that data you just emptied from the Trash is still sitting in a snapshot taken half an hour ago.

Stage 3: snapshots age out. Local APFS snapshots are kept for up to twenty-four hours and then automatically deleted to reclaim space, with macOS preferring to delete older snapshots first. Time Machine snapshots stick around longer if your Time Machine drive is connected. Once every snapshot referencing a file is gone, the data blocks become truly free and available for reuse.

Stage 4: blocks overwritten. The file’s former data blocks get reused by new writes from macOS or applications. Once that happens, the data is genuinely gone — there’s no metadata pointing to it, no snapshot referencing it, and the bytes themselves have been replaced.

The practical implication: if you deleted something within roughly the past day and haven’t been heavily using the Mac since, there’s often still a snapshot quietly holding onto the data. If you deleted something a week ago on a Mac you’ve been working on continuously, the snapshots have aged out and the blocks may have been reused. Time matters; continued use of the drive matters even more.

One additional layer: if FileVault encryption is enabled (which it is by default on most modern Macs), recovery requires both the data and the FileVault recovery key. If you have the key — it’s typically saved to your Apple ID account or printed during initial FileVault setup — we can decrypt the recovered data. Without the key, recovery from an encrypted volume is dramatically harder and often not viable.

What not to do while a Mac volume is acting up

Several common reactions to APFS trouble make recovery harder and sometimes impossible. The most damaging:

• Don’t reformat (Erase) the drive, even if Disk Utility’s First Aid suggests it’s your only option. Erase writes new file system structures over the existing ones. Once that happens, recovery becomes significantly harder.
• Don’t reinstall macOS over the existing system until you’ve recovered any data you care about. Reinstallation can rewrite system volume contents and trigger Disk Utility operations that touch the Data volume.
• Don’t keep running First Aid against a drive that’s showing physical-failure symptoms (slow response, clicking, disconnect/reconnect). Every First Aid pass adds wear to a drive that’s already failing.
• Don’t accept Disk Utility’s “Initialize” or “Repair” prompts blindly. Both can write to the drive. If your data isn’t backed up elsewhere, those writes can make recovery harder.
• Don’t use third-party “Mac repair” or “drive optimization” utilities on a drive that’s already failing. The ones that do work do their work by writing to the drive; the ones that don’t work waste your drive’s remaining read budget.
• Don’t keep restarting and rebooting a Mac that won’t boot. Each boot attempt is thousands of reads against whatever’s wrong, and if the drive is the problem, more reboots make it worse.
• Don’t open the Mac yourself to remove the internal drive on newer Macs — particularly Apple Silicon Macs, where the SSD is soldered to the logic board and isn’t removable, and where Apple’s T2 / Secure Enclave architecture means the drive is cryptographically bound to the original Mac.

What recovery actually looks like

For a Mac that won’t boot or a drive that won’t mount, the first thing we do in our lab is image the drive through hardware designed to read failing drives safely. That step matters enormously because, as discussed above, a lot of what looks like APFS corruption is actually physical drive trouble — and reading the drive through normal channels makes the problem worse. With a clean image in hand, the file system work happens against the image rather than the original drive.

From there, the recovery path depends on the situation. If the drive was physically failing but the APFS container is intact, the image often mounts cleanly and the files extract through normal channels. If the container itself has been damaged, we work through APFS’s structures offline — using tooling that understands the format and can reconstruct what Apple’s own utilities give up on. If FileVault is in play, we apply the customer’s recovery key to decrypt the recovered data. If the data was deleted but recent enough that a snapshot might exist, we look at the snapshots in the image to see what they preserve.

For Mac SSDs that have failed at the hardware level — the soldered storage on Apple Silicon Macs, the T2-protected drives on Intel Macs with the T2 chip — recovery is more involved and the outcomes vary. The encryption tied to the Secure Enclave means that even bit-perfect recovery of the raw NAND doesn’t produce readable data without the cryptographic context the original logic board provides. These cases require specialized procedures and aren’t always recoverable.

How the engagement works

Most APFS recovery cases that come into our lab fit our standard risk-free engagement model: free evaluation, flat-rate quote in writing before any work begins, and you only pay if we successfully recover your data. This applies to essentially all single-drive cases — failed internal drives in Macs, external Seagate or WD or LaCie drives that won’t mount, USB sticks, SD cards, and the typical APFS containers we see day-to-day. If we can’t recover your data, you don’t pay. If the quote we give you doesn’t make sense for what’s on the drive, you can decline and have the drive returned at no charge.

The exception is the rare case where APFS is sitting on top of a multi-drive RAID array of four or more drives — some prosumer and small-business setups use RAID-backed Thunderbolt enclosures or DAS units configured this way. Multi-drive RAID cases involve substantially more engineering hours for imaging every drive, reconstructing the array offline, and then dealing with the APFS layer above it. Those engagements look more like our other complex-storage work: free initial consultation, but the recovery phase may carry engineering charges that apply regardless of outcome, with the terms agreed in writing before any work begins. We’ll tell you during the consultation which category your specific case falls into.

For the overwhelming majority of Mac users with a failed internal drive, an unmountable external, or a corrupted APFS container, the standard risk-free engagement is what applies. No surprises, no engineering charges if we can’t get your data back.

If your Mac data matters, what to do right now

The actions that make the largest positive difference to the outcome are simple and immediate:

• Check iCloud first. Sign in at iCloud.com and look in Recently Deleted in Photos and iCloud Drive. If your files are there, you’re done.
• If the drive is making noise or behaving slowly, power it down. Failing drives get worse with every additional read. Stop using the drive as soon as you suspect a hardware problem.
• Don’t run First Aid, Erase, or Initialize against a drive whose contents matter to you. Anything that writes to the drive can make recovery harder.
• Document what you’re seeing. Exact error messages, exact Disk Utility output, photos of the screen if it’s easier — particularly any error codes that look like com.apple.DiskManagement.disenter error -119930868 or similar. The codes tell us a lot about what’s going on under the hood.
• Find your FileVault recovery key if your drive was encrypted. It’s typically saved in your Apple ID account, or printed when you first turned on FileVault. Recovery from a FileVault volume is dramatically easier with the key.
• Call us for a free evaluation. We’ll walk through what you’re seeing, tell you whether it’s likely a drive failure or a file system issue, what realistic outcomes look like for your specific situation, and what the engagement terms would be — risk-free for nearly all single-drive cases.

APFS is a solid, modern file system, and the great majority of Mac users will never see any of these symptoms. When the symptoms do appear, the underlying cause is usually one of two things: a drive that’s starting to fail (especially on aging hard drives), or a file system structure that’s been damaged by an interrupted operation. Both categories are recoverable in most cases — particularly when the drive arrives at our lab before destructive recovery attempts have been made against it. The data is almost always still there to be retrieved.