How to undelete files removed with rm -rf on an APFS SSD disk?

Solution 1:

No. It's very unlikely you're going to recover anything.

The reason being is that when you delete something from an SSD, the way it's deleted makes it virtually impossible to recovery. Basically, when you delete something, it tells the drive to mark the sectors as deleted just like in a traditional hard drive. However, when subsequently asked to read back the data, the drive will respond back with either zeros or garbage.

  • How to get the "securely erase" function of Disk Utility on El Capitan & Sierra
  • Can the data on an MacBook Pro SSD be recovered after formatting using Disk Utility

Note: It's not impossible to not recover any data, you will need to send it to a lab or to the manufacturer who can get around the mechanisms that secures the data. However, this is usually very cost prohibitive unless it's for forensics and provided that the sector hasn't been overwritten already. Unlike magnetic media, it only takes a single write to send the preexisting data into oblivion.

Solution 2:

There is no way to easily recover the files deleted by rm. You will ned a 3rd part app to do so. There is an app called Stellar, EaseUS, or Disk Drill. The first two are pricey but Disk Drill offers a level of recovery for free.