Does it genuinely support APFS?
It should not be HFS+ with APFS bolted on top. The questions you need to ask will relate to how the product handles containers, snapshots and clones — these are areas in which weak implementations fail.
Essential
APFS does a lot of things automatically. APFS automatically keeps local "snapshots" of what was there. And Time Machine leaves them on the Mac's disk itself. This means that if you have lost some information, odds are good that it can be restored from an existing snapshot. Not only will this cost you nothing ... but since the snapshot is already on your machine, there's no additional risk involved either.
Another thing that APFS does automatically is create local snapshots of itself. If something has been deleted today...it probably is still sitting in one of these local snapshots and can simply be pulled back out with no cost or risk.
The three methods listed below are all available in macOS and together cover a large portion of possible solutions.
Time Machine leaves hourly snapshots on the internal disk, so they exist even when the backup drive is elsewhere. They can be found by entering Time Machine and browsing through the files as they existed at different times. If you find a point prior to the deletion/loss, simply restore from that snapshot and stop reading.
iCloud Drive retains deleted files for thirty days, and it shows more deleted file information on its web interface than Finder. Check deleted file status with an alternative device rather than using the Finder app on the Mac that was used to delete those files.
Pages stores all its versions, as do Numbers, Keynote and many other apps. Version history is maintained by each of these applications regardless of whether or not a user has enabled Time Machine. File menu option Revert To, then Browse All Versions.
Only after trying all of the methods described above will a user need to start looking into recovery tool options — and the following paragraphs will explain whether or not recovery tools have any potential usefulness.
This is where we find out why Mac recovery is different from Windows recovery — and therefore, why some older methods no longer work.
A key reason APFS has a high chance of returning more than you expect when you carve files off an APFS volume is that APFS does not overwrite existing data in place. Each time you make a change to a file, the system writes the changed version somewhere else and simply updates all the pointers for each block of the original version to point at the new blocks. This means there are often earlier versions of a file available even though you think you have "lost" the file. It is because of this fact that the use of “copy-on-write” technology makes it common for users to be able to recover deleted items long after they appear to have been deleted from their location within their respective applications.
Containers instead of partitions: The other way in which APFS is different from traditional disk technologies is that APFS uses containers as opposed to fixed partitions. In a container, multiple volumes share one pool of unused space and can expand dynamically. Any utility developed under the assumption that every disk contains its own unique set of independent partitions will interpret your APFS disk incorrectly. Therefore, older utilities developed under the operating systems of previous generations of computers, including most of the Windows-based recovery utilities, perform badly on an APFS disk.
Clones further confuse the picture. When a file is cloned, instead of creating an exact duplicate of the entire file by writing out a completely new copy of all the blocks of the source file, the clone references the exact same blocks as the original. In other words, when you create a clone of a file with a certain amount of data in it, you now have two references to what was previously considered to be only one file. Even if you delete one version, deleting it does not reclaim the blocks since the remaining version still refers to them.
It matters far less what differences there are between reputable software tools than the questions that follow.
It should not be HFS+ with APFS bolted on top. The questions you need to ask will relate to how the product handles containers, snapshots and clones — these are areas in which weak implementations fail.
The ability to scan and see your files listed prior to making any payment is a necessity. Any utility that requests you pay them first is essentially requesting you take a gamble as to whether they will work properly.
With T2 and Apple Silicon, the internal storage area is soldered onto the board and encrypted. While the software can run as long as macOS is running, when the motherboard dies nothing can communicate with it.
Then no program, and no laboratory, can read from the volume until either the password or the recovery key has been entered. Find out what keys exist before you spend money.
The Mac will not start at all. Somewhere the software has to be running. If the machine is down but you have a removable drive with the data then the drive will be read by some other piece of hardware. On newer Macs, you may still be able to connect two machines together using either Target Disk Mode or Mac Sharing Mode.
The drive is making noise. Mechanical, and scanning accelerates it.
Soldered storage on a failed board. Apple stores encryption keys for its flash memory on a small processor called a "security chip" within the logic board. The key died along with the board so nobody – including Apple – will ever recover this data.
FileVault without the key. First check your iCloud account, or your company's IT department, as they store it for you more often than people expect. Where it is genuinely lost, we will try to recover your password. We can successfully recover passwords if they were weak or partially remembered, however we cannot recover long random passwords.
For Mac recovery in Manchester, the cost is from £300 + VAT when the drive comes out, and £550 + VAT flat rate for a Fusion Drive. We will also tell you if the diagnostic shows a snapshot would have done it.
Always check for an APFS snapshot before you buy anything. Even though the backup drive isn't attached, Time Machine makes hourly local snapshots on the internal disk so there are going to be some available locally, as well as being able to restore them instantly and at no charge.
Both. The copy-on-write mechanism creates superseded versions of files which can persist. Therefore, carving can often recover more data than expected. However, containers and clones cause problems with tools that rely on a rigid partition layout. For these reasons, true APFS support has to be native to the tool, rather than something added using a "bolt-on".
Not directly. Software must run from somewhere. Wherever the storage device is removable it can be accessed from a different device, and on newer Macs, either Target Disk Mode or Mac Sharing Mode may still allow access to the storage device from another computer.
Only while macOS still runs. On T2 and Apple Silicon machines the flash is soldered and encrypted by the security chip so that when the logic board fails nothing will ever reach it — not software, and not a laboratory.
Without the password or recovery key, yes, completely. Check your iCloud account or IT department first since it is escrowed more often than people expect. Where it is genuinely lost, password recovery can be tried against weak passwords.
If the Mac runs and the drive is quiet yes — after checking snapshots, iCloud Recently Deleted and in-app version history which are all free. If the machine is dead or the drive is making noise, then no.