Data Recovery Case File · Mac & Apple Ecosystem · Four Places to Look First

Recover a Deleted Pages Document on a Mac: Four Places to Look

Her enquiry was short and described one of the most ordinary losses there is. "I have lost an important Pages document. I think I trashed it by mistake and then emptied the trash. I have a 2014 MacBook Air." Two things need saying, and the second is more useful than the first. The honest one: on a Mac of that generation the deleted-file odds are materially worse than most people expect, for a reason specific to solid-state storage that this page explains plainly. The useful one: a Pages document that was worked on more than once almost certainly exists in three other places that have nothing to do with disk recovery — and she can check all of them herself, today, for nothing. Those come first, because in cases like hers they succeed more often than the bench does.

The decode: why an SSD changes the odds, and the three free places to look

The honest part first: on a traditional hard drive, deleting a file removes its listing and leaves the contents intact until something writes over them — which is why so much of this archive is about recovering deleted data. Solid-state storage behaves differently. Because flash memory has to erase a block before it can rewrite it, the operating system tells the drive which blocks are no longer in use so it can clear them in advance, in the background. That housekeeping runs within minutes of a deletion, and once it has run, the contents are genuinely gone rather than merely unlisted. So a document deleted from a Mac's internal SSD and noticed hours or days later is frequently unrecoverable at disk level — and any firm that promises otherwise is not being straight. That is worth knowing before anyone spends money.

Why that is far less bad than it sounds: because a document is not only in the place you deleted it from. First, the application's own versions. Pages saves revisions automatically as you work, and macOS keeps those in a version store separate from the file itself — which means a document edited across several sessions often survives even when the file has gone. Second, iCloud Drive. If the Mac had iCloud Drive enabled with Desktop and Documents syncing, deleted files sit in a recently-deleted area for a period and can be restored from the web interface — and older versions may be retrievable there too. Third, Time Machine or any backup drive, even one that has not been connected for months: a backup from before the deletion is a complete answer, and it is remarkable how many people have one and assume it is not relevant because it is out of date. Out of date is exactly what is wanted here.

And the fourth place, if those fail: disk-level recovery on an image of the machine — worth attempting where the deletion is very recent, where the document lived on an external drive rather than the internal SSD, or where fragments survive in temporary and cache locations that the housekeeping did not reach. Carving for a single small document is a fine-grained job rather than a bulk one, and the honest position is that it succeeds sometimes rather than usually on this class of machine.

The one instruction that helps: if she wants the disk-level chance preserved, the machine should stop being used now. Every hour of ordinary work is more background housekeeping and more writes. That is a real cost for a document that may well be sitting in iCloud, so the sensible order is: check the three free places first, quickly, and only then decide whether the fourth is worth the disruption.

On the bench

The free sources were worked through first, because a recovered document from a backup costs nothing and beats any bench result: the application's version store examined, the cloud account's recently-deleted area checked, and every backup destination the machine had ever written to identified and interrogated — including one that had not been connected in months and turned out to predate the deletion. Where disk-level work was warranted, the machine was imaged write-blocked on the Atola TaskForce 2 and OSForensics ran fine-grained carving for the document type alongside a sweep of temporary, autosave and cache locations that solid-state housekeeping does not always reach. The recovered document was verified the only way that counts — opened in the application and read.

The outcome

The document recovered and verified, with the free sources exhausted before any charge arose. Free assessment, one fixed written figure including VAT, no recovery, no fee. The decode, for anyone who has emptied the trash on a modern Mac: solid-state storage clears deleted blocks in the background within minutes, so disk-level recovery of a deleted file is genuinely harder than it is on a hard drive and nobody should promise you otherwise; but a document is rarely in only one place — the application's own version store, the cloud account's recently-deleted area, and any backup drive however out of date are all free to check and succeed more often than the bench does; and if you want the disk-level chance kept alive, stop using the machine while you check the other three.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.