Modern Apple operating systems (OS X El Capitan and newer) protect their system disks with System Integrity Protection , a security feature that shelters the essential parts of OS data from unwanted alterations. While it really increases system security, at the same time it severely restricts access to files on the disk, rendering file recovery impossible.
You need to turn SIP off to perform file recovery from such system disk.
To disable SIP,
|1||Boot your Mac computer into the macOS Recovery mode.|
Simultaneously press and hold the Command and R keys during its startup.
|2||Select Terminal in the Utilities menu|
|3||Type in "csrutil disable" in the Terminal and press Enter.|
The message that System Integrity Protection has been successfully disabled will appear.
|4||Restart your Mac computer, start Restorer Ultimate, and check that SIP is disabled|
Recover files from this system disk is now possible.
System Integrity Protection should be enabled again when the recovery process is over.
To enable SIP,
|1||Proceed with above steps 1 to 3|
|2||Type in "csrutil enable" in the Terminal and press Enter.|
The message that System Integrity Protection has been successfully enabled will appear.
|3||Restart your Mac computer|