Employee formatted hard drive with out permission

Unless Time Machine was regularly used on that now formatted Mac, and the employee did not format that backup media, or the Macs were centrally backed up by some other means, then formatting means the data on the drive is gone and unrecoverable.

If the files were located on iCloud Drive, and you still have access to the user's iCloud account, Apple provides a 30-day sliding window to recover files deleted from iCloud. See the Settings panel located below the users screen name in the upper right corner of the signed in iCloud account.

In the future, physically secure an employee's computer before they are let go to avoid a reoccurrence of this data loss.

You might look at a Mac online backup service, such as CrashPlan, Carbonite, Backblaze, etc...

Then use Enterprise Management Software, such as JAMF or Workspace ONE to manage company Macs and enforce things like on-line backup.

Of course make sure whatever backup service you choose gives management access to any and all of the backups.

No matter how much you think you have locked own a user's hardware, the user can find ways to get around it if they are smart enough. Heck he could have soaked it in the bathtub before returning it, so your best defenses is to have online backups. But I'm sure a smart employee can defeat that, so make sure your enterprise management software checks that backups are happening.

Finally make sure that any software you install does not suck the life out of the Mac. There are lot of packages out there that say they give management control or security, but do it at the expense of employee productivity. Do not be one of those managers.

I speak from experience in that I'm an employee where company IT has mandated software installed on company Macs, and 95% of the employee problems are directly related to that software, including macOS panics, serous performance slow down, getting locked out of the Macs, etc... So choose your company mandated software wisely.

Ouch... if the drive is an SSD then there's little hope of recovery, also if the former employee Secure Erased the drive then there is no hope of recovery.

Data Rescue II...

http://www.prosofteng.com/products/data_rescue.php

Virtual Lab...

http://www.binarybiz.com/vlab/mac.php?PHPSESSID=48b398a7879fa364a82736a2b9bf955a

This one would require another HD with plenty of space to recover to.

You should use another Boot Disk or other Mac with this one in Target mode to do the recovery.

They have a free demo to see what it could recover.

rccharles on file recovery...

"Stellar Phoenix Macintosh - Mac data recovery software, recovers data from damaged, deleted, or corrupted volumes and even from initialized disks."

They have a trial version, so I guess you can see if your data can be recovered...

http://www.stellarinfo.com/mac-data-recovery.htm

FileSalvage is an extremely powerful Macintosh application for exploring and recovering deleted files from a drive or volume. FileSalvage is designed to restore files that have:

   * been accidentally deleted.

   * become unreadable due to media faults.

   * been stored on a drive before it was re-initialized/formatted.

https://www.subrosasoft.com/product-category/file-recovery/

 Data Rescue...

http://www.prosofteng.com/products/data_rescue.php

But the longer you use the drive the less likely of any recovery, & if it's an SSD with TRIM enabled you can forget recovery.

http://subrosasoft.com/OSXSoftware/index.php?main_page=product_info&products_id=1

I used to work for a company that would inform an employee that they were done, obtain the surrendered access badge, and within 5 minutes, the individual was escorted from the premises. They were never allowed to return to their desk, or gather their personal items, which were later shipped to their address of record.

For the employee that announced to their manager that they they were leaving the company, the same immediate escort process was applied in those cases too. No equipment or data sabotage occurred.

Seems to me that if a drive is actually "formatted," and that really means erased using Disk Utility, then there is no recovery of that media content regardless whether rotational or SSD.

If it was FileVault encrypted, then the encryption keys are gone, and the rest of the drive is as good as useless.

My company owned Mac is mandated to have FileVault enabled.

Formatting generally just writes new Partition Maps & Directories basically. That is why Secure erase was invented. :)

Ah, good point!