Home / Apple Mac

Apple Mac Data Recovery

Macs fail quietly and then all at once: a grey screen with a folder on it, a MacBook that met a mug of coffee, a mini that has stopped waking up. Everything turns on one detail, which is whether the storage is a part you can unbolt or a chip soldered to the board. This page draws that line by model year and says which side of it your machine falls on.

A Mac costs nothing to examine. A drive or a blade is £300 + VAT, the number is agreed in writing before anybody starts, and logical faults sit under no fix, no fee.

// how apple machines arrive

Six ways a Mac stops being a Mac

Apple hardware gives very little notice. It behaves, and then one morning it does not, and the gap between those two states is usually a single night. Six patterns account for most of the Apple work booked in at Cambridge.

A grey screen and a folder with a question mark

macOS went looking for a system to boot from and came back with nothing. That is a statement about the boot path rather than about your documents. Most often the storage has worn thin or lost the records pointing at the system folder, and the files themselves have not moved an inch.

An iMac that has finally worn its disk out

Behind the glass on every iMac up to roughly 2020 sits a conventional spinning disk, and those end their lives the way spinning disks always have: a repeated tick, a spin that never completes, a volume that goes missing halfway through an afternoon. Donor parts and filtered air, as for any other 3.5-inch mechanism.

A Fusion volume that has come apart

Apple joins a small SSD to a large disk and presents the pair as one drive, keeping the index of what sits where spread over both devices. Break one and the index cannot be followed, so the healthy device alone tells you nothing. Both are imaged and the pairing is put back together away from the machine.

Liquid down through a keyboard

Spills travel onto the logic board and stop there far more often than they reach the storage. The drive usually lives, provided the machine went off within seconds rather than being left to dry out with corrosion quietly at work for a fortnight.

An update that halted partway

A macOS installer stopping mid-flight leaves a machine that will not boot and a set of documents nothing has touched. The storage is imaged, the file system is put right on the image, and the files come out of the repaired copy rather than out of the Mac.

A Trash emptied a moment too soon

Deletion marks space as reusable without scrubbing anything. What happens next depends entirely on how much the Mac writes over the following hours, which is why a machine shut down at once is a far cheaper job than one left running for a week.

// which macs can be helped, by era

Read the year off the case before anything else

Apple storage has passed through three eras, and it is the era rather than the symptom that decides whether a recovery is possible at all. Up to about 2010 the storage is a conventional disk on a standard connector. From roughly 2010 to 2017, MacBooks moved to plug-in SSD modules that look like an M.2 blade and are not one. From 2018 the T2 chip appears, and on Apple Silicon the flash is simply part of the logic board. Work out which of the three you own and the rest of this page follows from it.

The first two eras: storage is a part, and parts travel well

An iMac or Mac mini up to around 2020 holds a plain SATA disk or a Fusion pairing behind its panel, and a MacBook old enough for a 2.5-inch disk is the same proposition as any Windows laptop. The middle era is awkward in exactly one respect: Apple altered the connector, the pin count and the controller more than once across those years, so a module from one generation will not seat in the next and nothing sold online fits any of them. The bench keeps an adaptor per generation, which is why a blade that produced nothing in a caddy at home reads perfectly well here. All three are routine work — the disk or the module comes out, travels by itself, and is copied before a single repair is attempted.

The third era, where the answer has to be no

On T2 machines and on every Apple Silicon Mac since, the flash chips are soldered to the logic board and encrypted by a controller that lives on the same board. There is no drive to unbolt, nothing to put in a jiffy bag, and the keys never exist anywhere outside that silicon. If such a machine will not start and the data was never copied elsewhere, the honest answer is that this bench cannot recover it and neither can any other laboratory working on removable storage. That is not a negotiating position. It is the security model behaving as Apple designed it, and a firm promising otherwise about a 2021 Air is not being straight with you. For anything from 2018 onward, ring 0800 689 0668 before you go looking for a box and you will have a yes or a no inside a minute. A number of Windows ultrabooks are built the same way and get the same answer.

Getting the drive out, and what happens after

Only the storage makes the journey. Computers are not stripped down at this laboratory, but lifting an iMac panel or unclipping a MacBook base is ten minutes of work for a repair shop in Leicester, Loughborough or Hinckley and they will do it for very little. With the drive in your hand, address the parcel to Cambridge Data Recovery, Compass House, Vision Park, Chivers Way, Cambridge CB24 9AD and send it tracked and insured. The examination is free and closes 2 working days after the device is booked in, and nothing else happens until you have read a written figure and said yes to it. From that point a completed single-drive recovery runs 2 to 4 working days. Model-by-model notes sit on iMac recovery and MacBook recovery, the county service is on data recovery Leicestershire, and the bands are published under data recovery cost.

// the apple details that change the outcome

Encryption is the second gate, and it is a separate one

Whether a drive can be read at all is settled by the hardware. Whether what comes off it means anything is settled by FileVault. With encryption switched on the job stops being about mechanics and starts being about credentials: hand over the account password or the recovery key and the sequence is unremarkable, which is to copy the drive, unlock the copy, and mend the file system on the decrypted version. Hand over neither and there is nothing honest left to offer, because the encryption is doing exactly the job it was turned on for.

It is worth searching properly before you pack anything. The key may be attached to the iCloud account it was tied to, saved in a password manager, held by whoever administers the machines at work, or written on the sheet somebody was told to keep somewhere sensible. Any one of those turns an impossible job back into a routine one.

Two file systems, and they fail in different directions

Anything configured before High Sierra runs HFS+, which maintains one catalogue of every file with a journal alongside it. Damage the catalogue and the route back is well-trodden ground, usually quick. Everything since runs APFS, which never overwrites in place: new data goes to free space, the structures describing the volume are rewritten as checkpoints, and snapshots and clones allow several files to share blocks on the medium.

Each of those choices cuts in both directions when something goes wrong. Helpfully, an older checkpoint often remains readable when the current one does not, so a volume that refuses to mount can frequently be raised from a slightly earlier account of itself, which is something HFS+ never made possible. Unhelpfully, the space APFS reports as free is precisely where last week's only copy of a file may be sitting and waiting its turn to be reused. That is why this site keeps telling people to stop using a machine the moment it looks wrong, and why the advice matters more now than it did a decade ago.

Why First Aid is a gamble rather than a first step

Disk Utility works on the live volume, so whatever repair it attempts is an alteration to the only copy that exists. Where it succeeds you save an afternoon and lose nothing. Where it stops halfway it can leave the structures worse than it found them, and the material it was rewriting is exactly what a recovery would have leaned on. At this bench nothing is ever repaired on an original: the storage is copied, and every attempt is made against the copy, so a failed repair costs an hour of computing rather than your documents. If the volume matters more than the machine, copy first and experiment afterwards.

Fusion: one volume wearing two bodies

Fusion means a small SSD and a large mechanical disk presented to you as one volume, with macOS moving frequently used material onto the fast device and maintaining an index of what ended up where. Damage either device and the index cannot be followed, so the volume stops appearing even though one of the two is in excellent condition. From that comes the most frequent mistake on this page. People post the mechanical disk because it is the one making a noise, leaving the blade — and half the index with it — bolted into the machine. Both devices are needed, both should be labelled, both go in one parcel, and the two together are quoted as a single job.

What Time Machine and iCloud actually cover

Two things are widely mistaken for insurance. A Time Machine disk is worth owning, but it is only as recent as the last time somebody remembered to plug it in, and the disk inside it ages on the same curve as every other disk — a fair number of the external drives arriving here turn out to be the only place a household's photographs exist. iCloud is a synchronisation service first and a store second, so with storage optimisation running a file may be a stub on the Mac and whole in the cloud, or whole on the Mac and never uploaded. Which of your folders were genuinely in sync is a question the assessment answers, not one to guess at while deciding whether the drive is worth posting.

// related pages

Nearby on this site

// what mac owners ring up about

Common questions

Almost never. That symbol reports one thing and one thing only: no system was found to start from. In nine cases out of ten the storage has worn out or lost the records pointing at the system folder, while the documents sit untouched behind it. The drive is imaged, the copy is repaired, and the files come off the copy. Whether the Mac itself boots again is a different question altogether.
Any machine whose storage can be unbolted. That means iMac and Mac mini on SATA or Fusion up to about 2020, MacBooks fitted with a 2.5-inch disk, and the proprietary blade modules used between roughly 2010 and 2017. What goes in the parcel is the drive; the computer stays where it is.
They cannot, and saying so now beats saying it once you have paid for postage. The flash is soldered onto the logic board and encrypted by a controller sitting on that same board, so there is nothing to detach and nothing that could be read anywhere else. For any machine built from 2018 onward, ring 0800 689 0668 before you look for a box and the question takes under a minute to settle.
£300 + VAT for a drive, an SSD or a blade, which is the same band any Windows machine would meet, and a Fusion pairing is one job at one price rather than two. Logical faults sit under no fix, no fee. Anything dropped, soaked, burnt or electrically dead needs invasive work first, so half the quoted figure is payable before that begins and the remainder once your files are back.
Better not. The only part of any use here is the storage — behind the display on an iMac, beneath the base plate on a MacBook — and any repair shop will take it out for a few pounds if you would rather not. A bare drive posts more cheaply, survives the journey better, and nothing on this bench has any use for the rest of the machine.
Only where neither the password nor the recovery key can be produced. With one of the two it is routine work: copy the drive, unlock the copy, repair the decrypted volume. With neither there is nothing anybody can honestly promise, which is the encryption behaving as designed. Look in the iCloud account it was attached to, in any password manager, and on the sheet printed the day it was switched on.
Both, always, and label each one. The SSD and the mechanical disk are a single volume whose index of what lives where is spread over the pair, so one device by itself is not a partial job but an impossible one. Sending only the disk that makes a noise is the commonest error on this page, and it buys nothing except a second round of postage.

Mac will not start? The drive knows why.

Free examination, one written number, and no fix no fee where the fault is logical. Online or by freephone.

// how the media reaches Cambridge

Sending a device — and the three exceptions

Very little of this work is handed over in person. It arrives as a parcel, which suits hardware that has already stopped behaving: boxed, padded and insured is a gentler seventy miles than the M1 in a glovebox. Something posted in Leicestershire this afternoon is normally booked in at Cambridge the next working day.

The general rule is the drive travels and the machine stays behind — out of the laptop, out of the tower, out of the iMac, out of the recorder under the counter. This bench does not dismantle equipment, and a repair shop will do it while you wait. Three things are the other way round, and getting them wrong costs you the recovery: an external drive stays sealed in its own case, a NAS comes as a complete unit, and a WD My Passport or My Book travels whole with its cable, because on those the encryption key is held on the bridge board rather than on the disk — separate the two and the data becomes unreadable even to us. A Fusion Mac needs both of its drives, each labelled. The one thing nobody can work round is flash soldered onto the mainboard, as on Apple Silicon machines: if it will not come off, there is nothing to post.

  • A stiff box or a well-padded mailer, with enough packing that nothing moves when you shake it. Power supplies, docks and cables can stay at home unless the drive is one of the WD units above.
  • Running a RAID or a server? Send the member disks on their own, not the chassis or the controller, and write the bay order on each one — 1, 2, 3 and so on. Photograph the front of the unit before you pull anything, because that photograph occasionally saves a day of work.
  • Fill in the shipping and booking-in form (PDF) — a name, a number you actually answer, and a line on how the trouble started — and put it in the box.
  • Special Delivery is tracked and insured and is what most people use; your own courier is equally fine. Handing it over in person also works: reception at the Cambridge address takes devices across the counter, Mon–Fri 9:00am–5:30pm. What does not exist is a Leicester counter or anyone who comes to collect.
// write this on the label

Cambridge Data Recovery

Compass House
Vision Park, Chivers Way
Cambridge, CB24 9AD

↓ Print the shipping & booking-in form (PDF)

Address it to Cambridge Data Recovery. It is about seventy miles from Leicester if you fancy driving it — M1 south to Junction 19, then the A14 east — and the lab is two minutes off Junction 32 with parking at the door. Posting costs you a stamp and a day instead. Whichever you choose, you hear from us the moment it is booked in, and the free diagnostic closes two working days after that.

Not certain what belongs in the box? Ring 0800 689 0668 before you tape it up, or let the free online diagnostic ask the questions for you.