Three generations of Mac, three completely different answers — work out which one you are holding before you do anything else

No question arrives down this freephone more often than whether the files can be got off a Mac that will not start, and there is no single answer to it. There are three, they are wildly different, and which one applies is settled by a menu item you can check in half a minute.

Check which generation first. Everything else follows from it

Apple menu, About This Mac, and read the chip or processor line. Three populations are in circulation and they behave as though they were built by different companies when something goes wrong.

Apple Silicon — anything with an M1, M2, M3, M4 or later. The flash memory is soldered directly to the logic board and is encrypted by the Secure Enclave from the factory. There is nothing to unscrew and nothing to post.

Intel with a T2 chip — broadly 2018 through 2020, covering the MacBook Pro and Air of that period, the iMac Pro, the Mac mini and the Mac Pro. Storage is soldered here too, and the T2 handles encryption whether or not FileVault was ever switched on.

Intel without a T2 — 2017 and earlier as a rule. This is the generation where the storage is a removable part: a 2.5-inch SATA disk, a proprietary Apple SSD blade, or in an iMac a spinning disk and an SSD together. These are the machines that behave like ordinary computers on a bench.

Apple Silicon and T2: the honest short answer

If the machine is an M-series or a T2 Intel and the logic board is dead, the data is gone. Not difficult, not expensive — gone. The flash is soldered to the board, so it cannot be removed and read elsewhere in the way a drive can, and the encryption keys live in the Secure Enclave on that same board. Even where the flash chips themselves are physically intact, the key that makes them meaningful died with the board.

That is worth hearing before anybody pays for postage or an assessment elsewhere. There are firms that will take the machine in, keep it for a fortnight and then tell you the same thing with an invoice attached. It is a much better use of a phone call to establish which generation you have first.

The cases that are not hopeless on these machines are the ones where the board still works. A Mac that boots to recovery, or that starts and behaves oddly, or that has a failed screen, keyboard or battery, still has functioning storage — and the route in is Apple's own share-disk mode or a target-disk arrangement, copying the data off across a cable while the machine is alive. If an M-series or T2 Mac still powers on at all, do that today rather than waiting to see whether the fault gets worse.

Intel without a T2: ordinary bench work at £300 + VAT

Here the answers get much better, because the storage is a component rather than part of the board. A 2013-to-2017 MacBook Pro or Air uses a proprietary Apple SSD blade held in with one screw; an adapter reads it on standard equipment. A 2012-or-earlier MacBook Pro has a 2.5-inch SATA disk behind the bottom cover. An iMac of the same era has a 3.5-inch disk, an SSD, or both. In every case the storage comes out and travels on its own, and the machine stays where it is.

That is £300 + VAT, the single-drive band, regardless of whether it is a spinning disk or a blade and regardless of capacity. The usual faults are the usual faults: a mechanical failure in a disk that has taken a knock, a file system that has come apart after a power cut, an accidental erase, a failed macOS upgrade. Recovery works on an image, so nothing is written back to your storage at any point.

Two Mac-specific complications are worth knowing. Fusion Drive pairs a small SSD with a large hard disk and presents them as a single volume, with macOS moving blocks between the two. Neither half is readable on its own, so both have to travel — each labelled, in the same parcel — and the volume is reassembled on the bench. And APFS, standard since 2017, keeps its metadata in a very different arrangement from the old HFS+, with snapshots and space sharing that make some recoveries better and some considerably harder. Neither is a problem so long as nobody has been running repair tools first. Apple Mac recovery, MacBook recovery and iMac recovery cover the machines individually.

FileVault, and the question everyone forgets to ask

FileVault changes what is possible on every generation, and a surprising number of people do not know whether it was on. On an Intel Mac without a T2 it is the difference between a routine job and an impossible one. With the password or the recovery key, an encrypted volume is imaged and then decrypted against the copy, and the recovery proceeds normally. Without either, the volume is mathematically shut and no laboratory anywhere opens it.

Check where the key might be before assuming the worst. When FileVault is switched on, macOS offers to escrow the recovery key to your iCloud account, and a great many people accepted that offer years ago and forgot. In a business, the key is frequently held by whichever management platform enrolled the machine. Either of those turns a dead end into an ordinary £300 + VAT job.

On Apple Silicon and T2 machines everything is encrypted regardless, so the question of whether FileVault was on is less about recoverability and more about what a sale or a disposal actually destroys. Which brings up the useful corollary: erasing one of those Macs throws away the keys rather than overwriting your files, so the erase is genuinely final. That is reassuring when you are selling a machine and unforgiving when you erased the wrong one.

Things that make a Mac recovery worse, in order

Repeatedly restarting a machine making a new noise. A spinning disk in an older iMac or MacBook that has started ticking is damaging its own surface every time it spins up. Each restart costs you material that does not come back. Switch it off and leave it off.

First Aid in Disk Utility, on a volume you care about. It is a repair tool, and repair tools write. On a healthy volume with a small inconsistency it is fine. On a disk with a physical fault, or on an APFS container that has come apart, it can turn a full recovery into a partial one. The Mac habit of running First Aid as a first response is the single most common self-inflicted wound in this category.

Reinstalling macOS to fix a boot problem. This is the equivalent of a reinstall on Windows and it does what you would expect: writes a fresh operating system across the volume that is holding your files. If the machine will not boot and the data matters, take the storage out — or, on soldered machines, use share-disk mode — before anybody reinstalls anything.

Third-party recovery software run onto the same disk. Several free tools default to writing their working files onto the volume being scanned. If you do run something, point its output at a completely different drive, and only run it at all on a disk that is quiet, cool and detected consistently.

What to send, and what it costs

Where the storage comes out, send the storage and keep the machine. A 2.5-inch disk, an Apple SSD blade, or in a Fusion iMac both units labelled so nobody has to guess which was which. Nothing is dismantled at the Cambridge end and any repair shop in Leicester will free a drive in ten minutes. Where the storage is soldered — every Apple Silicon Mac and every T2 model — there is nothing to post, and the conversation is about whether the board still works rather than about postage.

One drive or SSD is £300 + VAT, NVMe and Apple blades on the same rung, quoted in writing once the free diagnostic closes 2 working days after booking in. A finished single-drive recovery normally runs 2 to 4 working days after you approve the figure. Logical faults run no fix, no fee; electronic and mechanical failures, chip level work, DVR and Forensic jobs are the stated exclusions and take 50% upfront. Every band is on the data recovery cost page.

Pack it so nothing can move, print the shipping form, and post it tracked and insured to Cambridge Data Recovery, Compass House, Vision Park, Chivers Way, Cambridge CB24 9AD. That is about seventy miles from Leicester — M1 south to Junction 19, then the A14 east — and the lab sits two minutes off Junction 32 with parking outside if you would rather drive it; reception takes drop-offs Mon–Fri 9:00am–5:30pm. Nobody collects and there is no counter in Leicester. If the storage is a solid state blade, SSD recovery explains what TRIM does to deleted files first. The freephone is 0800 689 0668.