Home / Case Studies / The Job That Was Turned Down
Macs and Apple Kit · case file

The Job That Was Turned Down

A logistics office in Enderby had a jug of water go across a desk and into a MacBook Air, which stopped that afternoon. The office manager did the sensible things: switched it off, turned it upside down, left it alone, and wrote asking whether the data could be taken off before anybody attempted a repair. The answer was no, given the same day and before anything was posted, and the reasoning is worth setting down because it applies to a growing number of machines.

MacWater / LiquidDead / No Power
// the job in four lines
MediaA recent MacBook Air with liquid across its mainboard. Its storage is a set of flash chips soldered to that board, with no separate disk to remove and no connector to read it through.
What was reportedMacBook Air, water spilled across the logic board, stopped working the same day, not switched on since, the data wanted off it before any repair is attempted.
Fault classOutside intake, and said so at the enquiry. Liquid on a board is workable in principle. The obstacle here is the storage: it is soldered flat to the mainboard and encrypted against a key held inside the machine's own processor, so there is nothing to unplug, post, or read on its own.
On the benchNone, and nothing was charged. The model was identified from its serial number and from photographs of the board taken on a telephone, the question was answered the same afternoon, and the office was told what to do instead of sending it.
// reading the fault

Reading the fault

Water damage on its own is not the problem. A board that has been wet is cleaned, dried and inspected, and where the storage is a separate part it is then read on its own regardless of whether the machine will ever run again. That is ordinary work. What decides whether it can be done is the architecture of the machine rather than the spill.

On this generation the storage is not a component you can remove. The flash is soldered directly to the mainboard and the controller that manages it lives inside the main processor rather than on the storage itself. There is no disk, no caddy and no adapter. Lifting the chips off is physically possible and pointless, because what comes off them is encrypted material that only that particular processor can turn back into files.

The encryption is the part that closes the door. The key is generated and kept inside the processor's secure area and never leaves it, which is a good design and the reason a stolen machine is not a data breach. It also means a laboratory holding the memory chips and not the working processor has nothing but noise. Any firm that offers to recover from a machine like this by lifting the chips is describing something that does not work.

Saying so at the enquiry is the whole point of the enquiry. The office could have posted it, waited, and been told the same thing a week later with a machine in transit and nothing gained. Storage soldered to a mainboard, which is how recent Apple laptops and a good many thin ultrabooks are built, sits outside what this lab takes in, and so does anything that cannot be unplugged and sent on its own. Phones and tablets are outside it for the same reasons and are never accepted.

// bench work

Bench work

Nothing came to the bench. The office sent two photographs of the underside of the board and the serial number off the case, which was enough to confirm both the model and that the storage was soldered rather than removable.

What they were told instead took about ten minutes on the telephone. Do not switch it on and do not put it on charge, because current through a wet board is what turns a cleanable machine into a corroded one. Take it to a repair firm that does board-level liquid work rather than a general shop, because the only realistic route to that data is through the machine itself: if the board can be brought back for long enough to start, the processor with the key in it does the decryption and the material copies off normally. And check what already exists elsewhere before spending anything at all.

// what went back

What went back

Nothing was charged, because nothing was done and no examination was needed to know the answer. That is the ordinary handling of a job that sits outside what can be taken in: it is turned down at the enquiry rather than after a parcel has been sent and a diagnostic has been run on something nobody can help with.

The end of it was better than expected. A backup disk was found in a cupboard in the same office, last used about five weeks earlier, which covered everything except the current month. The machine went to a board-level repair specialist and came back working a fortnight later, at which point the missing five weeks copied off in the usual way.

A wet laptop, and what to do in the first hour

Switch it off and leave it off. Do not press the power button to see whether it survived, do not put it on charge and do not use a hairdryer on it, because heat drives moisture further under the components rather than out of them. Leave it upside down somewhere warm and dry for a few days if you can bear to. Then work out what sort of machine it is before deciding anything, because that determines everything that follows: an older laptop with a disk or an SSD in a caddy can have that storage removed and read whatever state the machine is in, while a recent one with its storage soldered down and tied to its own processor cannot, and no laboratory can change that. If yours is the second sort, your route is a board-level repair that brings the machine back for long enough to copy from it, and that is a repair job rather than a recovery one. Ask before you post anything, since a question costs nothing and a parcel does.

Is this your drive as well? Every file on this page began with somebody describing a noise or a message, and the route in is the same each time. Nothing is charged for finding out what has happened. That examination finishes two working days after the parcel is logged in — never sooner, because rushing it is how evidence gets destroyed — and it ends in one number, written down, which does not move afterwards. Where a single drive is recoverable it is generally back with you two to four working days later. How you pay turns on which kind of fault it is, and the wording does not vary across this network: no fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. So a deletion, a broken file system, a lost partition, a firmware or service-area repair all keep the guarantee — nothing comes back, nothing is owed. Opening a drive under laminar flow, rebuilding a board, lifting a memory chip, or anything that arrived wet or burnt does not: half the agreed figure is taken before the work, and the balance only if your files come home. The published figures run: £250 + VAT for a memory card, a USB stick or a pen drive; £300 + VAT for any one hard drive or SSD, NVMe included; £400 + VAT for a recorder disk or a BitLocker volume; from £500 + VAT for an array, a NAS or a server; and £800 + VAT for a forensic investigation that ends in a written report. Five bands, all of them public, and the only one outside the guarantee is the forensic work. On packing: if the storage is screwed inside a laptop, a tower, a Mac or a server, take it out and send the bare unit, because dismantling equipment is not work this bench does. Three things go the other way and travel complete — an external drive in its own case, a NAS, and a WD My Passport or My Book with its cable, since on those the key sits on the bridge rather than the disk. A Fusion Mac needs both of its drives, labelled. A RAID or a server sends its member disks only, numbered by bay, with the front of the chassis photographed first. Flash soldered onto a mainboard, as on Apple Silicon Macs and many thin laptops, cannot be taken in at all, and neither can phones or tablets. Post it tracked and insured to Cambridge Data Recovery, Compass House, Vision Park, Chivers Way, Cambridge CB24 9AD, or put your own courier on it; the Cambridge reception takes devices across the counter too, Mon–Fri 9:00am–5:30pm. Nothing is collected, and there is no shopfront in the county to call at. Freephone 0800 689 0668. Packing notes and the shipping form live here.
Start a free diagnostic

Each of these is a real enquiry, taken from a household or a business somewhere in Leicester or the surrounding county, with the name of the customer, the firm and anything else that would identify them taken out. What is left is the reasoning: what turned up, what had actually failed inside it, the method that fault required and the equipment it was worked on. One of the thirty-six is a job that was refused, and it belongs here every bit as much as the successes do.

// nearby on the shelf

Three more files along the same lines

See every case file →

Is this your drive as well?

Examining it is free and takes 2 working days from arrival, the figure goes to you in writing and does not move afterwards, and a logical fault carries no fix, no fee. Start online or ring the freephone.