Apple storage · bench file · ADR-2025-3660
One Encouraging Sign, and It Was Not the Data.
An Apple shop had already made the diagnosis before he contacted us, and it was a Hard drive failure
. The machine isn't starting
. He had not got any backup of the files on the machine
, so he needed to determine whether the one hopeful thing he had noticed was something of value: The recovery mode is working
. His questions were all of the practical variety (how long, how it reaches us, what it costs), but the underlying question that determines the job is whether a Mac that can still run Recovery Mode is a Mac whose files can still be accessed.
Same story on yours? Tell us what it does — the look is free.
0203 0868633
What failed, and why.
Recovery mode is a small, separate system that the Mac can boot into when the main one will not. When a Mac boots into Recovery Mode, you know several things: the firmware is functional, the machine has power, and some portion of the storage is accessible enough to allow you to see the Recovery Environment. This is a better place than a dead box that shows nothing. However, Recovery Mode tells you absolutely nothing about accessing your data. That lives on the same storage that the shop diagnosed as being bad. A failing storage device may be good enough to load a maintenance environment like Recovery Mode and completely fail when asked to provide images or documents. Thus, both signs are true; they do not cancel each other out. In order to settle this job, we need to measure the condition of the storage itself, and on an Apple machine, there is a secondary question related to whether the data stored on said storage is protected in such a way that the key, rather than the reading, becomes the focus of the work.
What the bench did with it.
The order of the job →| Equipment used | Its work on this job | The reason for it |
|---|---|---|
| DeepSpar Disk Imager 4 | Copied where it could read (with the retries limited) | Mapped the heads first, then imaged one face of a platter per pass, with every reset, timeout and the power itself kept under our own control |
| PC-3000 Data Extractor | Profiled health first because the diagnosis was simply a description and not a reading | Instead of working around the drive's firmware and controller, it works with the two natively |
| UFS Explorer Professional Recovery | Opened the Apple volume from the finished copy and pulled the files out of it | When other applications will not open it, this application will open APFS, ReFS, XFS, ZFS and Btrfs. |
What the bench did with it.
Recovery mode says the machine lives, not the files
To begin, we needed to distinguish between the two claims he brought to us. Recovery booting confirmed the Mac was able to start something. The shop stated there was a problem with the storage area of his Mac (where all of his files would be stored). In reality, these two things can be true at the same time, and usually are, so nothing was concluded from the positive indication about whether or not his data could be recovered, and therefore we didn't restart the computer again. The storage component was removed from behind the recovery system and placed in front of one of our measuring devices instead of booting systems; this allowed us to turn the diagnosis of a failed component into a value.
Measure the storage, then copy what reads
The failure designation used by the shop is simply a symptom that has been assigned a name; it isn't a measurement. We created a health profile for the storage device first, and we then developed a policy for the subsequent copy process using this information: a hard retry limit, some difficult ranges set aside for a later and gentler attempt, and the copy progressed gradually rather than aggressively. There was no repair done to the storage device itself.
The encryption question, answered honestly
In an Apple product, reading the storage only gets you part of the story. The machine has its own security mechanism that can protect whatever is retrieved from the storage component. Wherever this security mechanism is in use, the path to the files goes through the key rather than through better equipment. This was determined alongside the copy process and clearly stated when it mattered most rather than at the end. The volume was then mounted from the copy, and the files were extracted under their original names and dates.
What went home.
He got back those files that he did not have another copy of via a copy, versus directly accessing them from his MacBook, and this was done without having to ask his MacBook to boot even once more. The three practical questions were resolved prior to beginning any of this: How much will it cost? How will it be transported here? And how long will a project such as this take? His storage was not repaired since repairing it was never the goal; the goal was to read the data once from this storage unit (and carefully), since it may become unreadable soon. As far as pricing went, the cost was the published single-drive figure of £300 + VAT, which was put in writing prior to taking any steps that generated charges.
Begin here if yours is doing the same thing.
More Apple machines, written up.
Yours doing something similar? Power it down first.
Published prices are fixed. Memory cards and USB sticks are £250 + VAT. Any stand-alone drive is £300 + VAT. Drive configurations containing multiple disks (RAID, NAS or server) start at £500 + VAT. First assessments are always complimentary. Thereafter, data recovery charges are also fixed in advance and in writing, so you'll always know how much you owe before paying any money. Shut it down, get a quote first (by phone or with the form), then send it in or drop it off at our Guildford intake laboratory, Monday to Friday, 9am to 5:30pm (no appointment needed). On most jobs you only pay if we recover your data.