Home / Apple Mac

Apple Mac Data Recovery

A question mark where the desktop should be. A MacBook that took a mug of tea. A Mac mini that has stopped waking up. Where the storage unbolts from the machine, the files generally travel out with it, and Apple drives that come apart are ordinary work at this bench. Flash soldered to a logic board is the exception, and this page says so plainly rather than taking your postage first.

Looking at a Mac costs nothing. One drive or blade is £300 + VAT, the figure is written down and agreed before any work begins, and logical faults run under no fix, no fee.

// what macs arrive with

The Apple failures that turn up weekly

Macs break in the same ways as everything else with storage inside it. What marks them out is the warning, which is none: the machine behaves perfectly right up to the morning it does not. Six patterns cover nearly all of it.

A flashing folder with a question mark

One message and nothing more — macOS hunted for a system to start from and found none. Underneath, the storage has usually worn out or lost the structures pointing at the system folder, while the documents themselves sit exactly where they were left.

An iMac disc that has reached the end

Every iMac up to about 2020 has a conventional spinning disc behind the glass, and they finish the way spinning discs always have: a tick, a stall, a volume that disappears at four in the afternoon. Donor parts and filtered air, the same as any other 3.5-inch drive.

A Fusion pairing that came apart

Two devices, one volume, and a record of what lives where that is spread across both. Lose either device and that record cannot be followed, so a healthy half is no use by itself. The pair is copied and rejoined logically at the bench.

A drink through a MacBook keyboard

A spill runs down onto the logic board and stops there far more often than it reaches the storage. The drive usually survives, provided the machine goes off within seconds and nobody leaves corrosion working away for a fortnight.

A macOS update that stalled

An installer stopping halfway leaves an unbootable machine and a set of documents nothing has touched. The storage is copied, the file system is repaired on that copy, and the files are lifted out of it.

An emptied Trash, regretted at once

Deleting marks space as available; it scrubs nothing. What decides the outcome is how much the Mac writes afterwards, which is why a machine left running for a week is a far harder job than one switched off in the first minute.

// which macs this bench can help

One test decides it: does the storage come out?

That is the whole of the rule, and everything else on this page follows from it. Machines with storage that unbolts are ordinary work: iMac and Mac mini through to about 2020, on a plain SATA disc or a Fusion pairing; any MacBook old enough to hold a 2.5-inch disc; and the proprietary plug-in modules used in MacBooks between roughly 2010 and 2017. If the drive can be freed from the machine and put in a jiffy bag, it can be attempted, and the overwhelming majority of those attempts succeed.

Apple Silicon and T2: the honest answer is no

From the T2 chip onwards, and on every Apple Silicon machine since, the flash is soldered directly to the logic board and encrypted by a controller that never leaves it. There is no drive to remove, no module to post, and the keys are held inside silicon that is part of the same board. When one of those machines will not start and the data has not been copied elsewhere, the truthful position is that it cannot be recovered here and that no removable-storage lab can do it either. That is not a sales tactic — it is the design working as Apple intended, and a firm that tells you otherwise on a 2021 MacBook Air is not being straight with you. Anything from 2018 onwards, ring 0800 689 0668 before it goes anywhere near a box and you will have a yes or a no inside a minute. The same applies to a number of Windows ultrabooks, where the flash is soldered for the same reasons.

Freeing it, and what follows

Only the drive makes the journey. Computers are not taken apart at this lab, but lifting an iMac panel or removing a MacBook base plate is ten minutes for any repair shop in Bracknell, Reading or Camberley, and they will do it for a small charge. With the drive out, address the parcel to Guildford Data Recovery, Building 2, Ground Floor, Guildford Business Park, Guildford GU2 8XH and send it tracked and insured. The examination is free, it closes 2 working days after the device is booked in, and nothing further happens until you have read and approved a written figure. There are model-by-model notes on the iMac recovery and MacBook recovery pages, the county service is on data recovery Berkshire, London is on data recovery London, and every band is published under data recovery cost.

// the mac-specific parts that decide the outcome

HFS+ or APFS, and what changes between them

Two file systems turn up on this bench and the difference is not academic. Anything set up before High Sierra will be running HFS+, which keeps one catalogue of every file with a journal beside it; tear the catalogue and the route back is old ground, well mapped and generally quick. APFS, on everything since, never overwrites in place. Fresh data goes to free space, the structures describing the volume are written again as checkpoints, and snapshots and clones let several files share the same blocks on the medium.

Both halves of that design bear on a recovery. The helpful half is that a superseded checkpoint frequently survives intact when the current one is unreadable, so a volume that refuses to mount can often be raised from a slightly older description of itself. The unhelpful half is that space reported as free is where the only copy of last week's work may be sitting, waiting its turn to be reused. That one fact is why every page on this site says to stop using the machine at the moment something looks wrong, and it carries more weight on APFS than it ever did on HFS+.

Why First Aid is a poor opening move

Disk Utility works on the live volume, so any repair it attempts is an edit to the only copy in existence. When it works, nothing is lost and an afternoon is saved. When it halts partway it can leave the structures in a worse condition than it found them, and the material it was rewriting is exactly the material a recovery would have leaned on. Nothing is repaired on an original at the bench: the storage is imaged and every attempt is made against the copy, so a repair that fails costs an hour of bench time and not a byte of your data. If the volume matters more than the computer, the order is image first and experiment second.

Fusion Drive: two devices wearing one name

A Fusion setup is a small SSD and a large mechanical disc joined into a single logical volume, with macOS shuffling the busy material onto the fast device and keeping a record of what went where. Break either device and that record is incomplete, so the volume stops mounting even when one of the two is in perfect health. The commonest mistake on this page follows straight from it: people send the mechanical disc because it is the one making a noise, and the blade holding half the metadata stays bolted into the machine. Both devices are needed, they go in the same parcel, and they are quoted as one job.

FileVault, and the key that has to exist somewhere

Where FileVault is on, the volume is encrypted and the job turns on credentials rather than on hardware. Produce the account password or the recovery key and everything proceeds as usual: image the drive, unlock the image, mend the file system on the decrypted copy. Produce neither and there is no honest offer to make, because the encryption is doing precisely what it was switched on to do. Look properly before packing anything. The key may be held in the iCloud account it was tied to, saved in a password manager, or sitting on the sheet somebody was told to keep somewhere safe.

The blade years

MacBooks built from roughly 2010 to 2017 use plug-in SSD modules that resemble an M.2 blade without being one. Apple altered the connector, the pin count and the controller more than once over those years, so a module from one generation will not seat in the next and none of them fits an adaptor bought online. That is why pushing one into a caddy at home tends to end in nothing at all. The adaptors exist at the bench; at your end the job is to unbolt the module, keep fingers and packaging tape off the gold contacts, and send it as it is.

Two things people mistake for a safety net

A Time Machine drive is worth having and is not the same as being covered. It is only as current as the last occasion somebody remembered to plug it in, and the disc inside it wears out at the same rate as every other disc — a fair share of the external drives that reach this bench turn out to hold a household's only copy of everything. iCloud, meanwhile, is a sync service before it is anything else. With storage optimisation running, a file can be a placeholder on the Mac and complete only in the cloud, or complete on the Mac and never uploaded at all. Which of your folders were genuinely synchronised is something the assessment establishes, not something to guess at while deciding whether the drive is worth sending.

// related pages

Nearby on this site

// the mac questions people ring about

Common questions

Almost never. The symbol says one thing only: no system was found to start from. Nine times in ten the cause is storage that has worn out or lost the structures pointing at the system folder, and the documents are untouched behind it. The drive is copied, the copy is repaired and the files come off that. Whether the Mac ever boots again is a separate question.
Every machine whose storage can be unbolted. iMac and Mac mini on SATA or Fusion up to about 2020, MacBooks with a 2.5-inch disc, and the proprietary blade modules fitted between roughly 2010 and 2017. What travels in the parcel is the drive itself; the computer stays where it is.
Those cannot be recovered, and it is better said now than after you have paid postage. The flash is soldered to the logic board and encrypted by a controller on that same board, so there is nothing to remove and nothing to read elsewhere. If the machine is from 2018 onwards, ring 0800 689 0668 first and it is settled inside a minute.
£300 + VAT for one drive, SSD or blade — the same band as any Windows machine — and a Fusion pairing is charged once, as the pair it is. Logical faults run under no fix, no fee. A drive that was dropped, soaked, burnt or has failed electrically needs invasive work, so 50% of the quoted figure is payable before that stage and the balance only when the data is back.
Please do not. Only the storage is wanted: behind the screen on an iMac, under the base plate on a MacBook. Any repair shop will free it for a few pounds if you would rather not open the machine yourself. A bare drive costs less to post, travels better, and there is nothing at this lab that needs the rest of the computer.
Not if the password or the recovery key can be found. With one of them the work is routine — image, unlock the image, repair the decrypted copy. Without either there is nothing anybody can honestly offer you, which is the encryption working as designed. Check the iCloud account, any password manager in use, and the printed sheet from the day it was switched on.
Both halves, every time. The SSD and the mechanical disc are one volume with the record of what lives where spread across the pair, so a single device on its own is not a partial job; it is an impossible one. Posting only the disc that makes a noise is the most frequent mistake here and it costs a second round of postage.

Mac down? The drive tells the story.

Diagnosis free, one written figure, no fix no fee on logical faults. Start online or ring the freephone.

// getting the media to the bench

Booking a device in — what actually has to happen

Hardly anything walks into this lab; it arrives in a padded box. Tracked, insured post is the least stressful thing that can happen to storage that has already given up, and a parcel handed over at a Bracknell post office before the last collection is usually in Guildford the following working day.

Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.

  • Pick packaging that holds its shape — a rigid carton or a heavy padded mailer — and pack round the unit so it cannot shift in transit. Leave the caddy, the mains adaptor and the leads at home; none of them are wanted at this end.
  • Print the shipping and booking-in form (PDF), put your name and mobile on it along with a sentence describing how the fault started, and slip it in alongside the media.
  • Send it Special Delivery through the Post Office and it travels tracked and covered. A courier account of your own works just as well. The only thing that matters is that somebody signs for it at this end.
  • If you would sooner deliver it by hand, the Guildford reception on the address card takes devices over the counter, Mon–Fri 9:00am–5:30pm. Neither a Bracknell shopfront nor a pickup van exists — those are the two things we cannot offer.
// write this on the label

Guildford Data Recovery

Building 2, Ground Floor
Guildford Business Park
Guildford, GU2 8XH

↓ Print the shipping & booking-in form (PDF)

The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.

Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.