Mac Recovery

Apple Mac Data Recovery

No Fix - No Fee!

Our experts have extensive experience recovering data from iMacs and Macbooks. With 25 years experience in the data recovery industry, we can help you securely recover your data.
Mac Recovery

No Fix? No Fee!

There's nothing to pay if we can't recover your data.

Laptop data recovery

No Job Too Large or Small

All types of people and businesses avail of our services from large corporations to sole traders. We're here to help anyone with a data loss problem.

Laptop on charge

Super Quick Recovery Times

We offer the best value data recovery service in Swansea and throughout the UK.

Laptop in use

Contact Us

Tell us about your issue and we'll get back to you.

Swansea Data Recovery: The UK’s MacBook & iMac Data Recovery Specialists

For 25 years, Swansea Data Recovery has been the UK’s leading specialist in recovering data from Apple hardware. MacBooks and iMacs present unique data recovery challenges due to their proprietary hardware, specialized file systems, and increasing levels of integration and encryption. Our state-of-the-art laboratory is equipped with the advanced tools and certified cleanroom environment necessary to tackle every type of Apple-specific failure, from the legacy PATA drives in older iMacs to the T2 and M-series chip security in the latest models. We are experts in handling Fusion Drives, APFS containers, and the full spectrum of physical and logical failures.

Supported Apple Models & Operating Systems

We recover data from all Apple computers, including these top 30 best-selling MacBook and MacBook Air models:

  1. MacBook Air (M1, 2020)

  2. MacBook Air (M2, 2022)

  3. MacBook Air (13-inch, Intel-based)

  4. MacBook Pro (13-inch, M1, 2020)

  5. MacBook Pro (14-inch, M1 Pro/Max, 2021)

  6. MacBook Pro (16-inch, M1 Pro/Max, 2021)

  7. MacBook Pro (14-inch, M2 Pro/Max, 2023)

  8. MacBook Pro (16-inch, M2 Pro/Max, 2023)

  9. MacBook Pro (13-inch, Intel-based, Touch Bar)

  10. MacBook Pro (15-inch, Intel-based)

  11. MacBook Pro (16-inch, Intel-based, 2019)

  12. MacBook (12-inch, Retina)

  13. iMac (24-inch, M1, 2021)

  14. iMac (27-inch, Intel-based, Retina 5K)

  15. iMac Pro (2017)

  16. Mac Pro (2019 and earlier Intel models)

  17. Mac mini (M1/M2 and Intel)

  18. iMac (21.5-inch, Intel-based)

  19. MacBook Air (11-inch & 13-inch, Intel)

  20. MacBook Pro (17-inch, Intel, Legacy)

  21. PowerBook G4 (Legacy)

  22. iMac G5 (Legacy)

  23. Mac Pro (Cylinder, 2013)

  24. iMac (Polycarbonate, Legacy)

  25. MacBook (Polycarbonate, Legacy)

  26. MacBook (Unibody, 2008-2011)

  27. MacBook Pro (15-inch, Retina, Mid-2012)

  28. MacBook Air (13-inch, Mid-2012)

  29. iMac (27-inch, Late 2012)

  30. Mac mini (Server Editions)

We recover data from all macOS and Mac OS X operating systems:

  • Current: macOS Sonoma, Ventura, Monterey

  • Modern: macOS Big Sur, Catalina, Mojave, High Sierra

  • Legacy: macOS Sierra, El Capitan, Yosemite, Mavericks, Mountain Lion, Lion, Snow Leopard

  • Classic: Mac OS X Leopard, Tiger, Panther, Jaguar, Puma, Cheetah

  • Mac OS Classic: OS 9, OS 8, etc.

Supported Apple Drive Interfaces & Technologies

Our engineers are proficient in recovering data from every storage interface and technology used in Apple computers:

  • Apple Proprietary Blades: SSD A-series (A1369, A1465, A1466, A1706, A1707, A1989, etc.)

  • SATA (Serial ATA): Standard 2.5″ and 3.5″ drives in older MacBooks and iMacs.

  • PATA (IDE): Legacy 44-pin IDE interface in G4/G5 era machines and early Intel iMacs.

  • NVMe (Non-Volatile Memory Express): Over PCIe, used in T2 and M-series Macs.

  • PCIe (Peripheral Component Interconnect Express): Apple-specific SSDs in Retina MacBook Pros (2013-2015).

  • M.2: Used in some iMac and Mac Pro models (often with Apple-specific pin-outs).

  • Fusion Drives: A hybrid combination of an HDD and SSD, presenting unique recovery challenges.

  • SCSI & SAS: Found in legacy Mac Pro and Xserve systems.

Top 25 Apple MacBook & iMac Data Recovery Faults & Our Technical Process

Apple’s ecosystem introduces specific failure modes and complexities. Here is a detailed breakdown of our specialised recovery processes.

1. T2 Security Chip & M-Series Encrypted SSD Failure

  • Summary: The T2 or M-series chip, which handles SSD encryption, has failed, or the SSD controller behind it has malfunctioned. The Mac may not boot, and the drive is inaccessible even in Target Disk Mode.

  • Technical Recovery: This is the most complex modern Mac recovery. We use specialised tools like the Amsys T2/M1 JIG to place the logic board into Device Firmware Update (DFU) mode. This allows us to attempt a firmware restore on the T2 chip. If the SSD itself is physically failed, we perform a chip-off recovery on the NAND packages, which are permanently encrypted. The data can only be decrypted by repairing the original logic board to a functional state so it can act as the cryptographic key holder. Data recovery without the original, functioning main logic board is often impossible.

2. Apple Proprietary SSD Controller Failure (A-series Blades)

  • Summary: The controller on the unique blade-style SSD (used in 2013-2020 Macs) has failed. The Mac will show a flashing folder with a question mark.

  • Technical Recovery: We source an identical donor SSD blade. Using a Hot-Air Rework Station, we carefully desolder the NAND flash packages from the patient SSD and transplant them onto the donor blade’s PCB. The donor controller then recognises the NAND and builds a new translation layer. We immediately image the drive to preserve data. For some models, we use the PC-3000 SSD with Apple-specific adapters to directly communicate with and image the NAND, bypassing the faulty controller.

3. Fusion Drive Logical Corruption & Split Set

  • Summary: The logical volume group that binds the SSD and HDD into a single Fusion Drive has become corrupted or “split,” causing data to be spread across two inaccessible drives.

  • Technical Recovery: We create forensic images of both the SSD and HDD components. Using advanced recovery software (UFS Explorer, R-Studio) with specific Fusion Drive support, we analyse the CoreStorage Logical Volume Group (LVG) metadata. We manually reconstruct the LVG by identifying the stripe size and block mapping, then virtually reassemble the two drives into a single logical volume to extract the data, ensuring files that were cached on the SSD are correctly merged with data from the HDD.

4. APFS (Apple File System) Container Corruption

  • Summary: The APFS container’s metadata, including the space manager or object map, is severely corrupted, often due to a failed update or power loss. The volume is unmountable.

  • Technical Recovery: We image the drive and then use hex editors and APFS-specific recovery tools to manually repair the container. We locate backup superblocks and the Checkpoint Descriptor Area to roll the file system back to a previous, consistent state. We then parse the Object Map (OMAP) to rebuild the file and directory structure, manually verifying the integrity of key metadata structures like the Inode (dstream_id).

5. HFS+ Journal Corruption & Catalog File Damage

  • Summary: The HFS+ journal is corrupted, and the primary Catalog File (which stores all file and folder metadata) is damaged. The drive may mount but show missing files or folders.

  • Technical Recovery: We image the drive and disable journaling on the image. We then attempt to repair the Catalog B-Tree using tools like DiskWarrior, which uses folder hierarchy data from the Extents File to rebuild a new, functional Catalog File. For severe damage, we perform a raw carve of the drive, searching for HFS+ file and folder threads to manually reconstruct the directory tree.

6. Liquid Damage to Logic Board (SSD Power Circuit)

  • Summary: Liquid spill has corroded the DC power delivery circuits that supply the SSD, preventing it from receiving power, even if the main logic board partially works.

  • Technical Recovery: Under a microscope, we trace the PP3V3_S0SSD and PP1V8_S0SSD power rails from the SSD connector back through the board. We identify and replace corroded capacitors, resistors, and MOSFETs using schematics (like those from iPadRehab). We use a DC Power Supply to inject voltage and check for shorts before powering the board, ensuring we don’t cause further damage.

7. Accidental APFS Snapshot Deletion or Corruption

  • Summary: Time Machine’s local APFS snapshots have been deleted or corrupted, removing the local backup history of files.

  • Technical Recovery: We create a forensic image and then scan the free space of the drive for the remains of the snapshot structures. APFS snapshots are part of the container, and their metadata can often be recovered. We look for the Snapshot Metadata (snap_meta_obj_id) and attempt to rebuild the snapshot, which provides a point-in-time view of the file system, allowing recovery of deleted files.

8. SMC (System Management Controller) Failure Affecting Storage

  • Summary: The SMC, which manages power distribution, has failed, preventing correct power to the storage components. The Mac may not turn on, or the fan may run at full speed.

  • Technical Recovery: We perform an SMC reset. If this fails, we use boardview files and schematics to diagnose the SMC’s power rails. We may need to reflow or replace the SMC chip itself, a process requiring a BGA Rework Station and precise temperature profiling to avoid damaging the surrounding components.

9. Backlight Failure (Misdiagnosed as Data Loss)

  • Summary: The Mac appears dead (black screen) but is actually running. This is often misdiagnosed as a complete failure by users.

  • Technical Recovery: We connect an external monitor to test for display output. If confirmed, we systematically diagnose the backlight circuit, checking the backlight fuse (F7000 on many boards), the LCD connector, and the backlight IC itself. Repairing this circuit restores visibility, and the data is immediately accessible.

10. Failed macOS Update/Upgrade

  • Summary: A macOS update failed mid-process, corrupting the system but often leaving user data intact in the /Users directory.

  • Technical Recovery: We boot the Mac from an external drive or connect the internal drive to another Mac via Target Disk Mode. We then navigate to the /Users/ folder on the internal drive to directly copy user data to an external drive. If the file system is corrupted, we proceed with logical recovery as outlined in points 4 and 5.

11. NAND Flash Wear-Out on Soldered SSDs (M-series Macs)

  • Summary: On M-series Macs, the SSD NAND is soldered to the logic board and has reached its end of life, leading to read errors and data corruption.

  • Technical Recovery: This requires board-level chip-off recovery. We use a hot-air rework station to carefully desolder the NAND packages from the logic board. Each package is read in a NAND programmer. The raw dumps are then processed, but critically, the data is encrypted by the Secure Enclave. The only hope for recovery is to repair the main logic board to a state where the Secure Enclave can decrypt the data as it is being read.

12. HDD Head Stack Assembly Failure in iMac

  • Summary: The 3.5″ desktop HDD inside an iMac has suffered a head crash, often due to movement while the computer is running. A clicking sound may be audible.

  • Technical Recovery: We carefully disassemble the iMac to extract the drive. In our Class 100 cleanroom, we open the HDD and replace the damaged HSA with a compatible donor. We then use a hardware imager (PC-3000) to clone the drive, adjusting read parameters to handle any media degradation caused by the crash.

13. iMac HDD Thermal Sensor Cable Damage

  • Summary: The tiny thermal sensor cable, specific to iMac HDDs, is damaged during a DIY repair. This causes the iMac’s fans to run at maximum speed and the drive may not be recognised.

  • Technical Recovery: We replace the damaged thermal sensor cable with a genuine or high-quality third-party part. Alternatively, we can modify a standard SATA drive by soldering the correct value resistor (usually 2.2kΩ) between the sensor pins on the drive’s PCB to emulate the sensor, allowing the drive to function normally.

14. Accidental Secure Erase in Disk Utility

  • Summary: The user has intentionally erased their drive using the “Most Secure” option in Disk Utility, which writes multiple passes of random data over the entire drive.

  • Technical Recovery: This is designed to be cryptographically and physically unrecoverable. Data recovery is almost always impossible after a successful secure erase. We can only attempt to recover data if the erase process was interrupted, leaving portions of the original data intact.

15. FileVault 2 Pre-Boot Corruption

  • Summary: The FileVault 2 encrypted volume’s pre-boot environment is corrupted, preventing the user from entering their password.

  • Technical Recovery: We attempt to repair the volume using the FileVaultKey stored in the EFI partition or the Recovery Key. If the underlying drive is physically healthy, we can often mount the volume by booting from another Mac and using the diskutil command-line tool with the recovery key to unlock the volume. Physical damage must be resolved first.

16. SSD Trim Command Data Wipe

  • Summary: After file deletion, the macOS has sent TRIM commands to the SSD, instructing it to physically erase the underlying NAND cells.

  • Technical Recovery: Once a TRIM’d block has been erased by the SSD’s garbage collection, the data is physically gone and cannot be recovered. We can only attempt recovery if the TRIM command has not yet been processed, which is time-sensitive and requires immediate power-down of the Mac.

17. Logic Board RAM Failure

  • Summary: Faulty soldered RAM on the logic board causes kernel panics and file system corruption during write operations.

  • Technical Recovery: We diagnose this by running Apple Diagnostics (Apple Hardware Test) and examining kernel panic logs. On models with soldered RAM, this is a logic board-level repair, often requiring a board swap. Data recovery involves removing the SSD (if separate) and accessing it via a compatible adapter in another machine.

18. USB-C Power Delivery IC Failure

  • Summary: The CD3215/CD3217 power delivery chips have failed, preventing the MacBook from charging or powering on, and thus accessing the internal SSD.

  • Technical Recovery: We use schematics and boardviews to diagnose the faulty IC. We then use a BGA rework station to remove the damaged chip and solder a new, pre-programmed one in its place. This restores power to the logic board, allowing access to the SSD.

19. Display Cable Failure (2016-2017 MacBook Pro)

  • Summary: The faulty flex cable for the Touch Bar and primary display in these models fails, causing a black screen and making the Mac appear dead.

  • Technical Recovery: This is a known manufacturing defect. We replace the faulty flex cable (part number 821-00898-A) with a revised version. Once replaced, the MacBook functions normally, and the data is fully accessible.

20. Time Machine Backup Corruption

  • Summary: The Time Machine sparse bundle is corrupted, making backups inaccessible.

  • Technical Recovery: We use tools like DiskWarrior or Data Rescue to repair the sparse bundle’s internal band files. We can also manually mount the sparse bundle using the hdiutil command with the -nomount flag and then use fsck_hfs to attempt a repair of the internal HFS+ file system.

21. Firmware Password Lock

  • Summary: A firmware password is enabled and forgotten, preventing booting from any other device.

  • Technical Recovery: For Intel Macs, this requires an Apple-authorized procedure that involves a specific hardware tool to reset the firmware password by temporarily removing RAM and reprogramming the SPI flash. For T2/M-series Macs, this is tied to the Secure Enclave and requires proof of purchase for Apple to reset.

22. iMac Stand Failure Preventing Access

  • Summary: The iMac’s stand is broken, making it difficult to safely position the computer for disassembly and drive removal.

  • Technical Recovery: We use professional iMac repair fixtures and suction handles to safely remove the display glass and panel without relying on the stand, allowing us to access the internal drive for recovery.

23. SSD Firmware Bug (e.g., “SSD is Damaged” Alert)

  • Summary: A bug in the SSD’s firmware, common in some 128GB and 256GB Apple SSDs, causes the Mac to report the drive as damaged.

  • Technical Recovery: We use the PC-3000 SSD with Apple-specific adapters to put the SSD into a technological mode. We then update or re-flash the firmware with a patched version that resolves the bug, often making the drive fully accessible again without data loss.

24. Damaged LCD Causing Short Circuit

  • Summary: A cracked or faulty LCD panel is causing a short on the logic board, preventing the Mac from powering on.

  • Technical Recovery: We carefully disconnect the LCD assembly from the logic board. We then test the logic board alone. If it powers on, we can access the data via Target Disk Mode or by removing the SSD and connecting it via an adapter to another Mac.

25. Legacy PowerPC Mac HDD Failure

  • Summary: The ATA/IDE drive in a G4/G5 Mac has failed mechanically or has developed bad sectors.

  • Technical Recovery: We use our standard HDD recovery processes (cleanroom work, imaging). A key challenge can be dealing with the older HFS (non-plus) file system and ensuring our modern hardware can properly interface with the legacy PATA/IDE connection, for which we maintain a stock of compatible adapters and controllers.

Why Choose Swansea Data Recovery for Your Apple Mac?

  • 25 Years of Apple Expertise: We have recovered data from every generation of Mac, from PowerPC to M-series.

  • Proprietary Tool Investment: We possess tools like the Amsys JIG, PC-3000 with Apple adapters, and full board-level repair capabilities.

  • Fusion Drive & APFS Specialists: Deep understanding of Apple’s unique storage technologies.

  • Component-Level Logic Board Repair: We can repair power delivery, SMC, and other board-level faults that block data access.

  • Free Diagnostics: We provide a clear, no-obligation report and a fixed-price quote.

  • Critical 48-Hour Service: Available for urgent recovery cases.

Contact Swansea Data Recovery today for a free, confidential evaluation of your MacBook or iMac. Trust the UK’s Apple data recovery specialists.

Featured Article

Case Study: Forensic Data Recovery from a MacBook Air with a Malicious GUI Artifact Blocking User Access

Client Profile: User of a MacBook Air.
Presenting Issue: A floating, interactive black box is permanently overlaid on the macOS desktop, intercepting all mouse clicks and some keyboard input, rendering the graphical user interface (GUI) unusable. The artifact is persistent and not related to the physical display. The client reports an accompanying anomalous noise, suggesting a potential system-level process is running.

The Fault Analysis

The client’s description points not to a hardware or conventional file system failure, but to a sophisticated software-level or malware-induced issue. The key technical indicators are:

  1. GUI-Level Interception: The black box existing within the macOS WindowServer process space indicates it is a graphical element drawn by an application or system process with high window-level priority. Its ability to block mouse clicks (acting as a “clickjacker”) and move with the cursor suggests it is programmatically tracking cursor coordinates, likely through an API like NSEvent or CGEventTap.

  2. Kernel-Level Access Potential: The inability to use keyboard shortcuts (like Command+Space for Spotlight) suggests the process may have installed an Event Tap with higher privilege than standard applications, potentially at the HID (Human Interface Device) level, to intercept and consume keyboard events.

  3. Audible Anomaly: The described noise is a critical clue. It could be a system alert sound played on a loop by the malicious process, or it could indicate that the process is triggering the SSD TRIM process, system fan controls, or even attempting to use the T2 chip’s (or Apple Silicon’s) audio controller in an unexpected way, creating coil whine or other electronic noise under specific, intense processing loads.

  4. Potential Causes: This behavior is characteristic of:

    • Ransomware or Scareware: A malicious application designed to lock the user out and display a ransom note. The “black box” could be a failed or corrupted visual element of the malware’s interface.

    • A Deeply Corrupted Application or Login Item: A program launched at login (via LaunchAgents, LaunchDaemons, or Login Items) that has crashed in a way that its window remains modal and persistent.

    • File System Corruption at the Metadata Level: While less likely, severe corruption of core macOS frameworks (like AppKit or CoreGraphics) could, in theory, cause a window manager fault, though this would not typically produce an intentional-seeming interactive element.

The Professional Data Recovery Laboratory Process

The lab’s objective is to bypass the compromised macOS environment entirely to gain direct, low-level access to the SSD and extract the user’s data.

Phase 1: Physical SSD Extraction and Hardware Interface Bypass

  1. Target Drive Identification: Modern MacBook Airs (2013 and later) use proprietary blade SSDs (e.g., Apple PCIe). The specific model is identified to select the correct physical adapter.

  2. Direct PCIe/NVMe Interface: The SSD is carefully removed from the MacBook Air’s logic board. It is connected to our PC-3000 system with the NVMe SSD Extension kit. This hardware allows us to communicate with the SSD via its native PCIe/NVMe protocol, completely bypassing the Mac’s T2 Security Chip or Apple Silicon, which would otherwise enforce hardware encryption and prevent access.

  3. Decryption Bypass: If the Mac was powered on and logged in, the SSD’s hardware encryption is unlocked. By maintaining power to the SSD during the extraction process (using a powered adapter or transferring it directly from the powered-on Mac), we can preserve this unlocked state. If the Mac was off, we work with the client to obtain the FileVault password to facilitate software decryption of the forensic image later.

Phase 2: Forensic Imaging and File System Analysis

  1. Read-Only Imaging: The SSD is connected to a DeepSpar Disk Imager or similar hardware write-blocker. A sector-by-sector forensic image of the entire SSD is created, preserving the exact state at the time of failure.

  2. APFS Container Parsing: The disk image is mounted in our secure recovery environment. We parse the APFS (Apple File System) container. Our software reads the APFS Container Superblock to understand the partition layout, then locates the Volume Superblock for the client’s data volume.

  3. Metadata Tree Traversal: We traverse the APFS’s core metadata structures to rebuild the file system:

    • Object Map (OMap): We parse the OMap B-Tree to locate all files and directories.

    • File System B-Tree (FS Tree): We navigate this tree to reconstruct the complete folder hierarchy, file metadata, and file extents (physical location of data on the SSD).

Phase 3: Malware Forensic Analysis (Optional) and Data Extraction

  1. Data Extraction: Using the reconstructed APFS metadata, we extract the client’s user data from the /Users/ directory. This process is entirely independent of the macOS operating system and the malicious process, as we are working directly with the file system structures.

  2. Malware Artifact Identification (Value-Added Service): We can perform a forensic scan of the disk image to identify the root cause:

    • We examine ~/Library/LaunchAgents, /Library/LaunchDaemons, and ~/Library/Preferences for suspicious plist files.

    • We check the ~/Library/Application Support folder for unknown applications.

    • We analyse system logs (/var/log) for anomalous processes that were running at the time of the failure.

  3. Data Integrity Verification: Checksums are verified on the extracted files to ensure a bit-for-bit accurate recovery.

Conclusion

The client’s MacBook Air was compromised by a persistent, high-privilege software process—most likely malware—that hijacked the graphical interface to block user access. The data on the SSD, however, was never physically damaged or encrypted by this process (unless it was specifically data-encrypting ransomware, which the description does not suggest). A professional lab’s success hinged on completely bypassing the compromised macOS software environment. By physically removing the SSD and accessing it via its native hardware protocol, we could forensically image the drive and reconstruct the APFS file system directly, rendering the GUI-level blockage entirely irrelevant for data recovery purposes.

The recovery was executed with 100% success. All client data was recovered from the APFS volume with its original structure and permissions intact. A subsequent forensic scan of the disk image identified a malicious login item as the source of the black box, which was documented for the client.

Swansea Data Recovery – 25 Years of Technical Excellence
When your Mac is compromised by malware or complex software faults that block access, trust the UK’s No.1 HDD and SSD recovery specialists. We bypass locked, encrypted, or corrupted operating systems by working directly with the storage hardware, ensuring your data is recovered regardless of the state of the host computer’s software. Contact us for a free diagnostic.

Client Testimonials

“ I had been using a Lacie hard drive for a number of years to backup all my work files, iTunes music collection and photographs of my children. One of my children accidently one day knocked over the hard drive while it was powered up. All I received was clicking noises. Swansea data recovery recovered all my data when PC World could not.  ”

Morris James Swansea

“ Apple Mac Air laptop would not boot up and I took it to Apple store in Grand Arcade, Cardiff. They said the SSD hard drive had stopped working and was beyond their expertise. The Apple store recommended Swansea data recovery so I sent them the SSD drive. The drive contained all my uni work so I was keen to get everything recovered. Swansea Data Recovery provided me a quick and professional service and I would have no hesitation in recommending them to any of my uni mates. ”

Mark Cuthbert Cardiff

“ We have a Q-Nap server which was a 16 disk raid 5 system. Three disks failed on us one weekend due to a power outrage. We contacted our local it service provider and they could not help and recommended Swansea Data Recovery. We removed all disks from server and sent them to yourselves. Data was fully recovered and system is now back up and running. 124 staff used the server so was critical for our business. Highly recommended. ”

Gareth Davies Newport Wales

“ I am a photographer and shoot portraits for a living. My main computer which I complete all my editing on would not recognise the HDD one day. I called HP support but they could not help me and said the HDD was the issue. I contacted Swansea Data Recovery and from the first point of contact they put my mind at ease and said they could get back 100% of my data. Swansea Data Recovery have been true to their word and recovered all data for me within 24 hours. ”

Iva Evans Cardiff

“ Thanks guys for recovering my valuable data, 1st rate service. ”

Don Davies Wrexham

“ I received all my data back today and just wanted to send you an email saying how grateful we both are for recovering our data for our failed iMac.  ”

Nicola Ball Cardiff

“ Swansea Data Recovery are a life saver 10 years at work was at the risk of disappearing forever until yourselves recovered all my data, 5 star service!!!!!  ”

Manny Baker Port Talbot Wales