Apple’s PCIe SSDs have always proven challenging for data recovery. We have a good success rate with them, however many of our tools don’t even support working at PCI level. This particular SSD provided a new challenge though.
The SSD we received was initially showing up correctly in the system. Upon access, the disk would read a few bytes and then stop reading. The SSD would remain visible to the system but not respond to any further commands. The only way to bring it back was to cycle power. Yep, the IT classic — Turn it off and on again! The problem is, PCI cards don’t come with on-off switches so the solution needed to work within software.
First I thought a copy task with a scheduled reboot may get the device back online, however I quickly found out PCI slots stay powered on during a reboot 🤦♀️ This means once the device gets stuck, a reboot won’t bring it back on.
My second idea was to schedule shutdowns but the time taken to boot and then restart the copy process seemed like a nightmare.
In the end I found a series of commands which could keep a fairly steady copy process going. The main idea was:
Start a copy task
Pause on error
Toggle the PCI connection using low-level commands
Resume the copy task
Rinse & repeat
Although not the most elegant solution, this process cycled through 647 times, taking an average of 760MB per cycle. In less than 24 hours the whole 512GB device was cloned to another disk ready for recovery.
After this script finished I did find a slightly cleaner way to reset the PCI slot which will result in much faster recoveries in the future.
I was unable to find any mention of this type of recovery online, so if anyone else knows about it, they’re keeping it to themselves. If you know anyone with a failed Mac SSD, get in touch. This is just one of the many solutions we have for recovering them.
Urgent Warning: Fusion Drive always consists of two separate disks. If you want your data back you must get both parts. We’ve heard a number of reports that users with failed Fusion Drives are only given the Hard Disk back when receiving Apple repairs. On its own, the hard drive is not enough to recover all data in original condition. This is especially true if FileVault encryption is used.
What is Fusion Drive?
Fusion Drive is Apple’s version of a hybrid solid state & mechanical disk. It combines a small fast SSD with a large slow hard drive to achieve a balance between cost & performance. Frequently used files are moved to the SSD, and old stale data is sent to the slow hard drive. This is all taken care of automatically behind the scenes. Unless you dig into the terminal, you wouldn’t even know you had two separate disks inside the Mac. Fusion Drive is part of Apple’s Core Storage system. It is somewhat similar to Linux LVM as a volume management system.
What Fusion Drive is not
Fusion Drive does not use the SSD as a cache for files but actually moves data from one disk to the other. This is important, as both disks are required for full recovery.
Why does Fusion Drive exist?
At launch, and even now, the cost for large capacity SSDs is way higher than the cost of an equivalent hard drive. The problem is that SSDs offer huge benefits to the user experience. When you use an SSD, you hardly ever have to wait for things to load. The computer boots up within seconds.
Hybrid drives aim to bridge the gap between solid state and mechanical disks. An iMac with a 3TB Fusion Drive comes with some of the benefits of SSDs, but much less cost. As the cost of SSDs fall, the need for Fusion Drive will eventually disappear. Apple has shown with their current lineup that they’d much rather go all-SSD where possible. Current iMac Pro & MacBook Pro both use 100% SSD internal storage.
We’ve had two recent cases where a user has brought a “Fusion Drive” to us for recovery, but actually only had the hard drive part. Apple had given the damaged hard drive back after replacement, but reused the SSD when creating a new Fusion Drive. This user only had a few GB of data so the Hard Drive hadn’t even been used yet. All the data was stored on the SSD which was now overwritten.
The majority of Fusion Drives we’ve seen have a Seagate ST3000DM001 3TB hard drive combined with a 128GB blade SSD.
We’ve seen a few cases recently where a user has unexpected lost all data, and been left with a disk named OS X Base System. Inside the disk is a file named Install macOS Sierra or Install macOS High Sierra, and a few other system files.
The OS X Base System is usually part of a macOS installer or update, so it’s unclear how disks ended up getting replaced with this.
If this has happened to you, we’d love to hear more about how.
We can usually recover these disks, but it’s really important that you stop using the disk as soon as possible. If you install anything to the disk you could risk losing all the data permanently.
We’ve still got more of these to investigate so we’ll update the post when we’ve learned more.
I have a particularly nerdy Apple rabbit hole to share with you today involving the labels on Apple hard drives. At some point around 2007-2008 Apple started re-labelling the hard drives used in their computers. I’m pretty sure the hard drives in black & white MacBooks were standard white labels with an Apple part number (655-XXXX) printed on them. Now disks feature a black label with white text. Not particularly exciting, but maybe somebody (Jony?) wanted the disks to match the fancy black circuit boards now used in all Apple hardware. That’s the sort of attention to detail we’ve come to love from Apple devices. Whatever the reason, this has resulted in a batch of Toshiba drives in circulation with incorrect information printed on them. I assume these are the result of a simple ⌘+C, ⌘+V error. My speculation is that after printing the labels for the 320GB disk nobody remembered to change the text for the 160GB version.
For reference MK3253GSX is 320GB and MK1653GSX is 160GB. In Apple’s world, both disks use MK3253GSX on the label, even though the correct number is shown when you check Disk Utility or About This Mac > System Information.
This wonky number business all came to a head ? when we were looking for replacement parts for one of these disks. We needed the double headed 160GB drive, not the four headed 320GB.
When I was trying to research this, I was quite suprised to find an old blog post of ours that shows the same problem with Hitachi drives manufactured around the same time. I’ve not found any other mention of this labelling fault, so thought I’d post it up here for future Mac Archaeologists to find.
We’ve had our fairshare of unusual and difficult recoveries over the years, but I have to share a photo of this bent iPhone we recently recovered. It’s an iPhone 5s that has seen better days. I’d love to know how anyone could bend a phone that far without also smashing the screen! It’s impressive.
As always, my first concern was extracting the damaged Lithium battery. I removed that straight away and disposed of it before starting the recovery.
With a bit of TLC and a new battery and screen, the phone was just about working. It stayed working long enough to get an iTunes backup, and extract all the data.
If you have a MacBook or MacBook Pro that’s a few years old, you might have a problem hiding right below your fingertips. If your trackpad has become difficult to press, or stopped clicking all together, you could have a dangerous faulty battery. In MacBook & MacBook Pro laptops, the battery is directly below the trackpad. When the battery fails it can expand, pressing into the bottom of the trackpad.
I’m not sure quite how risky these batteries get, but they almost double in size. Standard battery advice says don’t pierce or burn but when these battery start expanding they could easily get punctured. I saw one so bad last week that the bottom case and trackpad were being pushed apart. (see photo below)
If you click the battery ? icon near the clock at the top-right of your Mac screen you can check the status. (If you don’t see the status, press the option (alt) key before clicking the battery icon.)
From Apple’s help document
You may see any of the following conditions:
Normal: The battery is functioning normally.
Replace Soon: The battery is functioning normally but holds less charge than it did when it was new.
Replace Now: The battery is functioning normally but holds significantly less charge than it did when it was new. You can continue to use the battery until you replace it without harming your computer.
Service Battery: The battery isn’t functioning normally, and you may or may not notice a change in its behavior or the amount of charge it holds. Take your computer in for service. You can continue to use your battery before it’s checked without harming your computer.
If your status shows Replace Now or Service Battery, I would look to get the battery replaced as soon as possible. At the very least, a bulging battery could cause cosmetic damage to your Mac. At worst it could potentially leak or catch fire ?.
If you have a computer, tablet, or mobile you most likely have some of your data stored in the cloud. It may just be syncing your contacts or calendar, or even backing up your photos from your iPhone or Android phone. Whatever the reason it is now a cheap way of keeping your data safe. Or is it?
Never take for granted that your data is getting backed up correctly. Check it yourself.
I had a situation just recently where my wife’s iPhone had just gone through a 60℃ wash.
“That’s okay,” I said, “We have all your data on iCloud…”
A few days later we replaced the phone (thanks insurance) and restored the data back from iCloud. That’s when we discovered iCloud hadn’t been copying Contacts and some other data. Fortunately I had also kept another backup using iTunes on my Mac so was able to restore from there.
Now would be a great time to check your iCloud settings and make sure there’s a green tick next to everything you don’t want to lose!
Another thing to look out for, especially if you have a lot of data, is your upload speed. Unless you have fast broadband, uploading large amounts of data can take time. You’re unprotected until all of the data has reached the cloud. In some cases it can take hours, even days, depending on how much data you have and the speed of your network.
Once you have uploaded all your data, your device will only need to copy new changes so won’t take so long. As a Plan-B, don’t forget to backup to a computer once in a while. You can thank me later.
Don’t leave it until it is too late. You never know when your phone will take a spin in the washing machine.
When Apple release the latest version of macOS (named Sierra) in Autumn, it will include the new APFS filesystem. Apple haven’t launched a new FS for a long time, and this filesystem won’t work for bootable disks at first. Eventually Apple will make this the default filesystem across the whole product line, from the iPhone, through to the Mac.
APFS Upgrade In Place
I have heard that Apple will release a tool to upgrade an existing HFS+ volume to APFS. If you run the upgrade I strongly advise you to make at least a couple of backups first. I would suggest a Time Machine backup and a bootable full disk copy, with online backup if you have it. While the upgrade is cleverly designed to minimise the risk of disk corruption, there is always the chance that failure could leave you with no option but wipe & start again. This is especially true of older Macs that you may have updated through multiple OS versions and accumulated all sorts of nasties along the way.
APFS Data Recovery
We are already working through the APFS documentation to keep ahead of these failures. We will have some recovery tools ready soon. As with most recoveries, the most important thing is to stop as soon as you hit a problem. Remember my new catchphrase, “Most damage to data happens AFTER the original failure!” Or, “It’s not the failure that killed the data, but the failed repair.” (I know, snappy right.)
If you’re a Mac user in Portsmouth & Southsea you might be interested in our Mac Services. We’ve been helping Mac users sort out common and not-so common issues for years. We offer low hourly rates for on-site assistance, No callout fees, and fixed price repairs if you bring the machine to our workshop.
Also, as a specialist Mac data recovery company you can be sure we’ll never do anything that could harm your data.
If you are in Portsmouth or Southsea and having Mac trouble, give us a call on 02392 671 330