Apple’s PCIe SSDs have always proven challenging for data recovery. We have a good success rate with them, however many of our tools don’t even support working at PCI level. This particular SSD provided a new challenge though.
The SSD we received was initially showing up correctly in the system. Upon access, the disk would read a few bytes and then stop reading. The SSD would remain visible to the system but not respond to any further commands. The only way to bring it back was to cycle power. Yep, the IT classic — Turn it off and on again! The problem is, PCI cards don’t come with on-off switches so the solution needed to work within software.
First I thought a copy task with a scheduled reboot may get the device back online, however I quickly found out PCI slots stay powered on during a reboot 🤦♀️ This means once the device gets stuck, a reboot won’t bring it back on.
My second idea was to schedule shutdowns but the time taken to boot and then restart the copy process seemed like a nightmare.
In the end I found a series of commands which could keep a fairly steady copy process going. The main idea was:
Start a copy task
Pause on error
Toggle the PCI connection using low-level commands
Resume the copy task
Rinse & repeat
Although not the most elegant solution, this process cycled through 647 times, taking an average of 760MB per cycle. In less than 24 hours the whole 512GB device was cloned to another disk ready for recovery.
After this script finished I did find a slightly cleaner way to reset the PCI slot which will result in much faster recoveries in the future.
I was unable to find any mention of this type of recovery online, so if anyone else knows about it, they’re keeping it to themselves. If you know anyone with a failed Mac SSD, get in touch. This is just one of the many solutions we have for recovering them.
Urgent Warning: Fusion Drive always consists of two separate disks. If you want your data back you must get both parts. We’ve heard a number of reports that users with failed Fusion Drives are only given the Hard Disk back when receiving Apple repairs. On its own, the hard drive is not enough to recover all data in original condition. This is especially true if FileVault encryption is used.
What is Fusion Drive?
Fusion Drive is Apple’s version of a hybrid solid state & mechanical disk. It combines a small fast SSD with a large slow hard drive to achieve a balance between cost & performance. Frequently used files are moved to the SSD, and old stale data is sent to the slow hard drive. This is all taken care of automatically behind the scenes. Unless you dig into the terminal, you wouldn’t even know you had two separate disks inside the Mac. Fusion Drive is part of Apple’s Core Storage system. It is somewhat similar to Linux LVM as a volume management system.
What Fusion Drive is not
Fusion Drive does not use the SSD as a cache for files but actually moves data from one disk to the other. This is important, as both disks are required for full recovery.
Why does Fusion Drive exist?
At launch, and even now, the cost for large capacity SSDs is way higher than the cost of an equivalent hard drive. The problem is that SSDs offer huge benefits to the user experience. When you use an SSD, you hardly ever have to wait for things to load. The computer boots up within seconds.
Hybrid drives aim to bridge the gap between solid state and mechanical disks. An iMac with a 3TB Fusion Drive comes with some of the benefits of SSDs, but much less cost. As the cost of SSDs fall, the need for Fusion Drive will eventually disappear. Apple has shown with their current lineup that they’d much rather go all-SSD where possible. Current iMac Pro & MacBook Pro both use 100% SSD internal storage.
We’ve had two recent cases where a user has brought a “Fusion Drive” to us for recovery, but actually only had the hard drive part. Apple had given the damaged hard drive back after replacement, but reused the SSD when creating a new Fusion Drive. This user only had a few GB of data so the Hard Drive hadn’t even been used yet. All the data was stored on the SSD which was now overwritten.
The majority of Fusion Drives we’ve seen have a Seagate ST3000DM001 3TB hard drive combined with a 128GB blade SSD.
We’ve seen a few cases recently where a user has unexpected lost all data, and been left with a disk named OS X Base System. Inside the disk is a file named Install macOS Sierra or Install macOS High Sierra, and a few other system files.
The OS X Base System is usually part of a macOS installer or update, so it’s unclear how disks ended up getting replaced with this.
If this has happened to you, we’d love to hear more about how.
We can usually recover these disks, but it’s really important that you stop using the disk as soon as possible. If you install anything to the disk you could risk losing all the data permanently.
We’ve still got more of these to investigate so we’ll update the post when we’ve learned more.
If you need to add or change your Time Machine™️ backup drive, the process is pretty simple. Plug in a new disk and make sure there is nothing on it that you need. In most cases Time Machine will ERASE the disk before using it! You have been warned.
Now might be a good time to find the disk on your desktop and rename it to something obvious like “backups” for example.
Next, open Time Machine Preferences from the Time Machine menu. If you don’t have the Time Machine icon near the clock, you can also find the settings within “System Preferences”.
Click the “Use Disk” button, and Time Machine will start making a new full backup to this new disk. This may take a few hours.
If you have a MacBook or MacBook Pro that’s a few years old, you might have a problem hiding right below your fingertips. If your trackpad has become difficult to press, or stopped clicking all together, you could have a dangerous faulty battery. In MacBook & MacBook Pro laptops, the battery is directly below the trackpad. When the battery fails it can expand, pressing into the bottom of the trackpad.
I’m not sure quite how risky these batteries get, but they almost double in size. Standard battery advice says don’t pierce or burn but when these battery start expanding they could easily get punctured. I saw one so bad last week that the bottom case and trackpad were being pushed apart. (see photo below)
If you click the battery ? icon near the clock at the top-right of your Mac screen you can check the status. (If you don’t see the status, press the option (alt) key before clicking the battery icon.)
From Apple’s help document
You may see any of the following conditions:
Normal: The battery is functioning normally.
Replace Soon: The battery is functioning normally but holds less charge than it did when it was new.
Replace Now: The battery is functioning normally but holds significantly less charge than it did when it was new. You can continue to use the battery until you replace it without harming your computer.
Service Battery: The battery isn’t functioning normally, and you may or may not notice a change in its behavior or the amount of charge it holds. Take your computer in for service. You can continue to use your battery before it’s checked without harming your computer.
If your status shows Replace Now or Service Battery, I would look to get the battery replaced as soon as possible. At the very least, a bulging battery could cause cosmetic damage to your Mac. At worst it could potentially leak or catch fire ?.
I’ve seen someprettyseriousheadcrashes in my time. The worst part of my job is knowing I’ll have to tell someone their data is gone forever. Sometimes media damage can be subtle enough that it’s impossible difficult to even detect by eye. Other times the damage is obvious. Today was one of the clearest I’ve ever seen. What’s worse is that we got two of these identical disks from the same Mac Pro, with identical damage. You have to see it to believe it…
It’s difficult to know how long these damaged disks were left spinning, but it looks like months! If you look closely, you can see that the centre of the disk is worn right through. That black dust everywhere was once the shiny disk surface that stored the data. Nobody in the world can recover data from disk dust.
The easiest way to avoid such serious damage is to power off your hard drive as soon as you hear clicking. If we got these disks sooner it’s possible we could have recovered them.
When Apple release the latest version of macOS (named Sierra) in Autumn, it will include the new APFS filesystem. Apple haven’t launched a new FS for a long time, and this filesystem won’t work for bootable disks at first. Eventually Apple will make this the default filesystem across the whole product line, from the iPhone, through to the Mac.
APFS Upgrade In Place
I have heard that Apple will release a tool to upgrade an existing HFS+ volume to APFS. If you run the upgrade I strongly advise you to make at least a couple of backups first. I would suggest a Time Machine backup and a bootable full disk copy, with online backup if you have it. While the upgrade is cleverly designed to minimise the risk of disk corruption, there is always the chance that failure could leave you with no option but wipe & start again. This is especially true of older Macs that you may have updated through multiple OS versions and accumulated all sorts of nasties along the way.
APFS Data Recovery
We are already working through the APFS documentation to keep ahead of these failures. We will have some recovery tools ready soon. As with most recoveries, the most important thing is to stop as soon as you hit a problem. Remember my new catchphrase, “Most damage to data happens AFTER the original failure!” Or, “It’s not the failure that killed the data, but the failed repair.” (I know, snappy right.)
If you’re a Mac user in Portsmouth & Southsea you might be interested in our Mac Services. We’ve been helping Mac users sort out common and not-so common issues for years. We offer low hourly rates for on-site assistance, No callout fees, and fixed price repairs if you bring the machine to our workshop.
Also, as a specialist Mac data recovery company you can be sure we’ll never do anything that could harm your data.
If you are in Portsmouth or Southsea and having Mac trouble, give us a call on 02392 671 330
We recently received a Macbook Pro for data recovery. When we removed the broken hard drive and installed a new one for the customer, we noticed that the trackpad was not working correctly and would not click when pressed. We dismantled the Mac again and removed the battery which was underneath the trackpad. When the battery was removed we found that the underside of battery had blown and was pushing against the trackpad. We installed a new battery, recovered the customers data and now the mac is working fine.
This drive has a hardware problem that can’t be repaired.
Back up as much of the data as possible and replace the disk. See an authorised Apple dealer for more information.
S.M.A.R.T. Status : Failing
If you see the message above, your hard disk or SSD has started to fail and has reported faults to the Mac. If caught early enough, these disks can usually be recovered. You can try to copy important data to another disk but if the copy process gets stuck for a while, it’s safer to stop. If you leave a failing disk in that state it can deteriorate until the disk is ruined.
If the data is really important, and you’d rather not take the risk, you could have a look at our Mac Data Recovery Services. We have been dealing with these sorts of problems for years and have a developed a really safe way to get the data off in good condition.
Whatever you decide to do, don’t ignore this message. The broken disk cannot repair itself, and will only get worse. In many cases, the disk won’t even be readable by the time you see this warning.
It doesn’t matter if the disk is still inside your iMac or MacBook, we can remove it for you, and even replace the drive at the end of the recovery process if you want. Ask about our Mac Setup service if you are interested.