MacBooks tend to bow out quietly. The charger stops being acknowledged, or a lid closes on a working machine that never wakes, or a folder with a question mark on it appears on an otherwise unremarkable morning. Where the storage comes out — the SATA disks in the older bodies, and Apple's own blades up to 2017 — whatever was written to it is very probably intact, drinks included. What follows is ordinary work and one limit worth reading before you pay for postage.
Looking at a MacBook costs nothing. What comes out of that examination is one written figure, agreed between us before anybody picks up a screwdriver: £300 + VAT for one hard disk or SSD, an NVMe blade counting as a single drive.
Logical work is no fix, no fee. Four things sit outside that: electronic and mechanical failures, chip-level work, DVR jobs and forensic work, and anything physical is half up front. All five bands are laid out on the data recovery cost page, while data recovery services follows a postal job from the parcel to the answer.
Tracing a symptom back to whatever caused it is where the job genuinely starts, and these thirty cover very nearly every box opened on the Oxford bench. A fault that is not on the list is not an unfamiliar one: describe it over the telephone and you will get a straight reading of the odds before you have spent a penny on postage.
Charging circuits and power management chips fail on their own account and tell you nothing about the storage. Whether that matters depends entirely on which machine you have: on a body up to 2017 the drive comes out and is read, and on a 2018 or later machine the board is the storage. The model year is the first question asked on the telephone.
Liquid gets under the keys and onto the board immediately, and on the thinner bodies there is very little space between the two. Corrosion continues quietly for weeks. Where the machine has a removable drive, that drive is usually the least affected part in the case. Where the flash is soldered, a corroded board is the end of the story.
The machine cannot find a system to start from. That can be a failed drive, a damaged container, or simply a start-up disk setting that has been lost. Repeatedly holding the power button to try again is the instinctive response and the least helpful one, particularly on the older models that still have a spinning disk in them.
An update interrupted, or one that did not agree with the machine, leaves it cycling and the home folder untouched. Nothing has been deleted. On a removable drive the volume is imaged and the user data lifted out. On a soldered machine, whether anything can be done depends on the board still working, which is a different question with a different answer.
The unibody MacBook Pros up to 2012 used ordinary 2.5-inch disks, and those fail mechanically like any other. A tick, a rasp or a repeating sweep means heads that cannot find their bearings, and further start-ups make it worse. Head replacement under filtered air is physical work: 50% up front and outside no fix, no fee.
Backlight circuits, display cables and graphics faults all produce a machine that chimes and shows nothing. None of them touches the storage. On the machines with a removable drive the answer is simply to take it out. On the later ones an external display or a target disk arrangement may get the files off, provided the board is healthy.
From 2018 the Intel machines with a T2 chip, and every Apple Silicon MacBook Air and Pro since, have their storage soldered down and encrypted by the Secure Enclave inside the processor. There is nothing to unplug and the chips cannot be read anywhere else, because the keys never leave that particular machine. A dead board means the data has gone, and there is no bench in the country that can honestly say otherwise.
The 2013 to 2017 blades stop answering the bus in the same way any other flash device does, and the memory behind the controller is usually untouched when they do. Service-mode access is tried first because it leaves the module intact. Where the controller will not answer at all, the packages are read directly, which is chip-level work at 50% up front.
With the login password or the recovery key an encrypted volume is ordinary work in the 400 pounds + VAT band. Without either, there is no route in for anybody, and the mathematics is the whole answer. Look for the key before you post anything, because it changes the situation entirely rather than slightly.
The module is listed, the container is listed, and nothing inside opens. That is structural damage rather than hardware failure and the data is generally present behind it. It is worked from an image, never from the original, and the detail of how Apple file systems come apart is on the Mac OS X recovery page rather than repeated here.
macOS suggests erasing whenever it cannot interpret a volume, and the wording makes it sound like the obvious next step. It is the one thing not to agree to. Shut the machine down instead and let the volume be read in the state it is in now, which is better than the state it will be in afterwards.
On a spinning disk a deleted file survives until something is written on top of it. On flash, TRIM tells the controller to clear those blocks in the background, and once that has run the data is genuinely gone rather than merely hidden. The only useful action is to shut the machine down properly and leave it off, and the sooner that happens the better the odds.
A broken screen or a hinge that has torn its cable run makes a machine not worth mending, and it says nothing whatever about the storage. On the older bodies the drive comes out in a few minutes. On a soldered machine the board still working is what decides whether anything can be done at all.
Ageing batteries in the thin bodies expand, push the trackpad up and bow the bottom cover, and left long enough they press on the board above them. It is a genuine hazard as well as a fault. Stop using the machine, do not charge it, and mention the swelling when you book in, because it changes how the machine is handled at both ends.
Blades snap where they are screwed down, usually when somebody has levered rather than lifted. The break is at the edge of the board and the memory packages in the middle are frequently untouched. Rebuilding the connection at magnification is rework, and where the tracks cannot be repaired the packages are read directly instead.
On the older spinning models this is a disk relocating sectors it can no longer read first time, and the refusal at the end is the point where the spares ran out. On flash it is more often error correction working harder and harder until the controller stops. Both give a warning period, and both are much easier to deal with during it.
Blocked vents, dried paste and years of dust raise the temperature of everything in a thin case. Flash does not like heat and neither does a mechanical disk. Where documents have been opening as gibberish for months on a machine that is uncomfortable to hold, the storage has been trying to tell you something.
Moving to a new Mac sometimes copies part of an account, or makes a second one and leaves the original where it was. In nearly every case the data is still whole on the old machine. Stop using the old MacBook, and have its drive read rather than running the migration again in the hope of a better outcome.
An erase on a spinning disk leaves most of the data physically present and a good recovery is likely. An erase on flash, particularly with FileVault involved, is usually final because it discards the keys rather than the data. The difference is established during the free diagnostic and you are told which of the two you are in.
The disk mounts, the sparse bundle refuses to open, and the restore stalls part way. Backups are ordinary volumes with an unusual structure over the top, and a damaged one is generally taken apart and read directly. If the MacBook and its backup drive have both failed, send the backup drive as well, sealed in its own case.
Editing, design and audio work rarely lives in one place, and it is usually an external volume that fails first because it is the one being carried between home and a studio. List every drive that was part of the job on the booking form, because a project reassembled from two thirds of itself is not a project anybody can use.
Flash cells leak charge whether the machine is used or not, so a laptop left unpowered for years is not an archive. Some of these come back complete and some come back with gaps that error correction on the bench can no longer close. Nothing improves by waiting another twelve months, which is the only practical advice worth giving.
Consumer tools work by reading the whole device over and over, which is the wrong treatment for a failing drive, and several of them save their own working data onto the very volume they are examining. Say on the booking form if one has been used. It seldom rules a recovery out and it always changes the safest order to work in.
Activation locks and firmware passwords produce a laptop that starts and goes no further, and neither of them affects the storage. On the older bodies the drive comes out and is read straight away. On the newer ones the lock and the encryption are part of the same system, and that is a harder conversation to have honestly.
Uncommon on Apple hardware and by no means unheard of, and the laptop itself is generally untouched. What returns depends on the strain, on whether any APFS snapshots came through the run, and on how much has been written to the volume afterwards. Pricing follows the ordinary bands at 300 pounds + VAT for one drive, and it is neither treated nor invoiced as a forensic job.
Companies send these in wanting to know what was copied off before it was returned. That is forensic work rather than recovery: 800 pounds + VAT with a full written report, or 400 pounds + VAT for a binary image with deleted-file extraction and no report. It has to be treated as forensic from the outset rather than after somebody has browsed the disk.
Target disk mode on an Intel Mac, and share disk on an Apple Silicon one, only work when the machine still starts and the storage still answers. They are a way of moving files off a healthy computer with a broken screen, not a recovery technique. If the machine will not reach that state, the arrangement has nothing to offer.
A Boot Camp installation puts an NTFS volume alongside the Apple one on the same disk, and a partition map that has been damaged takes both out together. Windows files are recovered from an Apple disk here in exactly the same way as anything else, and having two file systems on one drive does not change the price.
A component that works cold and fails warm, on either a disk or a blade. Each cycle of trying it, getting ten minutes, and losing it again wears the fault in further. The right move is to stop trying, because the machine is spending the last of its cooperative starts on attempts that are not recovering anything.
A working MacBook going to a new owner, with a decade of photographs, coursework and correspondence on it and no backup that has run this year. On a body with a removable drive this is the cheapest job on the page. On a soldered machine it has to be done while the computer still works, which is exactly the point.
Everything on this page turns on whether the flash can be separated from the logic board. Bodies up to 2012 carry a standard SATA drive, and any third-party SSD fitted into one of those counts the same. Between 2010 and 2017 Apple used a series of proprietary blade modules with their own edge connectors; those unclip, and the adapters for reading them are already here rather than ordered once a job appears. From 2018 the Intel machines with a T2 chip put the storage on the board, and every Apple Silicon machine does the same. Once flash is soldered there is no route in, not here and not anywhere being straight with you. The interesting part is the blades in the middle. They are conventional flash sitting behind an unusual plug, and their controllers fail far more often than their memory does, so a blade that has disappeared from a machine completely is a more promising arrival than its owner tends to assume. Where the controller cannot be revived, the packages come off and are read directly, which is chip-level work: half up front, outside the guarantee, and named before you agree.
A drink goes through a MacBook keyboard and is on the board inside a second or two, after which corrosion carries on working for weeks regardless of how dry the outside looks. On the models with removable storage the drive sits clear of the worst of the mess and normally comes through intact. What kills these machines is rarely the spill: it is the optimistic power-up two days later, when a shorted rail takes out components that were undamaged until that moment. Leave it off, get the storage out if you can, and write down in the note what went in and when. Software calls for the same restraint. Disk Utility will offer to erase a volume that refuses to mount, which is not a repair and which replaces exactly the structures a recovery would be built from. First Aid writes to the volume it is examining, so a fifth run tells you nothing the first did not. On the flash machines there is a clock as well: TRIM erases released blocks whenever the machine has power, so a full shutdown beats closing the lid.
A MacBook that arrives as a drive or a blade is worked like any other storage. What is particular to Apple is the connector it came off, the file system on it and the encryption over the top, and the bench is equipped for all three.
Apple used four incompatible blade connectors between 2010 and 2017 and none of them fits a standard M.2 socket, which is why so many of these modules read as dead in an enclosure bought online. The adapters for each generation are on the bench, along with SATA for the earlier bodies.
APFS containers and HFS+ catalogues reconstructed from an image, with snapshot history used where it has survived. Nothing is repaired on the module that arrived, so whatever state it is in when it gets here is the state it stays in.
The controllers in Apple blades, like those in ordinary SSDs, have a diagnostic mode used in production, and most families still answer to it. That is the first route tried on a module that has stopped answering, because it leaves the hardware whole and takes hours rather than days.
Where the controller will not respond at all, the memory packages come off the board under controlled heat and are read individually, and the page order, interleave and error correction the original controller used are reproduced in software before anything reads as a file. That is chip-level work: 50% up front and outside no fix, no fee.
Encrypted volumes are unlocked on a copy using the password or the recovery key, and the module is never written to. The encrypted band is 400 pounds + VAT. Without the password or the key the answer is no, and it is given at the diagnostic stage rather than after an invoice.
The MacBook and MacBook Pro bodies up to 2012 carry ordinary 2.5-inch disks, and those get the same clean-air treatment as any other notebook drive: donor heads matched by firmware family, the drive levelled and supported, and imaging done head by head afterwards.
Everything on this page comes down to one question, and it is worth settling before you pay for packaging: does the storage come out. Where it unscrews or unclips, this bench can work on it, and that takes in the SATA disks fitted up to 2012, any aftermarket drive put into one of those bodies, and every Apple blade module made between 2010 and 2017. Where the flash forms part of the logic board, as it does on all Apple Silicon models and on the Intel machines built from 2018 with a T2 chip, it cannot be worked on here or anywhere else, and a laboratory telling you otherwise is not being straight with you. A drive or blade is 300 pounds + VAT, examined at no charge, with that examination closing two working days after arrival and the recovery finished two to four working days after the figure has been agreed. An encrypted volume, FileVault among them, moves to 400 pounds + VAT. Where memory packages have to be lifted off a blade it becomes chip-level work: half up front, and named in the published exclusions. Post the drive and keep the laptop, and where the model year leaves you unsure which of the two situations applies, ring 0800 689 0668 before spending money on postage. Nothing with a touchscreen and no keyboard is accepted, iPads included.
Almost everything worked on here arrived in the post. A drive that is already in trouble has an easier time boxed, padded and insured than it does being carried round in a bag for an afternoon, and a parcel handed over in Coventry today is normally booked in at Oxford tomorrow morning.
As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.
↓ Print the shipping & booking-in form (PDF)
Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.
Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.
Looking at it costs nothing, one written figure follows, and the band governing this page is £300 + VAT for one hard disk or SSD, an NVMe blade counting as a single drive.