(fig 1 .Macbook Air A1465)
We were recently helping a corporate user from Cork recover data from their MacBook Air (mid-2013 model). He had been using this system without a glitch since he bought it in late 2013. However recently he turned on his system and received the dreaded flashing question mark on his screen. This ominous warning sign was made worse when he realised that his files were not being backed up to the company’s server and he was not using any local backup system such as Time Machine. His IT support department were unable to recover data from SSDs but recommended Drive Rescue for data recovery
The user couriered the system to us. After removing the underside cover of his MacBook, we removed the drive from the motherboard. Inside we found a 256GB Toshiba SSD with a PCIe interface. This is an interface which we are seeing a lot more of lately as computing devices get smaller. The PCIe (Peripheral Component Interconnect Express) interface is a bus standard for many newer laptops, all-in-one PCs and desktop systems using ITX form factors. It overcomes the storage performance bottleneck of S-ATA III interfaces as it attaches directly directly to the PCIe host bus. For example, a third-generation PCIe four-lane bus can handle up to 4 gigabytes/second with ease (depending on drive spec.) Moreover, power draw and I/O latency rates are also reduced. Coupled with the compact size of PCIe connectors, it is no surprise that manufacturers are moving away from S-ATA. But Apple (being Apple) have added a slight twist here designing a proprietory connector (see fig. 2) which is not compatible with standard PCIe connectors.
(fig 2, Toshiba SSD PCIe dive)
To connect the drive to our data recovery system we used a proprietary adaptor designed to handle MacBook Air A1465 drives, but we immediately received the BSY (short for busy) status. When a drive is stuck in this state, it means it cannot receive or output data. To circumvent this problem, it is necessary to put the drive into what is known as “technological” mode. This can be achieved by physically shorting the drive using a laboratory-grade electronic tweezers. With the BSY status now cleared, we were now able to see information about the drive’s ICs (NAND chips). Next we uploaded some new Marvell microcode to the RAM of our recovery system. After successful upload of the microcode we could see his HFS+ volume and in our recovery tree along with it’s folders and files. We imaged these to a new hard disk drive.
(fig 3. Mathlab – a popular mathematical analysis software suite)
Next, our customer was able to remotely log in to our secure servers to view his recovered data. The most important files to him included .XLSX, .PDF, .M and .MAT files. The latter two file extensions belonging to the MATLAB, a mathematical analysis software suite. Having to re-construct them would have been a time-consuming and laborious task. The next day, our more-than-happy financial analyst customer received all his recovered data on an external USB hard drive. He vowed that we would never again ignore Time Machine backup reminders!
Drive Rescue Data Recovery are based in Dublin, Ireland. We can recover data from most MacBook and MacBook Air drives including models such as the A1278, A1286, A1370, A1369, A1439, A1466 and A1502.