Data Recovery Case File · Solid State & Flash · A Failed Repair Is a Lucky One

The Repair That Would Not Complete

His enquiry was modest about itself and contained exactly the right details. A 1TB SanDisk SSD that is "no longer being recognised by my Mac other than in Disk Utility, and is unable to complete a First Aid. Forgive the simple description — does this sound like something where files could be recovered?" The description needs no forgiving; it contains both halves of the diagnosis. And the second half is better news than it reads, because this archive spends a great deal of time warning people away from that tool. A First Aid that fails partway has, in all likelihood, done him a favour — it stopped before it could write the thing that would have cost him.

The decode: what each half tells us, and why failure helped

What being visible in Disk Utility establishes: a great deal. The drive received power, enumerated, identified itself and reported a capacity — which is why the utility can list it at all. That eliminates the categories where nothing appears: dead controllers, failed connections, drives that never complete their start-up. His hardware is answering. What has failed is the volume — the filesystem structures describing how the space is organised — which is why nothing mounts.

Why that is the recoverable category: nothing has been erased and nothing is physically failing. His files sit intact behind structures that cannot currently be parsed, and reconstruction on an image typically returns the folder tree, filenames and dates as they were rather than an unnamed carve.

Now the part that matters most. First Aid repairs a filesystem by writing decisions: it reads the structures, chooses between records that disagree, discards entries it cannot reconcile, and moves orphaned content into a recovery folder with generic numbered names. On a lightly inconsistent volume that works and is the right tool. On a badly damaged one it converts something reconstructable into permanent structural loss, and strips filenames on the way through. It is the single most common way a good outcome becomes a mediocre one, and it is recommended everywhere because in ordinary use it is genuinely useful.

Why his failing is fortunate: when First Aid cannot complete, it has usually found the volume too damaged to proceed and has stopped before committing its changes. So the structures a reconstruction rebuilds from are, in all likelihood, still as they were. Somebody whose First Aid succeeds on a badly damaged volume often ends up in a worse position than somebody whose failed — which is a genuinely counter-intuitive thing and worth knowing before the next attempt.

The temptation to resist: running it again. A tool that fails invites a second and third attempt, sometimes with different options, and each one is another chance for it to gain enough traction to write something. The same applies to the offer to erase that sits alongside it in the same window.

On his apology for the description: worth answering directly, because plenty of people preface enquiries this way. He reported which tool sees the drive, which does not, and what the repair did. That is more useful than a page of technical vocabulary, and the two facts together locate the fault precisely.

On the bench

No further repair was attempted, since a tool that has stopped short has left the structures a reconstruction needs, and every retry is another chance for it to commit changes instead. The drive was imaged write-blocked before any reconstruction, so that everything afterwards happened against a copy. On the image the filesystem structures were examined and rebuilt — including from the backup copies filesystems maintain at known offsets — until the volume mounted from the copy with its folder tree, filenames and dates intact, and the contents were verified by opening.

The outcome

The volume rebuilt from a write-blocked image with folders and filenames intact, verified and delivered. Free assessment, one fixed written figure including VAT, no recovery, no fee. The decode, for anyone whose repair tool failed: that is better news than it sounds — repair works by writing decisions, choosing between records that disagree and dumping orphaned content into folders of numbered files, so a tool that stops short has usually left the structures a proper reconstruction rebuilds from; somebody whose repair succeeds on a badly damaged volume frequently ends up worse off. Being visible in the disk utility while refusing to mount means your hardware answers and only the filesystem is unreadable. Don't run it again.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.