I Did a Master-Reset

The decode

A reset clears the index, not the file data. That the Mac was reset to factory settings does not by itself erase the files, because a reset clears the catalogue that records where each file sits and marks that space as available, but it does not scrub the storage — the file data stays where it was written until something new is saved over it. So the loss is of the listing, not the content: the Mac no longer knows where the files are, which is why they appear gone, rather than the data having been wiped. Her files usually persist on the storage after the reset, reached by reading it directly. A reset clears the index, not the file data.

The data persists until it's overwritten. That the file data remains means the deciding factor is how much has been written since the reset, because the freed space is only reused when new data is saved onto it — so files whose space has not yet been written over are recoverable, while any the machine has since saved over are the part that is lost. So leaving the Mac alone protects what remains: the less that has been done since the reset, the more of her local files survive to be carved back. Her data is reached from the space not yet reused, which is why further use is avoided. The data persists until it's overwritten.

The files are carved back by content, an honest partial. Because the index is gone, the files are carved by content — the storage imaged read-only, the freed filesystem records recovered where they survive, and the file data identified by its content where the records are gone, so the recoverable files are rebuilt from what remains. So the recovery reads the storage for the data itself rather than relying on a catalogue the reset cleared; it is an honest partial, its completeness set by how much survives unoverwritten. Her data is reached by carving the storage, which is how a reset Mac is recovered. The free diagnostic establishes how much survives before anything goes ahead.

The honest prognosis is a partial, set by writing since. If little has been written since the reset — best where the machine was set aside — much of the local data is carved back, sometimes most of it. If the Mac has been used and files saved over the freed space, that part is lost, and recovery returns what remains. Which applies is established at assessment by reading the storage, with the recoverable extent confirmed before anything is agreed — the sooner it stops, the more comes back.

On the bench

The drive was read directly, or the storage read from the machine, behind a hardware write-blocker on PC-3000 UDMA to prevent further writing. It was imaged read-only on DeepSpar. The Mac filesystem (APFS) was parsed in R-Studio, the freed records recovered, and the file data carved by content in PhotoRec where the index is gone, validated onto fresh media.

The outcome

The storage read read-only, and the local files carved back from what survived the reset. The diagnostic stage is free and reports back within two working days of the media arriving; after it you hold one written quote, fixed with VAT included — and if the files don't come back, you don't pay. The decode: a reset removes the index, not the data — the older files are carved back, an honest partial. Carved from what remains, your files come back.

Our case files are written up from genuine enquiries our lab has handled for customers across Swindon and Wiltshire, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery approach our engineers apply to that fault, using the equipment listed.