An old MacBook Air, formatted and put back to factory settings, and then the thought that arrives about a week later: the older photographs were on there. The question came with an apology attached and an assumption that it was a long shot. It is not automatically a long shot, but the answer splits cleanly on one fact — whether the storage in that particular Air unscrews. On the pre-2018 machines it does, and a reset that wrote a fresh system over part of the drive commonly leaves a great deal of the older material untouched in the space it never reached. On the later ones the flash is soldered to the board and locked to hardware encryption, and that is not work we take on. Better to establish which you have on the phone than after you have paid for postage.
| Media | An older MacBook Air, formatted and restored to factory settings, with photographs from earlier years hoped to still be on it. |
| Reported situation | Old MacBook Air · formatted and reset to factory settings · older photos wanted back · owner assumed it was hopeless · asked anyway. |
| Fault class | Formatted and reset storage. The format cleared the index; the reset wrote a fresh operating system across part of the drive. Older files frequently survive in the space the reset never reached, and are carved from a read-only image. The limit is set by how much was written afterwards, and by whether the storage is removable at all. |
| Equipment used | Model identified first, and the storage confirmed removable · the SSD blade taken out and read on PC-3000 UDMA through a hardware write-blocker · imaged read-only on DeepSpar · surviving filesystem records parsed in R-Studio, older photographs carved from the image by content signature in PhotoRec, every file opened and rendered before it was written to fresh media. |
A format is not a shredder. It rewrites the index that says where things are, and leaves the things themselves lying where they were until something else needs the room. A factory reset goes a step further and installs a fresh system on top, which does claim space — but it claims a fraction of a drive, and it claims it at the front. Photographs from years back generally sit further out, in regions the installer never touched.
So the question is not whether anything survived. It is how much of the drive got written over afterwards, and that depends on what happened in the days following the reset. A machine that was wiped and immediately shut down is a good prospect. A machine that was wiped, set up with a new account, signed into iCloud and left syncing for a fortnight is a poor one, because every download and every update lands in the free space where the old pictures are waiting.
There is a second limit and it is a hard one. Any MacBook Air from 2018 onward has its flash fixed permanently to the logic board and bound to that board's own encryption. We do not take soldered storage on any make of machine, so on those models the honest answer is no before anything is packed. On the earlier Airs the SSD blade unscrews, comes out, and gets read by itself — which is what happened here.
Because a carve either produces your photographs or it does not, this went through on no fix, no fee. The assessment costs nothing and is done within 2 working days of arrival, and it ends with a written figure and a straight account of what is realistically coming back. Nobody is charged for a search that finds nothing.
The model was identified before anything else and the storage confirmed as a removable blade. It came out and was read on PC-3000 UDMA through a hardware write-blocker, so that nothing at all could be written back to it, then imaged read-only on DeepSpar. All work after that happened on the image. What survived of the old filesystem records was parsed in R-Studio, and the remainder was carved by content signature in PhotoRec, which finds pictures by their headers rather than by any index. Every recovered image was opened and rendered before it counted, because a file with a plausible name and size that will not display is not a photograph.
The blade imaged read-only, and the older photographs carved back out of the space the reset had never reached. The assessment cost nothing and produced one written figure before any work started. This was logical work with no parts consumed, so it ran under no fix, no fee: had the pictures not been there, there would have been no bill. The honest note attached to the result was that the more recent material was gone, written over by the fresh system, and that no laboratory anywhere recovers what has been overwritten.
Stop using it this minute. Not tomorrow, now. Every subsequent download, update and sync writes into precisely the space your old files are sitting in, and that is the only thing standing between a good recovery and a poor one. Do not reinstall anything, do not run a repair tool, and do not install recovery software onto the machine you want recovered — that alone can overwrite what you are looking for. If it is a Mac, find the model year before you do anything else: pre-2018 machines have storage that comes out and can be read, and later ones have flash soldered to the board, which nobody here can take. One phone call settles which you own and costs nothing.
Each file below comes from a genuine enquiry taken from households and firms across Aberdeen, Aberdeenshire and the wider north-east, anonymised so nobody can be identified. Each one sets out how the fault was reasoned through, what was done about it, and which equipment did the work.
A light proves the drive has power and nothing else — and one firm failing to read it is a fact about that firm's equipment, not a verdict on the platters
The drive reads perfectly and images without complaint; the encryption on top of it needs a credential, and nothing on this bench manufactures one
Whether the machine ever runs again is beside the point — the only question that matters is whether the storage comes out
Assessment is free and takes 2 working days at most once it lands, the figure is fixed in writing, and logical work carries no fix no fee. Begin online, or lift the phone.