Data Recovery Case File · Apple Mac · Layered Data Loss

The rescue that needed rescuing: an overwritten Time Machine drive, a dd command, and the original disk that saved everything

This case arrived as two generations of good intentions. The owner — twenty years of writing, business records, family history and correspondence, much of it needed urgently — had a MacBook whose drive stopped mounting. A capable, well-meaning grandson stepped in to help. Every individual step he took was defensible; their sum was a Time Machine backup with recovered files written over it and a low-level copy command run on top. The case file is published with the family's story softened and their dignity intact, because the lesson in it belongs to everyone.

The enquiry

“My grandson decided to upgrade my MacBook Pro and seems to have ended up overwriting my Time Machine backup archives on a My Passport external disk. It contains my whole recent life and work of twenty years… In his words: since the SSD wouldn't mount due to filesystem corruption, I used recovery software to scan it and recover all the files to the backup drive. Then I ran sudo dd…”

Where the rescue went wrong — gently, and precisely

Two principles were breached, and naming them is the point of this page. First: the backup drive is sacred ground. When the original disk failed, the Time Machine drive silently became the best copy of twenty years in existence — and recovery software was then pointed at it as a destination, writing thousands of recovered files into the one place that already held good ones. A Time Machine archive is a dense, intricate structure; writing into it is renovation with a bulldozer parked inside. Second: dd is a power tool without a guard. It copies raw data wherever it's told, prompts for nothing, and forgives nothing; aimed with one path transposed, it overwrites at scale. Between the two, the backup drive had absorbed real damage. But — and this is the turn the whole case pivots on — the rescue's very first premise had quietly preserved the real prize: the original SSD, corrupted but never repaired, never reformatted, never written to, still existed.

Going back to the patient, not the paramedic

Triage therefore inverted the family's ranking. The mangled Time Machine drive, which felt like the crisis, was imaged on the TaskForce 2 and set aside as the secondary source. The corrupted SSD — the drive everyone had given up on first — was imaged write-blocked on the Insight Forensic and became the primary one, because a corrupt filesystem over intact data is a locked filing cabinet, while an overwritten one is a shredded file. In Data Extractor, the SSD's damaged filesystem structures were rebuilt from their surviving redundancy, and the volume opened: the user account, the twenty years of documents, the pension and financial folders needed most urgently — present, named, and dated, exactly as they'd stood when the drive last mounted. The Time Machine image then served as sworn witness rather than source: its surviving historical snapshots cross-checked against the SSD recovery, contributing a modest number of earlier file versions the live disk no longer held, its overwritten regions simply routed around.

Outcome

Effectively the whole twenty years, recovered from the drive the rescue had abandoned at step one — delivered organised, with the urgent financial material verified first and handed over ahead of the rest. Two closing notes were part of the delivery. To the owner: a backup regime now exists in which no single drive, and no single helpful afternoon, can take everything. And for the grandson, genuinely: his instincts — scan, recover, copy — were the right instincts. The craft he was missing is one rule deep: recover from a damaged drive, never onto the only other copy of it. He knows it now, at a price the lab was able to refund.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.