Data Recovery Case File · Apple Mac · The Panic Backup

A backup made under fire: the rescue copy that half-worked, and the dying drive that still held the truth

Everything this customer did was the right idea executed at the worst possible moment. His MacBook was visibly failing — SMART errors, increasing unusability — so he bought a 2TB portable, set out to partition it for both Time Machine and cross-platform file storage, and dragged his data across by hand while the machine still ran. The result was a rescue in quantum superposition: he suspected the formatting had gone wrong, or the copy hadn't completed, or the data had corrupted in transit — "the data appears to be there and some files are accessible, but not the whole lot." A backup you can't trust is a question, not an answer.

The principle the case turns on

When a rescue copy is doubtful and the original still exists, the original outranks the copy — however sick it is. His MacBook's drive, for all its SMART complaints, remained the one complete, authoritative edition of his data; the external held a derivative of unknown fidelity, made by a crashing machine through a filesystem arrangement its owner didn't fully trust. So the job inverted his instinct: rather than forensically untangling the copy's muddle, the source was imaged properly — the failing internal extracted from the MacBook and read on the PC-3000 with the discipline SMART-failing drives get throughout this archive: self-maintenance stood down, healthy regions banked first, the weakening patches worked patiently last. Coverage closed high; the authoritative edition existed at last, somewhere safe.

Reconciling the two — and what the muddle turned out to be

With truth established, the rescue copy could be graded instead of trusted. Its partitioning had indeed gone sideways in the hurry — a layout macOS half-honoured, which explained the "some files accessible, not the whole lot" — and the drag-copy had done what drag-copies under duress do: completed unevenly, skipping quietly where the dying source stalled, with no record of what it missed. Cross-checked against the imaged source, the copy proved a decent partial and nothing more. The delivery resolved the superposition: one clean, verified set built from the source image — his user folders complete, checked by count and by opening — on a properly formatted new drive, with the hurried external wiped of its ambiguity and reborn as what he'd originally wanted: a straightforward Time Machine home for the replacement Mac.

Outcome

Effectively complete recovery, delivered as one set instead of two half-trusted ones — and a page-worth of sympathy for the position he was in, because the panic backup is a rational act at an irrational moment. The upgrades for anyone reading this before their machine starts dying: verify every backup by opening files from it, not by watching the progress bar finish; don't redesign partition schemes mid-crisis — copy first onto whatever works, reorganise later; and treat SMART errors as the starting gun they are. Made calmly a month earlier, his backup would have been boring. Boring is the entire goal.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.