Data Recovery Case File · Apple Mac · The Update That Moved In

The external that became the boot drive: a macOS update pointed at the wrong home, and 350GB of files brought out from under it

Her account contained a moment of genuine computing surrealism, described exactly as it felt. Updating her MacBook Pro, short of internal storage, she downloaded the update "onto my hard drive" — the external — "without thinking this issue would happen." The laptop restarted into the new software "like it was a brand new laptop with none of my information"; unplugging the external drive, eerily, put everything back to normal. But the drive itself came out of the adventure transformed: no longer recognised properly, apparently "reformatted itself," showing "only codes etc from my laptop" where her files used to be. Her own forensic instinct supplied the case's most important fact: 350GB of the 1TB is still occupied — "so I'm pretty sure they are still on there, but have got lost." She was right on both counts, and the surrealism has a precise mechanical explanation.

Decoding the surreal reboot — and what "only codes" means

The installer, offered an external drive as its workspace, did considerably more than store a download there: it prepared the drive as a system destination — repartitioning, laying down macOS structures, and leaving it bootable — and on restart the Mac did what Macs do with the most eligible startup disk it can find: it booted from her external. The "brand new laptop with none of my information" was literally a brand new system — running from her drive, blind to the internal disk where her account still sat untouched, which is why unplugging it restored normality instantly: the Mac simply went back to booting from itself. The transformation she then found on the drive follows directly: the "codes" are the installed system's own files, the "reformatted itself" is the installer's repartitioning, and the old volume's paperwork — her filing system — was the main casualty. But installers write systems, not erasures: a macOS deployment occupies a modest footprint at the drive's front territory, and her 350GB reading was the estate itself reporting in — her files' bulk sitting exactly where it always had, unlisted behind new paperwork, in space the fresh system had claimed on paper and barely visited.

The recovery

The drive was imaged once, write-blocked — the accidental macOS never booted again — and the archaeology ran on the copy: remnants of her original volume's structures recovered from beyond the installer's stamp, restoring folder trees, names and dates for the majority of the estate, with the paperwork the repartitioning had genuinely consumed made good by carving those files whole from the untouched bulk and re-filing them by type and date. The honest ledger confined the true losses to the installer's actual footprint — the drive's opening territory plus the new system's scattered writes — a bounded, itemised population. Her files came back verified and delivered on new media, and the update, for the record, was subsequently completed the boring way: internal space cleared first.

Outcome

Substantial recovery from an accident whose strangest symptom — the laptop briefly becoming someone new — turned out to be its most diagnostic. Two carry-aways, one Mac-specific and one universal. Mac-specific: when an update pleads for space, the fixes are clearing internal storage or an empty external — never a drive with a life on it, because "use this disk" at install time means all of it, structure included. Universal, and the reason her case ended well: her own reasoning — the space is still occupied, so the files must still exist — is exactly the right read of a freshly-overwritten-looking drive, and acting on it correctly means stopping there. She didn't reformat "properly," didn't let the new system keep running from the drive, didn't try to delete the "codes." The 350GB waited, unlisted, for someone to re-list it.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.