A MacBook began restarting endlessly partway through a macOS update, never reaching the desktop. The update had damaged the system side of the disk while the user's files sat in a separate APFS volume. With the owner's password to hand, we reconstructed that volume and recovered their data.
The MacBook had been mid-update when something went wrong, and afterwards it looped through the Apple logo and restarted without ever booting. The owner's documents, photos and mail were on it, with no recent backup. Re-running the installer or erasing and reinstalling — the usual advice — risked the data, so the machine was brought in to have the files recovered first.
Modern macOS splits the disk into a sealed, read-only system volume and a separate data volume that holds your files, bundled together in an APFS container. An update replaces the system volume, and if that process is interrupted the Mac can be left unable to boot — looping — even though the data volume alongside it is intact. Recovering the files means reaching that data volume and rebuilding its APFS structures, independently of the broken system that won't start.
There's an important caveat with any recent Mac. Apple Silicon and Intel Macs with a T2 chip solder the storage to the board and encrypt it in hardware, tied to that machine and its passcode. That means the data simply cannot be read without the user's password or recovery key — there is no way around it by design, and any honest recovery firm will tell you so. In this case the owner had their password, which is what made the recovery possible; without it, encrypted Mac storage is unrecoverable.
With access established and the password supplied, the APFS container was worked through: the data volume located, its encryption unlocked with the owner's key, and its structures — the volume superblock, object maps and file-system tree — reconstructed where the failed update had left them inconsistent. That brought the user's home folder back with its structure and file names intact, and the documents, photos and mail were extracted.
Files were opened across the recovered set to confirm they were whole, then returned on fresh media, after which the MacBook itself could be reinstalled cleanly. About 98% came back. We underlined two points: keep your Mac's password and recovery key safe, because on modern Macs they are the data; and Time Machine or a cloud backup turns a failed update into a five-minute annoyance.
APFS container and volume reconstruction · FileVault decryption using the owner's key · object-map and file-tree repair. All work carried out in-house in Belfast.
Send it to us for a free, no-obligation diagnostic. We’ll tell you what can be recovered and put a fixed price in writing before any work starts — and on most jobs, if we can’t get your data back, there’s nothing to pay. Post your device in, or drop it to us by appointment.
Usually, yes — a failed update damages the system volume while your files sit in a separate data volume that's typically intact. We reconstruct that volume to recover them. On modern Macs we'll need your password or recovery key.
On Apple Silicon and T2 Macs, yes — the storage is hardware-encrypted and tied to your passcode, so without it the data can't be read by anyone. It's a design feature, not a limitation we can work around. Keep your password and recovery key safe.
Often, yes — where the storage is accessible and, on encrypted Macs, the password is available. A free diagnostic will confirm what's possible for your specific model.