Data Recovery Case File · Mac & Apple Ecosystem · A Boot Message, Not a Verdict

The Question Mark on the Screen

Her enquiry described a symbol that alarms people more than it should. "Yesterday I was greeted with a question mark on my MacBook Pro, which has two SSD drives in it. Is the data on these, my photos, recoverable please?" The flashing folder with a question mark is one of the few error messages that is genuinely precise, and it says something narrower than most people assume. It means the machine looked for a system to start from and did not find one — which is a statement about booting, not about the existence of her photographs. A great many machines showing that symbol have entirely intact data sitting behind it.

The decode: what the symbol means, and what it does not

What the machine is actually reporting: at start-up a Mac looks for a valid system to hand control to. The question mark folder means that search found nothing usable. That is all it means. It does not report a failed drive, missing files, or damaged photographs — it reports the absence of something bootable, which is a much narrower finding.

The three things it can indicate: the system volume has become damaged or been removed, while user data on the same drive remains untouched — much the commonest case, and the reason so many of these end well. Or the machine has simply lost its record of which drive to start from, a setting-level problem in which nothing at all is wrong with the storage. Or, least often, the drive itself has failed and there is genuinely nothing to find. Those look identical on screen and have entirely different implications.

Why the two drives matter: a machine with two internal drives is a machine where the system and the data may live in different places. It is entirely possible for the system drive to have failed while the drive holding her photographs is perfectly healthy — and equally possible that one drive is the system and the other is storage she has never thought about separately. Establishing which drive holds what is the first job, and it frequently reveals that the alarming symbol relates to a drive her photographs were never on.

Why the generation decides the route: on machines of the era that carried two separate internal drives, storage is usually removable and not cryptographically bound to the mainboard, so the drives can be read directly on a bench — which takes the failing machine out of the question entirely. That is a considerably better position than later models where storage is soldered and sealed to a security chip.

What she should not do: reinstall. The instinct on seeing that symbol is to reinstall the operating system, and the standard reinstall route will offer — sometimes prominently — to erase the drive first. On a machine whose user data is intact behind a damaged system, that converts a straightforward recovery into a real loss. Nothing should be reinstalled, erased or repaired until it is known which drive holds what and whether the data is present.

The reassuring summary: the symbol is a boot message. Her photographs are a separate question, and it is answered by reading the drives rather than by looking at the screen.

On the bench

The drive configuration was established before anything else — which of the two drives carried the system and which held user data, and whether the machine's generation allowed removal — because that determines whether the alarming symbol relates to the drive her photographs were even on. Storage was then read write-blocked on native equipment rather than through the machine, taking the boot failure out of the question, and the filesystem examined for the presence of user data before any repair was contemplated. Photographs were validated by rendering.

The outcome

The configuration established, the drives read write-blocked and the photographs located, validated and delivered. Free assessment, one fixed written figure including VAT; where a drive has to be opened or a chip removed, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone seeing that symbol: it means the machine looked for a system to start from and found none, which is a statement about booting rather than about your files — most often the system volume is damaged while user data on the same drive is untouched, sometimes the machine has merely lost its record of which drive to use, and least often the drive has genuinely failed; on a machine with two drives, the fault may relate to a drive your photographs were never on; and above all, do not reinstall, because the standard route offers to erase first.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.