Data Recovery Case File · Mac & Apple Ecosystem · What Happens, and What It Costs

MacBook Flashing Question Mark: the Process and the Fees

His enquiry asked for two things that customers are entitled to and rarely get in writing. A MacBook Pro: "working fine less than 24 hours ago. Opened it up today and getting a grey screen with a flashing question mark in a folder, i.e. failing to find a startup disk. Please can you describe your solution process and associated fees." The symbol is decoded below and means less than it appears to. But the more useful half of this page is the part he actually asked for and which almost no firm publishes: the process, stage by stage, and what is chargeable at each one. A customer who knows what happens next and what it costs can make a decision on facts, and that is the whole point of writing it down.

The decode: the symbol, then the process and the fees

What the flashing folder means: precisely one thing — the machine looked for a bootable system and did not find one. It is a statement about bootability, not about the drive's health. A Mac displays it when the drive has failed, certainly, but equally when the system files are damaged, when the boot record is corrupt, or when the volume simply cannot be mounted. On its own it does not tell him his data is at risk. His "working fine yesterday" adds something too: sudden onset with no preceding slowness or noise points more often at the system volume than at a mechanism winding down.

The process, stage by stage. One — assessment, free. The machine's generation is identified, because it determines everything: whether storage is a removable module, a proprietary blade, or soldered to the board. The encryption position is established in the same step, since on later machines a perfect extraction reads as noise without a lawful credential. The fault is characterised and the realistic outcome stated. Nothing is chargeable at this stage and nothing irreversible is done. Two — the written figure. One fixed figure, including VAT, issued before any chargeable work begins. It does not move afterwards, there is no hourly meter, and it does not grow "depending what we find". Three — access and imaging. Where the module lifts out it is read on a generation-matched interface; where it is integrated, the board is worked at micro level until the machine can address its own storage. Either way a complete image is taken at the first successful access, because a machine in this state earns no assumptions. Four — reconstruction, on the copy. The volume is rebuilt from the image, never from the original. Five — verification and delivery. Files are verified by opening rather than counted, delivered on separate verified media, and the original hardware returned.

The fees, plainly. The assessment is free. One fixed written figure including VAT is issued before any chargeable work. On work that does not require the drive to be opened or a chip removed, nothing is payable unless the data comes back. Where a drive must be opened or a chip removed, parts are bought and consumed whether or not the job succeeds, so 50% of parts and labour is payable upfront with the balance due only on successful recovery. Delivery media is included in the figure rather than added afterwards.

What he should do meanwhile: stop restarting it. Each attempt is another cycle asking a drive that may be struggling to do the one thing it is currently failing at, and repeated boot attempts are a small but real cost on a marginal drive.

On the bench

The generation and encryption position were established before any route was committed to, since they decide both what is possible and what it costs. Where the machine's era provided a removable module, it was read on a generation-matched interface through the Atola Insight Forensic's Apple support and imaged completely in the first session; where storage proved integrated, the board was assessed and worked until the machine could address its own storage, with imaging following immediately. The volume was rebuilt from the image rather than the original, his files verified by opening, and everything delivered on fresh media with the machine returned alongside a written account of what had been found.

The outcome

The fault characterised free of charge, the figure fixed in writing before work, and the data imaged, verified and delivered. Free assessment, one fixed written figure including VAT; on work not requiring the drive to be opened, no recovery, no fee; where a drive has to be opened or a chip removed, 50% of parts and labour is payable upfront with the balance only on success. The answers to his two questions: the flashing folder means no bootable system was found, which is a statement about booting rather than a verdict on your drive — and sudden onset after a normal day points more often at the system volume than at a failing mechanism. And the process is five stages — free assessment, written figure, imaging at first access, reconstruction on the copy, verification by opening — with the only chargeable point coming after you have seen the number.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.