Data Recovery Case File · Second Fixes & Trade Handoffs · The Chip That Left the Building

MacBook Storage Chip Replaced: Where Is the Old One?

Her enquiry describes a repair that succeeded and a recovery that may already have been decided by it. A MacBook Air that broke a few months ago: "when I took it for repair he said there was an issue with the storage chip and I've pretty much lost all the data. He changed out the chip and the laptop works fine, but I would like the data restored. This was something he didn't have the resources to work on, so he referred me to you." The referral is fair and the repair sounds competent. But there is one question that has to be asked before anything else, and it is more urgent than any technical detail on this page: where is the chip he removed? Because her data is not in the laptop she is holding. It is on the component that came out — and if that component has been discarded, there is nothing on any bench that can help.

The decode: the urgent question, and the one that follows it

Why the removed chip is everything: on a MacBook Air of this design the storage is not a drive that unplugs — it is flash memory soldered to the logic board. Replacing it means desoldering the original package and fitting a new one. The new one is empty; the machine works because it has fresh storage, not because anything was restored. Every photograph, document and message she is asking about is physically on the small component that was lifted off the board. So the first call is not to a laboratory but to the repairer: do you still have the chip you removed, and can I collect it? Reputable repairers often keep removed components for a period, precisely because this situation arises. If it has been kept, this is a workable case. If it was discarded, no technique exists to recover data from a component that no longer exists, and she should be told that plainly rather than encouraged to hope.

The question that follows: assuming the package is retrieved, the next thing that decides the outcome is the machine's generation, because Apple's encryption arrangements changed. On earlier machines the flash contents can be read directly from the package and reconstructed. On later ones the storage is encrypted with keys held in a dedicated security chip that stayed behind on the logic board — and a package read in isolation yields ciphertext rather than files. That distinction is established before any figure is quoted, because it is the difference between a recovery and an honest no.

What the reading involves: where the generation allows it, the package is read on flash equipment as raw memory and then reconstructed — the scrambling reversed, error correction applied, and the translation layer rebuilt to turn raw pages back into a filesystem. It is the same discipline this archive applies to monoliths and memory cards, at a larger scale.

The lesson for the trade, said without blame: the repairer diagnosed correctly, fixed the machine, was honest about the limits of his resources and referred her onward — most of that is good practice. The gap is one of sequence rather than skill, and it is worth naming for anyone who repairs devices: on soldered-storage machines, the data question must be settled before the component comes off, because removal is the irreversible step. A customer who says the data does not matter is fine; a customer who has not been asked is a customer who may lose everything to a successful repair.

On the bench

The first action was a phone call rather than a bench procedure: the repairer contacted, the removed package located and collected, and its identity confirmed against the machine. Only then did the technical questions begin — the machine's generation established and its encryption arrangement determined, so that expectations were set correctly before any work was quoted. The package was read as raw flash on the PC-3000 Flash with pinout and scrambling confirmed against the Rusolut VNR database, and reconstruction ran XOR descrambling, ECC correction and translation rebuild until her filesystem stood up. Her files were verified by opening and delivered on fresh media, and the removed package was returned with them.

The outcome

The removed storage package retrieved, read and reconstructed, with the contents verified and delivered. Free assessment, one fixed written figure including VAT, 50% of parts and labour upfront with the balance only on successful recovery. The instruction that outranks everything else on this page: if a repairer has replaced soldered storage, your data left with the component — ask immediately whether it has been kept, because that single answer decides the case; if it survives, the next question is the machine's generation, since later designs encrypt with keys that stayed on the board and a package read alone yields nothing readable; and for anyone in the repair trade, the sequence is the whole lesson — settle the data question before the chip comes off, because removal is the step that cannot be undone.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.