At Arkadian Cybersecurity, we sometimes see unusual cases come through our forensic lab. Recently, our client tried to swap the boot drives in his Mac but accidentally powered the computer on during the process. As a result, the SSD he brought to us now appears to be dead.
He also brought us a MacBook Pro A1278, where he wanted this disk installed—if we could bring it back to life.
First, we connected the drive to our forensic workstation using a write-blocking device to prevent any alteration to the client's disk.
Then, we checked whether it was possible to read any data from the drive and created a bit-by-bit image of the disk using FTK Imager, one of the forensic tools in our Digital Forensics Services toolkit.
With the digital original secured, we copied the contents of the client's SSD to a new drive of the same size.
With a functional copy of the source SSD, we could now begin analyzing the root cause of the issue.
The MacBook Pro came with an HDD running Yosemite. After some research, we realized that this version of macOS couldn’t read APFS-formatted disks.
To address this, we had to upgrade the OS in stages: from Yosemite to Sierra, and from Sierra to High Sierra—the first macOS version with APFS support.
Once High Sierra was installed, we hoped to use built-in disk repair tools to recover the data.
Unfortunately, none of them were able to repair the partition table, and information about the APFS containers remained inaccessible.
At this point, we decided to try connecting the drive to our own MacBook Pro with an M4 chip.
Using diskutil apfs list, we noticed some errors in the container—it appeared that the information about the container size was corrupted.
Next, we ran diskutil repairDisk /dev/<drive#>, which reported that it had fixed the issue, and...
To our surprise, all containers were immediately detected, and fsck_apfs -n /dev/<drive#> showed no more issues!
While inspecting the disk information, we noticed that it had been formatted with a macOS version later than 10.14.6.
Could this be the reason? Did we need to upgrade the A1278 one more time—this time to Mojave?
It seemed that updating to Mojave might be necessary to upgrade the firmware of the MacBook during the OS installation process. So, we proceeded with that.
It turned out that this was indeed the final step—after upgrading the MacBook to Mojave, the disk became fully usable with the A1278.
In the end, the issue with the SSD itself was relatively straightforward, as we were able to bring it back to life using macOS’s built-in tools like diskutil and fsck_apfs.
What turned out to be far more time-consuming was uncovering why the SSD wouldn’t work with this older laptop in the first place.
All in all, it was yet another fascinating journey through the evolution of operating systems and filesystems.
Have you run into APFS issues on older Macs? What worked for you?