November 11th, 2017, 13:36
We received a MacBook A1398 (2015) with liquid damage for data recovery.
Prior coming to us, the MacBook was sent by our customer to the online shop where it had purchased it.
The merchant way not providing data recovery service and hence the Macbook was sent back to our customer.
The 256 GB SSD in the MacBook that we received should be the original one (not a replacement).
It had some kind of dryied syrup drops when we received it and we cleaned them.
It was a little strange, because our customer told and confirmed to us that the damage occured with water, not syrup or so.
However, the MacBook was very dirty inside and the sticky nature of the drops could come from this dirt.
The SSD is a Samsung MZ-JPU256T/0A6.
The SSD is reachable, has GPT partitioning scheme and three partitions: 200 Mo, 232.96 Go and 650 Mo.
All three partitions are healthy.
(I assumed that the 3rd partition was the one for system recovery, but it may be wrong in this case.)
According to our client, the SSD was running Windows OS through Parallels and had no encryption as it would have bored him. He also told us that the drive should be fast full.
Two security clones of the whole SSD were done.
Despite having HFS+ for Windows from Paragon, the second partition doesn't mount on Windows, nor does the third partition.
Running ReclaiMe Ultimate doesn't detect any HFS+ file system after 20% scan, and only one file was found in RAW.
It's 4096 MB in size (4 GB) and starts with a "P69.-" signature.
I assume this file could be one component Parallels virtual hard drive system.
No JPEG or any other file could be found by ReclaiMe's file signatures database.
I understand Parallels as a virtual maching running from within Mac OS and using files for virtual drives.
So I hoped finding an HFS+ system. If I remember well, the second partition was shown as HFS+ by fdisk -l.
Should I scan 3rd partition hoping to find there MacOS, and extract from there the location of the virtual HDD?
I tried booting a PC from one of the two clones, to see if something happened but no operating system was found.
November 12th, 2017, 9:17
Do you have another macbook/Apple?
You could try to connect the ssd to it using an adapter and try to see if it mounts there.