Start with these three steps
Stop setting it up
Do not install apps or copy new files onto the affected storage while the recovery position is unresolved.
Identify the operation
Write down the menu or tool used, the selected disk or volume, whether it finished and whether macOS was subsequently installed.
Find independent sources
Locate Time Machine disks, cloud files, exported projects and other copies without attaching a backup to any erase workflow.
Record exactly what the erase did
Apple’s Erase All Content and Settings removes user data, settings and apps while retaining the installed operating system on supported Macs. Its successful completion should not be treated like moving a folder to Trash. A usable setup screen says little about the recoverability of the former account.
If the event involved Disk Utility, record whether a volume, volume group or physical device was selected. If another computer was used for firmware work, ask whether the action was Revive or Restore. Preserve the technician’s report and screenshots rather than relying on the broad word “reset”.
Sources: [1] Apple Support [2] Apple Support [3] Apple Support
Understand why the password may no longer help
Apple documents secure deletion of volume encryption keys and media-key erasure for Apple silicon and T2 storage. When necessary cryptographic material has been destroyed, knowing the former password does not recreate it. Physically reading the flash is not a workaround for that missing decryption path.
The practical consequence is to focus on copies outside the erased device. Do not accept a universal claim that a full erased MacBook SSD can be recovered. If the operation failed or its scope is uncertain, an assessment can clarify the situation, but uncertainty is not evidence that the files survived.
Sources: [4] Apple Platform Security [5] Apple Platform Deployment
Treat older storage as a separate case
An older removable drive or a separately erased external disk may require a different analysis from integrated encrypted storage. Its format, encryption status, erase method and later writes all matter. Even a quick format should not be translated into a promise of recovery.
SSDs can reclaim unused flash through their own storage-management mechanisms. Additional installation or copying also changes the source. Preserve the device as it is and give the assessor the exact sequence of actions, including any attempted recovery software and where its results were saved.
Sources: [2] Apple Support [6] Kingston Technology [7] Data Recovery Lab NZ — external provider
Reconstruct a working set from independent copies
Use a healthy Mac to inspect Time Machine backups from before the erase and check the relevant cloud accounts. Cloud material must actually have been uploaded; an online account cannot supply a local file that never reached it. Preserve backup sources while you compare their contents.
Build a short inventory of recovered folders, dates and remaining gaps. Include email attachments, shared project deliveries and original camera cards where relevant. Recovering from several independent sources may restore useful work even when the erased internal storage itself has no viable recovery route.
Sources: [8] Apple Support [9] Apple Support
A realistic view of recovery
- Completed cryptographic erasure can make the former internal data permanently inaccessible.
- A successful macOS installation or account login does not prove that pre-erase data remains recoverable.
Your questions, answered
Does my old password reverse Erase All Content and Settings?
Is a firmware revive the same as a restore?
Should I buy a deep-scan app before checking backups?
Need help with the original MacBook?
Describe the model, what happened and which data matters. Data Recovery Lab NZ is an external specialist; ask it to confirm the assessment route for your exact device.
Sources & further reading
Primary and specialist guidance checked 27 October 2026. Features and instructions depend on the model and operating system.