I run the ZA Support workshop in Hyde Park, and I see liquid-damaged MacBooks every week from Sandton, Rosebank, Bryanston, and across Johannesburg. Most of them arrive with the owner asking the same question: "Can you fix it?" But a meaningful share of them belong to medical practices, law firms, accountants, and other professionals where the harder question is the one nobody wants to ask first: "If you cannot fix it, can you still get my data off it?"
This guide is for those clients. It explains how data recovery works on a liquid-damaged MacBook, why the question of recovery is fundamentally different from repair, what the compliance picture looks like for practices governed by the Protection of Personal Information Act and the Health Professions Council of South Africa, and what we can realistically achieve at the workshop. The pricing here is indicative only and the exact figure depends on the specific failure mode of your machine. The right starting point for every case is a R599 assessment.
Why Data Recovery Matters More Than Device Recovery
A MacBook is replaceable. The data on it often is not.
When a laptop is destroyed by a coffee spill, a burst pipe, or a swimming pool incident, the device itself becomes a question of insurance and budget. A new MacBook Pro is a phone call away. The seven years of patient consultation notes, the unfiled trust account ledger, the half-finished forensic report due on Monday, the architectural drawings for the project breaking ground next quarter — those are not on the shelf at iStore.
For professional clients, the calculation is rarely about the cost of the laptop. It is about the cost of the records. A medical practice that loses six years of patient files faces a direct conflict with HPCSA Booklet 5, which requires patient records be retained for a minimum of six years from the last consultation. A legal practice that loses client correspondence may breach attorney-client privilege obligations and trigger Law Society inquiries. A POPIA-regulated business that loses personal information may have triggered a notifiable event under section 22.
This is why every liquid-damage assessment we run starts with a single question to the client before we open the machine: "What is the worst thing that happens if we cannot recover the data?" The answer drives everything that follows.
Compliance Risk: POPIA, HPCSA, and Legal Privilege
South African professional clients carry compliance obligations that turn ordinary data loss into a regulatory event. Understanding the framework matters because it changes the urgency of the recovery work and the documentation we generate during the process.
Section 19 of the Protection of Personal Information Act requires every responsible party to "secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures." The phrase "appropriate, reasonable" is doing a lot of work in that sentence. The Information Regulator has been clear in published guidance that backups, encryption, and access controls fall under reasonable measures for any organisation handling personal information at scale. A practice that lost the only copy of its patient database to a single liquid-damage incident is going to struggle to argue it took reasonable measures.
Section 22 of the same Act requires the responsible party to notify the Information Regulator and each affected data subject "as soon as reasonably possible" after discovering that personal information has been compromised. Compromised includes destroyed and lost. A medical practice that cannot recover patient records from a flooded MacBook is, on a strict reading, in a section 22 notification posture.
For medical practitioners specifically, HPCSA Booklet 5 sets the patient record retention floor at six years from the last consultation, with longer periods for paediatric records, occupational health records, and records of patients who have died. The booklet treats records as fundamental to professional accountability. Loss of records can be raised in HPCSA disciplinary proceedings as evidence of inadequate practice management.
For legal practitioners, the picture involves both the Legal Practice Act and the common-law doctrine of attorney-client privilege. Trust account records have a statutory retention period of seven years under the Legal Practice Council rules. Privileged correspondence cannot be reconstructed from the other side of the conversation in any meaningful sense. Court-ordered preservation obligations attach to active matters and survive any technology incident.
What this means practically for our workshop: when a client tells us the MacBook holds patient data, trust account records, or active matter files, the assessment is no longer about whether to attempt recovery. It is about which recovery path gives the highest probability of complete extraction in the shortest time, and how we document the chain of custody so the client has evidence of due diligence to show a regulator.
How SSDs Fail in Liquid Damage
The mechanics matter because they determine whether recovery is possible at all.
Modern MacBook storage is solid-state. There are no spinning platters and no moving heads. Data lives on flash memory chips, addressed by a controller that sits between the chips and the operating system. When liquid enters the machine, three failure modes can occur, sometimes together.
The first is power-rail damage. Coffee, water, juice, and seawater all conduct electricity to varying degrees. When the machine is powered on at the moment of the spill, current can flow across pathways the design never intended, frying voltage regulators, capacitors, or the power management chip itself. The data on the SSD is usually intact at this point — the chips themselves did not fail — but you cannot reach it because the laptop will not boot.
The second is logic-board corrosion. Liquid that sits on the board for hours or days starts dissolving the solder, growing dendrites between traces, and shorting components that were not directly touched at the moment of the spill. This is why we tell every liquid-damage caller the same thing: power the machine off immediately, do not attempt to dry it with rice or a hairdryer, and bring it in. Time is the enemy. A spill that gets to us within twenty-four hours often has a meaningfully better recovery outcome than the same spill we see ten days later.
The third is direct chip damage. If the spill reaches the SSD chips themselves and corrodes the package, the data they hold can become genuinely unreachable through normal means. This is the worst case and it is the one that drives a recovery toward chip-off NAND extraction in the laboratory.
Most spills we see are case one or case two. The chips are alive, the data is intact, the recovery work is about getting electrical access to the chips again. That is good news for the client even when we cannot save the laptop.
Soldered SSD vs Removable SSD
Apple changed how MacBook storage works in two waves, and both waves matter for recovery.
The first wave was the move to proprietary blade SSDs in the 2013-2015 era. The blades were physically removable but used a connector that was not standard, requiring a USB-C adapter to read in another machine. Recovery was straightforward: pull the blade, plug it into the adapter, copy the data off. This is the easiest recovery scenario we encounter and the one with the highest success rate.
The second wave was the move to SSDs soldered directly to the logic board. This started with the MacBook Air in 2018, the MacBook Pro 13" in 2016, the MacBook Pro 15" in 2016, and continued with the M1, M2, M3, and M4 generations of MacBook Air, MacBook Pro 14", and MacBook Pro 16". On these machines, the storage chips are surface-mount components soldered directly to the main board. They cannot be removed in the traditional sense, and they are paired cryptographically to the T2 security chip or to the Secure Enclave on Apple Silicon machines.
This pairing is the part that surprises clients. On a soldered-SSD MacBook, the storage chips are encrypted at hardware level by the T2 or Secure Enclave the moment they are written to. Even if we successfully extracted the chips and read them with a chip programmer, the result would be encrypted blocks. The decryption keys live in the security chip on the original board. Move the chips to another logic board and they cannot be decrypted.
The implication is that recovery from a soldered-SSD MacBook with a damaged board has only a few realistic paths. First is to repair the original board well enough to boot the machine and let it decrypt its own storage in place. Second is to source a donor logic board that has a matching T2 or Secure Enclave — which is genuinely rare because pairing is per-device, not per-model. Third is to attempt board-level repair on the specific damaged components blocking power-on. Fourth, in the worst case, is chip-off NAND extraction followed by an attempt to reconstruct the encrypted file system, which is laboratory work that is expensive and not always successful.
For pre-2016 MacBook Pros with removable SSDs, we recover the blade in-house at the workshop and turn the data around in days. For soldered-SSD MacBooks, the conversation is more nuanced and the timeline depends on which path turns out to be viable.
Our Data Recovery Process
Every liquid-damage data recovery case at our Hyde Park workshop follows the same sequence. The structure exists so that nothing is missed and the client has evidence of every step.
The first step is the R599 assessment. The client books in, drops the machine off, and we do a controlled non-destructive inspection. We open the machine, photograph the internal state, identify the make and year of the SSD configuration, test for shorts on the power rails, and run a controlled power-on attempt under safety conditions. At the end of the assessment we know which recovery path applies and what the realistic price range and timeline look like.
The second step is the recovery proposal. We send the client a written quote with three pieces of information: the technical recovery path, the price, and the timeline. The price for the data recovery itself ranges from R2,500 to R8,000 depending on how the recovery is achieved. Board-level repair to enable in-place decryption sits at the lower end. Removable-SSD blade reading sits at the lower end. Donor-board sourcing sits in the middle. Chip-off NAND recovery sits at R8,000 to R15,000 because of the laboratory cost and the time involved.
The third step is the recovery work itself. Once the client approves the quote, we proceed. For removable-SSD cases, the work is done in our workshop, usually within three to seven working days. For board-level repair on soldered-SSD machines, the work is done in our workshop and usually takes one to three weeks depending on parts. For chip-off NAND extraction, the work involves a partner laboratory and usually takes three to eight weeks.
The fourth step is verification. Before we hand back data, we verify that what we extracted is readable, complete, and uncorrupted. For medical practices, we hash the recovered files and provide the hash list as evidence that nothing was modified during recovery. For legal practices, we provide a chain-of-custody document that records who handled the data, when, and through what process.
The fifth step is delivery. The recovered data is provided on an encrypted external drive that we hand over physically at the workshop. We do not transmit recovered data over the internet because professional client data is not appropriate for cloud transit during a recovery process. The client signs receipt of the drive. We then securely wipe our intermediate copies and provide a wipe certificate.
The sixth step is the most important one and the one most clients underestimate. We help the client set up a real backup architecture so the next incident does not repeat the experience. Time Machine to a local drive, iCloud Drive for active documents, an off-site cloud backup for compliance records, and a tested restore procedure. A practice that has gone through one liquid-damage data scare almost always wants the next one to be a non-event.
When Recovery Is and Isn't Possible
Honesty matters more than optimism in this business. Some cases are not recoverable, and pretending otherwise does the client no favours.
Cases we recover well. Removable-SSD MacBooks from before 2016 with intact SSD blades are usually a clean recovery, success rate above ninety per cent. Soldered-SSD MacBooks with cosmetic-only liquid damage where the board can be cleaned and powered on are usually a clean recovery, success rate above eighty per cent. Soldered-SSD MacBooks where the SSD chips themselves are intact and only specific power-rail components are damaged are recoverable through targeted board repair, success rate around seventy per cent.
Cases where recovery is uncertain. Soldered-SSD MacBooks with significant board corrosion that has reached multiple layers of the board are a coin-flip. We can usually tell at assessment which side of the coin we are on, but not always. Cases where the machine has been powered on repeatedly after the spill, or where someone has attempted a home repair, often have made the situation harder than it would have been with a clean intake.
Cases where recovery is unlikely. Soldered-SSD MacBooks where the SSD chips themselves show physical damage from the liquid are at the chip-off NAND extraction tier, and even there the encrypted-block reconstruction is not guaranteed. Salt-water immersion incidents are particularly difficult because the corrosion process accelerates dramatically. MacBooks that have been left in a damp environment for weeks before assessment have usually progressed past the point where standard recovery techniques work.
We tell the client which category they are in at assessment, in writing, before they spend more money. The R599 assessment exists so the client gets an honest answer for a fixed cost before committing to the recovery itself.
Pricing and Timeline
The pricing structure for data recovery is intentionally simple so the client can plan.
The R599 assessment is the entry point for every case. It covers the inspection, the diagnostic, the written report, and the recovery quote.
Standard data recovery from R2,500 to R8,000 covers the cases that can be resolved at the workshop bench. The range exists because removable-SSD recovery, board-level repair on soldered-SSD machines, and donor-board recovery have different cost profiles.
Chip-off NAND recovery from R8,000 to R15,000 covers the laboratory cases. The price is higher because the laboratory work, the chip programmer time, and the encrypted-block reconstruction are all genuinely expensive activities.
The timeline depends on the recovery path. Workshop-bench recovery is usually three to seven working days. Donor-board recovery is one to three weeks. Chip-off NAND recovery is three to eight weeks.
For medical and legal clients with active patient or matter obligations, we offer urgent prioritisation on workshop-bench recovery cases at no premium. We understand that a paediatric practice with a Monday deadline cannot wait two weeks. The standard timelines are honest defaults; the actual delivery depends on the case.
Indicative pricing only. Final pricing is confirmed once ZA Support verifies your device model and serial number and completes the assessment. Contact ZA Support on 064 529 5863 with your model and serial number for a confirmed quote.
Frequently Asked Questions
The following are the questions we field most often from medical, legal, and professional clients facing a liquid-damage data scenario.
Can you recover patient data from a flooded MacBook Pro? Yes, in most cases. The success rate depends on which generation of MacBook the practice uses and how quickly the machine reaches us after the incident. Pre-2016 MacBook Pros with removable SSDs are the most reliable recovery. Soldered-SSD MacBooks are recoverable in most cases through board-level repair, with chip-off NAND extraction as the laboratory fallback for the hardest cases.
Is the data recovery process POPIA compliant? Yes. We treat every recovery case as a chain-of-custody event from intake to delivery. We document who handled the data, when, and through what process. We do not transmit recovered patient data or other personal information over the internet. We deliver the recovered data on an encrypted external drive handed over physically. We securely wipe our intermediate copies and provide a wipe certificate. Each of these steps maps to the section 19 reasonable security obligation under POPIA.
What's the success rate for liquid-damage data recovery? Across the cases we see at the Hyde Park workshop, the overall success rate is above eighty per cent for removable-SSD machines and around seventy per cent for soldered-SSD machines, with the rate increasing significantly for cases that reach us within twenty-four hours of the incident and decreasing for cases that have been left for weeks or that have been subject to home-repair attempts. We tell each client where their case sits at assessment.
What if the SSD is encrypted with FileVault? FileVault encryption protects the data at rest with a key derived from the user's password. For data recovery purposes, we need the FileVault password. If the client has the password, FileVault is not an obstacle to recovery — once we have read the encrypted blocks off the SSD, we apply the password and decrypt them. If the client does not have the password and there is no recovery key, the FileVault-encrypted data cannot be recovered by us or anyone else, which is the point of the encryption design.
How fast can you turn around urgent cases? For workshop-bench recovery cases involving medical or legal clients with active patient or matter deadlines, we offer urgent prioritisation at no premium. The fastest realistic turnaround is forty-eight hours from intake for a removable-SSD blade recovery. Soldered-SSD board-level recovery is genuinely a one-to-three-week process even with prioritisation because the board cleaning and component-level repair takes the time it takes. Chip-off NAND recovery cannot be rushed below the three-week floor because the laboratory work is the binding constraint.
What to Do Right Now If Your MacBook Just Got Wet
Three actions in this order. Power the machine off immediately. Do not attempt to dry it with rice, a hairdryer, or any heat source. Bring it to the Hyde Park workshop or call us on 064 529 5863 to arrange collection.
The first twenty-four hours determine more about the recovery outcome than anything else. Time turns a coffee spill into corrosion, and corrosion turns a clean recovery into a complicated one.
For medical, legal, and professional clients with compliance obligations, we treat every liquid-damage data case as a priority intake. Call the workshop, send a message, and we will arrange the assessment immediately. The data on the machine is almost always recoverable. The harder question is how quickly we can confirm that for your specific case, and that starts with the R599 assessment.
ZA Support
Hyde Park, Johannesburg
064 529 5863
