Photoshop Crashed and Ejected the Disk

The decode

A pull-out during a write is exactly when filesystem damage happens. Saving a file simply updates a volume's internal structures, so a loss of power or a disconnection while the volume is being updated leaves those structures half-written and internally inconsistent. That is what happened when disaster struck during a Photoshop save: the drive was writing when it was disconnected, and the interrupted write corrupted the bookkeeping the operating system needs to mount the volume.

Disk Utility crashing on connection is a strong sign of structural damage, not a dead drive. Disk Utility is the tool used to read a volume's structures, and when it keeps crashing while trying to read them, it is very likely that those structures are damaged badly enough to defeat it. Damage like this fits an interrupted write, and is different from a mechanical failure of the drive. This unit powers up, lights, and gets far enough to make Disk Utility fail when reading its contents.

The detail most likely to mislead is the password prompt, and it's well worth reassuring her about. Normally, her encryption password resides in Keychain and unlocks her drive automatically; the NVRAM reset erased that saved credential, which is why she was suddenly asked for it. Being prompted doesn't mean the encryption has broken down; it simply means the auto-unlock was reset. Her password is still valid. That the drive then still failed to mount points directly at the corrupted volume structures the system reads after unlocking, rather than at the encryption layer.

The two problems are independent, and separating them is the key. There is an encryption layer, which is working as expected and opens with her password, and underneath it a file system whose structures are damaged. The drive cannot mount because, after unlocking successfully, the system is unable to make sense of the damaged structures within the file system. Recovery unlocks the encryption first, and then rebuilds the file system below it: two separate steps, both required to recover her data.

All of this is done on an image of the disk, which protects a delicate situation. First, the drive is imaged, with the encryption preserved. The unlock and reconstruction are then performed on the decrypted image instead of the original, so nothing is written back to a disk that is already structurally compromised, and nothing prevents another recovery method being tried later. Her password is essential for this, so recovering an encrypted disk depends on the owner still having it.

The physical health of the disk is verified because the interruption may have left physical marks. When a disk is pulled during a write, generally only its logical structures are affected. However, a sudden stop can occasionally leave bad sectors. So the first step is to verify the drive's overall health, and if it has physical damage, imaging is adapted accordingly. Whether the problem is purely logical or has physical damage underneath shapes the honest prognosis, and that is established before any work begins.

On the bench

We imaged the drive using a hardware write-blocker to preserve its encryption, and inspected its physical condition on PC-3000 UDMA, imaging it on a DeepSpar Disk Imager where the interruption had left bad sectors. The encrypted volume was unlocked with the owner's password against the image, never the original, and the APFS/HFS+ structures were extracted from the decrypted image in R-Studio. Using these, we located the backup copies and rebuilt them. The recovered files were then validated by rendering.

The outcome

Encryption preserved and unlocked against the image, the corrupted filesystem restored from its backup copies, and the files returned. There is no cost for the assessment, and our quote is one fixed amount, plus VAT; if the data cannot be recovered, there is nothing to pay. The decode: the crash kicked out the drive during a write, breaking the volume's internal structure. The password prompt was simply the NVRAM reset clearing your saved key; the encryption itself has not failed. Unlock it, rebuild the internal structure behind it, and your work comes back.

Our case files are written up from genuine enquiries our lab has handled for customers across Staines, Surrey and the surrounding area, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery approach our engineers apply to that fault, using the equipment listed.