MacBook Datarecovery

== Theory ==
Since introduction of the integrated SSD Mac models, datarecovery is a huge challenge. 
Rule #1. If data is not backed up and device boots once during your repair - backup data first, finish the repair later. No matter what repair is that, non-backed up Mac is a great risk of losing customer's data. Thus if data is important, always ask for the password before even starting the repair. In some cases you might have 5-10 minutes untill device dies completely and you will not be able to get to the data without a major effort
Mac does not allow direct disk access. This means using an sort of data recovery software is very limited and if SSD is failing you need to reduce possible working time and avoid doing a byteclone unless it is completely necessary or you cant map the data.
== Software ==
UFS Explorer Professional - Hands down best software ever written. It supports fusion drive, snapshot-based filesystem reconstruction and even basic cloning functionality. The most stable version is probably a windows one. Free license allows you to save small files and also preprocess filesystem so you can decide if it worth it. It costs around 700$ for a lifetime license with 1 year of free updates, and if used on regular basis - worth every dime. 
OpenSuperClone - this software will help you to make a byteclone from a failing SSD drive. it is especially important if you are restoring from a filevault-encrypted drive which is not mountable. 
gddrescue - basically same purpose OpenSuperClone, CLI. Allows a bit more fine-tuning if you know what are you doing. 
iBoysoft / DiskDrill - somewhat usable software with ability to be run directly from the Recovery environment if its available. Filesystemanalyse is not as good as in UFS Explorer, also Mac-Only, most likely no or bad NTFS/ExFat support.
rsync / cp commands are very useful if you are able to get machine into single-user mode. to use rsync you need to find it under /usr/bin of the system partition. it also would not work on M1 since some dlibs would be missing. Rsync is able co continue copy process if its interrupted due to device crash. 
== Intel Machines (T1, A1534, A1708) ==
these machines use just a normal integrated SSD drive. on A1706/A1707 it is soldered on board, however if you are skilled enough, you can transfer SSD to A1708 replacable SSD drive, it is identical. 
A1534 2015-2017 use different SSD types, however some of them are compatible with SSD transfer. In most cases it would have a failed CPU, so the most efficient way to get data would be to slightly rehot the CPU and get it into the Target Disk mode. it is also a good idea to put a dry ice block underneath it to prolong its functional time and keep it close to room temperature during transfer.
== Target disk mode ==
on Intel macs Target disk mode is implemented in mac EFI and it is accessible by pressing T during init. Device will be visible as an external disk drive (not accesible by windows / linux machines). This mode is quite limited because because IO errors during data transfer will in most cases cause kernel panic on the host machine. 
on M1 machines Target Disk Mode requires boot into the recovery environment and using "share disk" option. this mode is also Mac-only and mac will be visible as a local network device. 
to use Target Disk you need to use usbc or usbc-usba cable with at least usb 2.0 wiring or better. Use known working machine to sind a cable which provides fast and stable data transfer, lable it and keep as a reference. 
== Recovery Environment ==
if machine is able to boot into Recovery (CMD+R on Intel or 8 Sec Power on Apple Silicon machines), you will be able to access terminal or disk utility. 
Disk utility is able to make image (DMG file) from folder, so you can use it to back up user folders to the external drive or even a network drive if USB ports are dead.
On M1 machines CMD + L during the diagnostics alows you to save machine boot and update logs into the external drive (it shows a strange dialog which offers you to "open" when in fact is it a save dialog). 
Recovery Environment is probably the only method of getting data from M1+ machine, especially if it fails to log in(you type password and it shows unclickable "lets go" button behind fancy desktop background) after the Sequoia Update
== Data Transfer Tool and Utility (AASP only) ==
A1706 and A1707 have a "lifeboat" connector on board which is basically an interface to access PCI-E SSD Drive directly. There are grey-market SSD Transfering devices (only compatible with intel mac machines!) which allow to acces SSD directly. 
On apple T2 machines there is a special iBSS image which is sideloaded into T2, allowing it to start Target Disk mode without Intel part (even if there is no CPU on board). it is only accesible for AASP providers, however if you a re lucky you might find one which is able to do that for you. There are also some methods of doing that using Checkmate exploit, however i never seen Data Transfer iBSS image in wild. most likely it would be some sort of patched iBSS + Ramdisk similar to one uploaded during DFU restore / revive to allow direct disk access and write BridgeOS)