Part 1 ended with an 80 GB Intel SSD out of a 2009 Mac Mini and an adapter on order. That post made a bet: if the Pictures folder is empty, the disk was reinstalled before it went in the cabinet, and the photos may still be on the flash. Today the adapter arrived. Both halves of the bet paid.
The SSD showed up over USB-C in a few seconds. No Initialize dialog. One GPT disk, one HFS+ volume named "75GB Intel SSD," one Recovery HD partition. We mounted it read-only and looked.
| What we found | Meaning |
|---|---|
| Mac OS X 10.9.5 Mavericks, installed November 15, 2019 | Fresh OS, seven years after the Mini shipped |
| Two user accounts, both created that week | Somebody set it up, then stopped |
Every Pictures folder: one hidden .localized file | No library. No JPEGs. Nothing. |
No Previous Systems, no Deleted Users | Not an in-place upgrade. Erase and install. |
| 12 GB used of 74 GB | The reinstall touched about 15% of the flash |
So: in late 2019 the disk was erased, Mavericks went on, and the Mini went into the garage. The old library was gone from the catalog. That is exactly the case Part 1 planned for.
This is a first-generation Intel X25-M. It has no TRIM. When Disk Utility erased it in 2019, it wrote a new empty catalog; it did not tell the drive to discard the old blocks. Seven years unpowered in a cabinet does not change that. The only thing that overwrites old data on a no-TRIM SSD is new data, and the reinstall only wrote about 12 GB on top of 80.
Whatever lived in the other 63 GB was still physically there. It just had no names.
One rule: nothing writes to the SSD, and nothing reads it more than once. We unmounted it and copied the raw device to a file with dd. A small wrapper script refused to run unless the target was a USB disk with the Intel model string and exactly 156,301,488 sectors, so there was no way to point it at the wrong drive.
The image came out byte-exact: 80,026,361,856 bytes, matching the disk. We hashed it, then ran PhotoRec against the image file, not the drive:
photorec /log /d carve/rec /cmd intel-x25m-80g.img \
partition_none,options,paranoid,wholespace,fileopt,everything,disable,jpg,enable,png,enable,tif,enable,mov,enable,searchFour minutes. 81,230 files, 43 GB. PhotoRec does not know what a filename is. It walks the raw bytes looking for the signatures of JPEG, PNG, TIFF, and QuickTime headers and pulls out whatever decodes. Most of that 81k is Mavericks: 43,752 PNG icons, a few thousand tiny TIFFs, 1,933 iTunes tracks it caught by accident. The photos were in there with them.
Carved files are named by sector offset. The only metadata that survives is what the camera or scanner wrote inside the JPEG. So we read EXIF from every JPEG over 50 KB and sorted by that.
| Camera / source | JPEGs found (before dedupe) | Years |
|---|---|---|
| Noritsu minilab scanner ("EZ Controller") + Photoshop Elements 6, Windows | 1,495 after dedupe | Scanned December 3–6, 2011 |
| Canon EOS 50D | 2,328 | 2009–2011 |
| Sony DSC-H1 | 1,377 | 2006–2008 |
| Olympus 720SW | 1,215 | 2006–2009 |
| Nikon D3S | 562 | 2010 |
| Canon 10D, Nikon E5700, Kodak Z650, iPhone 3GS through X, iPad | ~1,000 | 2005–2018 |
The scans were the point of the whole hunt. In December 2011 a commercial photo lab ran Mom's prints through a Noritsu minilab and handed back JPEGs; someone touched them up in Photoshop Elements on a Windows PC and imported them into Aperture on this Mini. Two sizes came out: the minilab's own 4119×2731 scans of individual prints, and larger 6479×4987 flatbed passes that turn out to be whole album pages. The first two we opened were a 1983 album title page and a late-1980s print of a woman at a mountain overlook. Both intact, full resolution.
Aperture keeps a master and a preview of every photo. The carve returned both. Same camera, same capture timestamp to the second, different pixel counts: keep the biggest, drop the rest. Exact byte-duplicates went first.
| Step | Count |
|---|---|
| Carved files | 81,230 |
| JPEG with EXIF or over 300 KB, plus video and DNG | 11,662 |
| After exact-duplicate removal (SHA-256) | 10,979 |
| After collapsing Aperture master/preview pairs | 7,038 |
Final layout: scans/ (1,495), camera/<year>/ (3,166), video/ (66), raw/ (91), and an unsorted/ pile of 2,220 Aperture exports and Photoshop edits that need a human, not a rule. 14 GB total. The raw image and the untouched carve output stay on disk as provenance.
One $40 USB-C SATA adapter, one afternoon, no lab, no recovery software beyond dd and PhotoRec. The rules that mattered: never click Initialize, verify the mount is actually read-only before looking (macOS mounted the data volume read-write the first time despite being asked not to), image once, carve the image, and sort by EXIF because the filenames are not coming back.
Next is a throwaway Photos library and a slow pass through 1,495 scans. That part is not a technical problem.