Data Recovery from factory reset Macs
We have a MacBook Air A1932 (2018) model. This has been factory reset/wiped. The mac has not been set up; i.e. upon boot it takes you to the page to create a new user. My question is, is it possible to recover any data from this mac? It has a 128GB SSD. Being an SSD, I would have though that upon factory reset no data would be recoverable anyway.
Attempted to image the Macs using MacQuisition and Paladin. Upon boot into the imaging utility, the system gave an error saying - "Security Settings do not allow this Mac to use an external startup disk. You can change this by restarting and holding down the Command-R to open macOS Recovery and then choosing Startup Security Utility".
Startup Security Utility was run and it needed Authentication. When proceeded, once again there was an error saying that "Recovery is trying to change system settings. No administrator was found". This error is because the macs have been wiped and no admin has been set up on them. So, in order to proceed, the mac will have to be setup with an admin account.
Question: is it worth setting up a new user and trying MacQuisition again. Or I was thinking of chip-off (this mac has the SSD soldered to the motherboard so not removable). Will either two options have any realistic chance of recovering the deleted data? The mac may or may not have been previously encrypted.
This model has a T2 security chip, so removing the SSD wouldn't be an option to get you decrypted data, even if the SSD hadn't been wiped.
You could try imaging via Target Disk Mode, but you're most likely going to find that no user-generated data is recoverable.
What are you looking for?
Also most likely not there anymore.