The System Sees It, but Disk Utility Doesn't

The decode

The split between System Report and Disk Utility locates the fault precisely, and it is reassuring. System Report lists all hardware that the Mac detects on a basic level; Disk Utility functions one level up by reading the volume structures of the disk so it can be presented for use. If a drive is listed in System Report but not in Disk Utility then the drive has been recognised as hardware (it powers and communicates), however its volume cannot be read. That is a volume-level fault rather than a dead drive: the hardware is fine, and the file system is damaged.

A full disk is a plausible trigger for this occurrence, which explains the timing. It was not a coincidence when the hard disk was completely filled and then could not be recognised. When a volume is filled to absolute capacity, it can leave no room in the filesystem to perform operations (such as updating) on the filesystem itself; and when a structure update is caught with no free space available, the volume can become corrupted. The disk filling is very likely what caused the damage to the structures, which is why the failure to recognise it occurred at that exact time rather than at random.

Detected-but-not-in-Disk-Utility indicates that the file data is still intact, sitting behind the damage. Since the drive is detected as a hardware device, the memory area where the files are located is being reached at the low level. What has failed is simply the volume structure information that Disk Utility requires in order to present the contents of the drive. Therefore, the data is still stored intact in this memory location, and all that has been damaged is the "description" of the volume, the records that tell the system how to locate and view it, not the space holding the files. This is the recoverable combination: a good physical drive with a damaged volume.

The move to resist is Disk Utility's repair and erase, which carries the main risk. When Disk Utility encounters a volume that it can't present, it provides two options, "First Aid" (which will write repairs to the disk) and "erase". If you have a volume whose structures have been damaged, especially by the volume filling up, running First Aid could further corrupt the disk and running "erase" would completely wipe out all recoverable information. Neither option should be attempted on the original device; instead, the device should be left in the condition it was found and the data recovered from an image.

The honest prognosis is good, with drive health confirmed first. A detected drive which has been found to have a volume fault from a full disk typically can be recovered well. Drive health gets checked at the very start, to rule out a hardware fault that just happens to coincide, and what can be recovered is confirmed before there's any charge. The advice going forward follows from the cause; generally leaving headroom on a drive would avoid the full-disk corruption that triggered this, and the recovered data should be kept somewhere backed up.

On the bench

The drive was imaged using a hardware-based write blocker before anything was interpreted, to prevent any changes to the original data, and the drive's health was checked via PC-3000 UDMA. After that the native Mac APFS/HFS+ structures were interpreted from the disk image within R-Studio, backup copies of the volume structures were located and rebuilt, and signature carving was used to recover anything which was no longer referenced in the damaged structures. The recovered files were then validated by rendering them.

The outcome

The detected drive was imaged, all of the volume structures were rebuilt from their backup copies, and the files were returned arranged back to how they were originally organised. There is no cost for the diagnostic, which will be completed within two working days after arrival, and the quote is a single fixed written figure with VAT already in it; if the data cannot be brought back, no charge is made. The decode: if the drive appears in System Report but not in Disk Utility, it does not mean your drive has died. It's been recognised, but the volume on it is damaged, and the most likely reason is that it filled right up. Once the files are rebuilt from the volume's own backup structures, working on an image, they come back; First Aid never gets a chance to make the damage any worse.

Our case files are written up from genuine enquiries our lab has handled for customers across Swansea and South Wales, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery approach our engineers apply to that fault, using the equipment listed.