Velocity Reviews

Velocity Reviews (http://www.velocityreviews.com/forums/index.php)
-   NZ Computing (http://www.velocityreviews.com/forums/f47-nz-computing.html)
-   -   Data recovery, formatted HFS+ sata drive (http://www.velocityreviews.com/forums/t734841-data-recovery-formatted-hfs-sata-drive.html)

Nik Coughlin 10-06-2010 05:27 AM

Data recovery, formatted HFS+ sata drive
 
We got burgled today, great huh.

My flatmate lost her laptop with years of work on it. Yeah, I know,
backups right. She has some.

She upgraded the hard disk some months ago and I have the old hard
disk. It's been formatted but not used at all since being formatted.

I'm able to see the files using a piece of software called SalvageData
Mac:

http://www.salvagedata.com/recovery-...vage-data-mac/

It seems to work because I can browse files and it has a preview
function which I've used to look at some of the images on the disk
successfully.

They want US$190 for a license to activate it before I can actually
recover the data though. She's willing to pay it but first I wanted to
see if anyone has any experience with this or other software, or if
you think I should talk to someone like Computer Forensics NZ first,
or just if anyone can offer any other useful advice.

Thanks a million

Lawrence D'Oliveiro 10-06-2010 05:38 AM

Re: Data recovery, formatted HFS+ sata drive
 
In message
<4a08c875-0648-412c-9001-da6ee17f399b@m35g2000prn.googlegroups.com>, Nik
Coughlin wrote:

> It seems to work because I can browse files and it has a preview
> function which I've used to look at some of the images on the disk
> successfully.


Any reason you can’t just mount it read-only and copy files off it?

Nik Coughlin 10-06-2010 05:45 AM

Re: Data recovery, formatted HFS+ sata drive
 
On Oct 6, 6:38*pm, Lawrence D'Oliveiro <l...@geek-
central.gen.new_zealand> wrote:
> In message
> <4a08c875-0648-412c-9001-da6ee17f3...@m35g2000prn.googlegroups.com>, Nik
>
> Coughlin wrote:
> > It seems to work because I can browse files and it has a preview
> > function which I've used to look at some of the images on the disk
> > successfully.

>
> Any reason you canít just mount it read-only and copy files off it?


First thing I tried, only to discover that it'd been formatted, as
NTFS.

So it shows up as being an empty drive.

The software I mentioned above was able to reconstruct the HFS+ volume
after about 90 minutes, and I can view the files (one at a time, using
their proprietary image/hex viewer) but it won't recover the files en
masse until it's been activated.

Just wanted to check what people had to say before spending the money,
which is definitely an option, it's cheap compared to the data on the
disk.

Notice that those Computer Forensics crowd only bills if the succeed
in recovering your files, so that's tempting too, but again, any
advice would be very welcome.

Ray Greene 10-06-2010 06:19 AM

Re: Data recovery, formatted HFS+ sata drive
 
On Tue, 5 Oct 2010 22:45:16 -0700 (PDT), Nik Coughlin
<nrkn.com@gmail.com> wrote:

>On Oct 6, 6:38*pm, Lawrence D'Oliveiro <l...@geek-
>central.gen.new_zealand> wrote:
>> In message
>> <4a08c875-0648-412c-9001-da6ee17f3...@m35g2000prn.googlegroups.com>, Nik
>>
>> Coughlin wrote:
>> > It seems to work because I can browse files and it has a preview
>> > function which I've used to look at some of the images on the disk
>> > successfully.

>>
>> Any reason you canít just mount it read-only and copy files off it?

>
>First thing I tried, only to discover that it'd been formatted, as
>NTFS.
>
>So it shows up as being an empty drive.
>
>The software I mentioned above was able to reconstruct the HFS+ volume
>after about 90 minutes, and I can view the files (one at a time, using
>their proprietary image/hex viewer) but it won't recover the files en
>masse until it's been activated.
>
>Just wanted to check what people had to say before spending the money,
>which is definitely an option, it's cheap compared to the data on the
>disk.
>
>Notice that those Computer Forensics crowd only bills if the succeed
>in recovering your files, so that's tempting too, but again, any
>advice would be very welcome.


I bought an earlier product from these guys, this is presumably the
latest version
http://www.prosofteng.com/products/d...cue_pc_buy.php

I was in a similar situation to you and it recovered a whole drive
without any problem. This one is $US99.

You'll probably find some free tools that can do the same job if you
look around. Recuva springs to mind, though I haven't tried it on a
formatted disk.
http://www.piriform.com/recuva

--
Ray Greene

Dave Doe 10-06-2010 10:57 PM

Re: Data recovery, formatted HFS+ sata drive
 
In article <4a08c875-0648-412c-9001-
da6ee17f399b@m35g2000prn.googlegroups.com>, nrkn.com@gmail.com says...
>
> We got burgled today, great huh.
>
> My flatmate lost her laptop with years of work on it. Yeah, I know,
> backups right. She has some.
>
> She upgraded the hard disk some months ago and I have the old hard
> disk. It's been formatted but not used at all since being formatted.
>
> I'm able to see the files using a piece of software called SalvageData
> Mac:
>
> http://www.salvagedata.com/recovery-...vage-data-mac/
>
> It seems to work because I can browse files and it has a preview
> function which I've used to look at some of the images on the disk
> successfully.
>
> They want US$190 for a license to activate it before I can actually
> recover the data though. She's willing to pay it but first I wanted to
> see if anyone has any experience with this or other software, or if
> you think I should talk to someone like Computer Forensics NZ first,
> or just if anyone can offer any other useful advice.
>
> Thanks a million


Try Testdisk first - it's free - and has done the job for me on many
occasions.

http://en.wikipedia.org/wiki/TestDisk


--
Duncan.

Gordon 10-07-2010 08:11 AM

Re: Data recovery, formatted HFS+ sata drive
 
On 2010-10-06, Bret <at@at.corn> wrote:
> On Tue, 5 Oct 2010 22:27:33 -0700 (PDT), Nik Coughlin wrote:
>
>> We got burgled today, great huh.
>>
>> My flatmate lost her laptop with years of work on it. Yeah, I know,
>> backups right. She has some.
>>
>> She upgraded the hard disk some months ago and I have the old hard
>> disk. It's been formatted but not used at all since being formatted.
>>
>> I'm able to see the files using a piece of software called SalvageData
>> Mac:
>>
>> http://www.salvagedata.com/recovery-...vage-data-mac/
>>
>> It seems to work because I can browse files and it has a preview
>> function which I've used to look at some of the images on the disk
>> successfully.
>>
>> They want US$190 for a license to activate it before I can actually
>> recover the data though. She's willing to pay it but first I wanted to
>> see if anyone has any experience with this or other software, or if
>> you think I should talk to someone like Computer Forensics NZ first,
>> or just if anyone can offer any other useful advice.
>>
>> Thanks a million

>
> Not an answer, but I think you should image it and work with that just to
> be safe.


Indeed. Should be the first thing you do

Dave Doe 10-07-2010 08:26 AM

Re: Data recovery, formatted HFS+ sata drive
 
In article <8h5dl7FbpuU2@mid.individual.net>, gordon@clear.net.nz
says...
>
> On 2010-10-06, Bret <at@at.corn> wrote:
> > On Tue, 5 Oct 2010 22:27:33 -0700 (PDT), Nik Coughlin wrote:
> >
> >> We got burgled today, great huh.
> >>
> >> My flatmate lost her laptop with years of work on it. Yeah, I know,
> >> backups right. She has some.
> >>
> >> She upgraded the hard disk some months ago and I have the old hard
> >> disk. It's been formatted but not used at all since being formatted.
> >>
> >> I'm able to see the files using a piece of software called SalvageData
> >> Mac:
> >>
> >> http://www.salvagedata.com/recovery-...vage-data-mac/
> >>
> >> It seems to work because I can browse files and it has a preview
> >> function which I've used to look at some of the images on the disk
> >> successfully.
> >>
> >> They want US$190 for a license to activate it before I can actually
> >> recover the data though. She's willing to pay it but first I wanted to
> >> see if anyone has any experience with this or other software, or if
> >> you think I should talk to someone like Computer Forensics NZ first,
> >> or just if anyone can offer any other useful advice.
> >>
> >> Thanks a million

> >
> > Not an answer, but I think you should image it and work with that just to
> > be safe.

>
> Indeed. Should be the first thing you do


Why??? It will just be an image of a formatted disk. There is no way to
read any underlying data (the image won't get that, so won't contain
it).

The main thing is to just ensure it is put in a PC as a non-master
drive.

--
Duncan.

Dave Doe 10-07-2010 11:42 AM

Re: Data recovery, formatted HFS+ sata drive
 
In article <MPG.27184b48630bcdde9897dc@news.eternal-september.org>,
hard@work.ok says...
>
> In article <8h5dl7FbpuU2@mid.individual.net>, gordon@clear.net.nz
> says...
> >
> > On 2010-10-06, Bret <at@at.corn> wrote:
> > > On Tue, 5 Oct 2010 22:27:33 -0700 (PDT), Nik Coughlin wrote:
> > >
> > >> We got burgled today, great huh.
> > >>
> > >> My flatmate lost her laptop with years of work on it. Yeah, I know,
> > >> backups right. She has some.
> > >>
> > >> She upgraded the hard disk some months ago and I have the old hard
> > >> disk. It's been formatted but not used at all since being formatted.
> > >>
> > >> I'm able to see the files using a piece of software called SalvageData
> > >> Mac:
> > >>
> > >> http://www.salvagedata.com/recovery-...vage-data-mac/
> > >>
> > >> It seems to work because I can browse files and it has a preview
> > >> function which I've used to look at some of the images on the disk
> > >> successfully.
> > >>
> > >> They want US$190 for a license to activate it before I can actually
> > >> recover the data though. She's willing to pay it but first I wanted to
> > >> see if anyone has any experience with this or other software, or if
> > >> you think I should talk to someone like Computer Forensics NZ first,
> > >> or just if anyone can offer any other useful advice.
> > >>
> > >> Thanks a million
> > >
> > > Not an answer, but I think you should image it and work with that just to
> > > be safe.

> >
> > Indeed. Should be the first thing you do

>
> Why??? It will just be an image of a formatted disk. There is no way to
> read any underlying data (the image won't get that, so won't contain
> it).
>
> The main thing is to just ensure it is put in a PC as a non-master
> drive.


And um.. further to that. I think it's a really BAD IDEA to image the
disk. While clearly *writing* to the disk is to be avoided - intensive
reading from it is probably a bad idea too. I think if you want to read
the data from the previous format, imaging the disk should be avoided
absolutely.

And as said, there is no advantage in imaging the disk at all anyway.

--
Duncan.

Squiggle 10-07-2010 07:19 PM

Re: Data recovery, formatted HFS+ sata drive
 
On 8/10/2010 12:42 a.m., Dave Doe threw some characters down the intarwebs:

>
> And um.. further to that. I think it's a really BAD IDEA to image the
> disk. While clearly *writing* to the disk is to be avoided - intensive
> reading from it is probably a bad idea too. I think if you want to read
> the data from the previous format, imaging the disk should be avoided
> absolutely.



Why???? We aren't talking about a drive that is suspected of having
suffered a head crash or other hardware failure just a quick format
destroying the FAT (or whatever the HFS+ equiv is called). If its
mounted read-only the only risk to the data is that of hardware failure
of the HDD.


>
> And as said, there is no advantage in imaging the disk at all anyway.
>


Except if your recovery software doesn't work.. then you can plug in the
original, make another image and try again. If the OPs friend is
considering paying computer forensics several hundred dollars to recover
the data the cost of a spare HD to image it onto then do the recovery is
not a problem.

Dave Doe 10-07-2010 11:53 PM

Re: Data recovery, formatted HFS+ sata drive
 
In article <who-9B4E6F.07072508102010@news.orcon.net.nz>,
who@am.i.spammer says...
>
> In article <MPG.27184b48630bcdde9897dc@news.eternal-september.org>,
> Dave Doe <hard@work.ok> wrote:
>
> > In article <8h5dl7FbpuU2@mid.individual.net>, gordon@clear.net.nz
> > says...
> > >
> > > On 2010-10-06, Bret <at@at.corn> wrote:
> > > > On Tue, 5 Oct 2010 22:27:33 -0700 (PDT), Nik Coughlin wrote:
> > > >
> > > >> We got burgled today, great huh.
> > > >>
> > > >> My flatmate lost her laptop with years of work on it. Yeah, I know,
> > > >> backups right. She has some.
> > > >>
> > > >> She upgraded the hard disk some months ago and I have the old hard
> > > >> disk. It's been formatted but not used at all since being formatted.
> > > >>
> > > >> I'm able to see the files using a piece of software called SalvageData
> > > >> Mac:
> > > >>
> > > >> http://www.salvagedata.com/recovery-...vage-data-mac/
> > > >>
> > > >> It seems to work because I can browse files and it has a preview
> > > >> function which I've used to look at some of the images on the disk
> > > >> successfully.
> > > >>
> > > >> They want US$190 for a license to activate it before I can actually
> > > >> recover the data though. She's willing to pay it but first I wanted to
> > > >> see if anyone has any experience with this or other software, or if
> > > >> you think I should talk to someone like Computer Forensics NZ first,
> > > >> or just if anyone can offer any other useful advice.
> > > >>
> > > >> Thanks a million
> > > >
> > > > Not an answer, but I think you should image it and work with that just to
> > > > be safe.
> > >
> > > Indeed. Should be the first thing you do

> >
> > Why??? It will just be an image of a formatted disk. There is no way to
> > read any underlying data (the image won't get that, so won't contain
> > it).
> >
> > The main thing is to just ensure it is put in a PC as a non-master
> > drive.

>
> No, no , no, no ,no you should do a sector image,
> On a Mac using OSX you would do something like
>
> dd if=/dev/disk1 of=/dev/disk2
>
> or what ever the relevant disk IDs are.


Shows you how much you know. dd doesn't do a full sector based image -
just the boot sectors.

You know what dd stands for? :)

dd is pottentially a good file recovery program. I wouldn't use it as a
sector based imager - because it isn't.

ddrescue is a full sector based imager.

dd can be very dangerous - and if the OP has not had experience with it,
I would not recommend it.

There are other much nicer (GUI) sector based imaging programs around -
many commercial of course. I wouldn't use any of them though - as such
an intensive read of the drive will only lessen the chance of data
recovery. A few years back I used to deal with a data recovery dude in
Palmy (Alan someone). He died of a heart attack a few years ago - so I
don't deal with him anymore. He was good, *and* cheap (typically about
$300 for a drive recovery - but it could be twice or three times that).
I spoke to him on many occasions and his advice was NOT to (sector)
image the drive. Just send it to him, with another new drive as big or
bigger - and he'd send at least the latter back. I never got all the
reasons from the dude about why it shouldn't be imaged - but one of them
was a potentially bad controller. While the OP's HDD controller is
probably good - it can't be ruled out entirely.

The general technique I got from Allen (not sure that's his name now) -
is that he would first examine the disk, dig in a bit. Try and find out
what the problem is, based on the customer info and his initial
forensics. Typically he never imaged the disk.

Feel free to phone up some other data recovery specialists and ask them
- they won't recommend you image the disk. And the probably won't image
the disk if you send it to them. There is simply no need. For example,
take Testdisk - it has backup functions on most of its write procedures.
eg. you can save existing partition information before making changes.

Here's an example page from their site...
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

--
Duncan.


All times are GMT. The time now is 10:23 AM.

Powered by vBulletin®. Copyright ©2000 - 2014, vBulletin Solutions, Inc.
SEO by vBSEO ©2010, Crawlability, Inc.