Data recovery, formatted HFS+ sata drive

Discussion in 'NZ Computing' started by Nik Coughlin, Oct 6, 2010.

  1. Nik Coughlin

    Nik Coughlin Guest

    We got burgled today, great huh.

    My flatmate lost her laptop with years of work on it. Yeah, I know,
    backups right. She has some.

    She upgraded the hard disk some months ago and I have the old hard
    disk. It's been formatted but not used at all since being formatted.

    I'm able to see the files using a piece of software called SalvageData
    Mac:

    http://www.salvagedata.com/recovery-software/salvage-data-mac/

    It seems to work because I can browse files and it has a preview
    function which I've used to look at some of the images on the disk
    successfully.

    They want US$190 for a license to activate it before I can actually
    recover the data though. She's willing to pay it but first I wanted to
    see if anyone has any experience with this or other software, or if
    you think I should talk to someone like Computer Forensics NZ first,
    or just if anyone can offer any other useful advice.

    Thanks a million
     
    Nik Coughlin, Oct 6, 2010
    #1
    1. Advertising

  2. In message
    <>, Nik
    Coughlin wrote:

    > It seems to work because I can browse files and it has a preview
    > function which I've used to look at some of the images on the disk
    > successfully.


    Any reason you can’t just mount it read-only and copy files off it?
     
    Lawrence D'Oliveiro, Oct 6, 2010
    #2
    1. Advertising

  3. Nik Coughlin

    Nik Coughlin Guest

    On Oct 6, 6:38 pm, Lawrence D'Oliveiro <l...@geek-
    central.gen.new_zealand> wrote:
    > In message
    > <>, Nik
    >
    > Coughlin wrote:
    > > It seems to work because I can browse files and it has a preview
    > > function which I've used to look at some of the images on the disk
    > > successfully.

    >
    > Any reason you can’t just mount it read-only and copy files off it?


    First thing I tried, only to discover that it'd been formatted, as
    NTFS.

    So it shows up as being an empty drive.

    The software I mentioned above was able to reconstruct the HFS+ volume
    after about 90 minutes, and I can view the files (one at a time, using
    their proprietary image/hex viewer) but it won't recover the files en
    masse until it's been activated.

    Just wanted to check what people had to say before spending the money,
    which is definitely an option, it's cheap compared to the data on the
    disk.

    Notice that those Computer Forensics crowd only bills if the succeed
    in recovering your files, so that's tempting too, but again, any
    advice would be very welcome.
     
    Nik Coughlin, Oct 6, 2010
    #3
  4. Nik Coughlin

    Ray Greene Guest

    On Tue, 5 Oct 2010 22:45:16 -0700 (PDT), Nik Coughlin
    <> wrote:

    >On Oct 6, 6:38 pm, Lawrence D'Oliveiro <l...@geek-
    >central.gen.new_zealand> wrote:
    >> In message
    >> <>, Nik
    >>
    >> Coughlin wrote:
    >> > It seems to work because I can browse files and it has a preview
    >> > function which I've used to look at some of the images on the disk
    >> > successfully.

    >>
    >> Any reason you can’t just mount it read-only and copy files off it?

    >
    >First thing I tried, only to discover that it'd been formatted, as
    >NTFS.
    >
    >So it shows up as being an empty drive.
    >
    >The software I mentioned above was able to reconstruct the HFS+ volume
    >after about 90 minutes, and I can view the files (one at a time, using
    >their proprietary image/hex viewer) but it won't recover the files en
    >masse until it's been activated.
    >
    >Just wanted to check what people had to say before spending the money,
    >which is definitely an option, it's cheap compared to the data on the
    >disk.
    >
    >Notice that those Computer Forensics crowd only bills if the succeed
    >in recovering your files, so that's tempting too, but again, any
    >advice would be very welcome.


    I bought an earlier product from these guys, this is presumably the
    latest version
    http://www.prosofteng.com/products/data_rescue_pc_buy.php

    I was in a similar situation to you and it recovered a whole drive
    without any problem. This one is $US99.

    You'll probably find some free tools that can do the same job if you
    look around. Recuva springs to mind, though I haven't tried it on a
    formatted disk.
    http://www.piriform.com/recuva

    --
    Ray Greene
     
    Ray Greene, Oct 6, 2010
    #4
  5. Nik Coughlin

    Dave Doe Guest

    In article <4a08c875-0648-412c-9001-
    >, says...
    >
    > We got burgled today, great huh.
    >
    > My flatmate lost her laptop with years of work on it. Yeah, I know,
    > backups right. She has some.
    >
    > She upgraded the hard disk some months ago and I have the old hard
    > disk. It's been formatted but not used at all since being formatted.
    >
    > I'm able to see the files using a piece of software called SalvageData
    > Mac:
    >
    > http://www.salvagedata.com/recovery-software/salvage-data-mac/
    >
    > It seems to work because I can browse files and it has a preview
    > function which I've used to look at some of the images on the disk
    > successfully.
    >
    > They want US$190 for a license to activate it before I can actually
    > recover the data though. She's willing to pay it but first I wanted to
    > see if anyone has any experience with this or other software, or if
    > you think I should talk to someone like Computer Forensics NZ first,
    > or just if anyone can offer any other useful advice.
    >
    > Thanks a million


    Try Testdisk first - it's free - and has done the job for me on many
    occasions.

    http://en.wikipedia.org/wiki/TestDisk


    --
    Duncan.
     
    Dave Doe, Oct 6, 2010
    #5
  6. Nik Coughlin

    Gordon Guest

    On 2010-10-06, Bret <> wrote:
    > On Tue, 5 Oct 2010 22:27:33 -0700 (PDT), Nik Coughlin wrote:
    >
    >> We got burgled today, great huh.
    >>
    >> My flatmate lost her laptop with years of work on it. Yeah, I know,
    >> backups right. She has some.
    >>
    >> She upgraded the hard disk some months ago and I have the old hard
    >> disk. It's been formatted but not used at all since being formatted.
    >>
    >> I'm able to see the files using a piece of software called SalvageData
    >> Mac:
    >>
    >> http://www.salvagedata.com/recovery-software/salvage-data-mac/
    >>
    >> It seems to work because I can browse files and it has a preview
    >> function which I've used to look at some of the images on the disk
    >> successfully.
    >>
    >> They want US$190 for a license to activate it before I can actually
    >> recover the data though. She's willing to pay it but first I wanted to
    >> see if anyone has any experience with this or other software, or if
    >> you think I should talk to someone like Computer Forensics NZ first,
    >> or just if anyone can offer any other useful advice.
    >>
    >> Thanks a million

    >
    > Not an answer, but I think you should image it and work with that just to
    > be safe.


    Indeed. Should be the first thing you do
     
    Gordon, Oct 7, 2010
    #6
  7. Nik Coughlin

    Dave Doe Guest

    In article <>,
    says...
    >
    > On 2010-10-06, Bret <> wrote:
    > > On Tue, 5 Oct 2010 22:27:33 -0700 (PDT), Nik Coughlin wrote:
    > >
    > >> We got burgled today, great huh.
    > >>
    > >> My flatmate lost her laptop with years of work on it. Yeah, I know,
    > >> backups right. She has some.
    > >>
    > >> She upgraded the hard disk some months ago and I have the old hard
    > >> disk. It's been formatted but not used at all since being formatted.
    > >>
    > >> I'm able to see the files using a piece of software called SalvageData
    > >> Mac:
    > >>
    > >> http://www.salvagedata.com/recovery-software/salvage-data-mac/
    > >>
    > >> It seems to work because I can browse files and it has a preview
    > >> function which I've used to look at some of the images on the disk
    > >> successfully.
    > >>
    > >> They want US$190 for a license to activate it before I can actually
    > >> recover the data though. She's willing to pay it but first I wanted to
    > >> see if anyone has any experience with this or other software, or if
    > >> you think I should talk to someone like Computer Forensics NZ first,
    > >> or just if anyone can offer any other useful advice.
    > >>
    > >> Thanks a million

    > >
    > > Not an answer, but I think you should image it and work with that just to
    > > be safe.

    >
    > Indeed. Should be the first thing you do


    Why??? It will just be an image of a formatted disk. There is no way to
    read any underlying data (the image won't get that, so won't contain
    it).

    The main thing is to just ensure it is put in a PC as a non-master
    drive.

    --
    Duncan.
     
    Dave Doe, Oct 7, 2010
    #7
  8. Nik Coughlin

    Dave Doe Guest

    In article <-september.org>,
    says...
    >
    > In article <>,
    > says...
    > >
    > > On 2010-10-06, Bret <> wrote:
    > > > On Tue, 5 Oct 2010 22:27:33 -0700 (PDT), Nik Coughlin wrote:
    > > >
    > > >> We got burgled today, great huh.
    > > >>
    > > >> My flatmate lost her laptop with years of work on it. Yeah, I know,
    > > >> backups right. She has some.
    > > >>
    > > >> She upgraded the hard disk some months ago and I have the old hard
    > > >> disk. It's been formatted but not used at all since being formatted.
    > > >>
    > > >> I'm able to see the files using a piece of software called SalvageData
    > > >> Mac:
    > > >>
    > > >> http://www.salvagedata.com/recovery-software/salvage-data-mac/
    > > >>
    > > >> It seems to work because I can browse files and it has a preview
    > > >> function which I've used to look at some of the images on the disk
    > > >> successfully.
    > > >>
    > > >> They want US$190 for a license to activate it before I can actually
    > > >> recover the data though. She's willing to pay it but first I wanted to
    > > >> see if anyone has any experience with this or other software, or if
    > > >> you think I should talk to someone like Computer Forensics NZ first,
    > > >> or just if anyone can offer any other useful advice.
    > > >>
    > > >> Thanks a million
    > > >
    > > > Not an answer, but I think you should image it and work with that just to
    > > > be safe.

    > >
    > > Indeed. Should be the first thing you do

    >
    > Why??? It will just be an image of a formatted disk. There is no way to
    > read any underlying data (the image won't get that, so won't contain
    > it).
    >
    > The main thing is to just ensure it is put in a PC as a non-master
    > drive.


    And um.. further to that. I think it's a really BAD IDEA to image the
    disk. While clearly *writing* to the disk is to be avoided - intensive
    reading from it is probably a bad idea too. I think if you want to read
    the data from the previous format, imaging the disk should be avoided
    absolutely.

    And as said, there is no advantage in imaging the disk at all anyway.

    --
    Duncan.
     
    Dave Doe, Oct 7, 2010
    #8
  9. Nik Coughlin

    Squiggle Guest

    On 8/10/2010 12:42 a.m., Dave Doe threw some characters down the intarwebs:

    >
    > And um.. further to that. I think it's a really BAD IDEA to image the
    > disk. While clearly *writing* to the disk is to be avoided - intensive
    > reading from it is probably a bad idea too. I think if you want to read
    > the data from the previous format, imaging the disk should be avoided
    > absolutely.



    Why???? We aren't talking about a drive that is suspected of having
    suffered a head crash or other hardware failure just a quick format
    destroying the FAT (or whatever the HFS+ equiv is called). If its
    mounted read-only the only risk to the data is that of hardware failure
    of the HDD.


    >
    > And as said, there is no advantage in imaging the disk at all anyway.
    >


    Except if your recovery software doesn't work.. then you can plug in the
    original, make another image and try again. If the OPs friend is
    considering paying computer forensics several hundred dollars to recover
    the data the cost of a spare HD to image it onto then do the recovery is
    not a problem.
     
    Squiggle, Oct 7, 2010
    #9
  10. Nik Coughlin

    Dave Doe Guest

    In article <>,
    mer says...
    >
    > In article <-september.org>,
    > Dave Doe <> wrote:
    >
    > > In article <>,
    > > says...
    > > >
    > > > On 2010-10-06, Bret <> wrote:
    > > > > On Tue, 5 Oct 2010 22:27:33 -0700 (PDT), Nik Coughlin wrote:
    > > > >
    > > > >> We got burgled today, great huh.
    > > > >>
    > > > >> My flatmate lost her laptop with years of work on it. Yeah, I know,
    > > > >> backups right. She has some.
    > > > >>
    > > > >> She upgraded the hard disk some months ago and I have the old hard
    > > > >> disk. It's been formatted but not used at all since being formatted.
    > > > >>
    > > > >> I'm able to see the files using a piece of software called SalvageData
    > > > >> Mac:
    > > > >>
    > > > >> http://www.salvagedata.com/recovery-software/salvage-data-mac/
    > > > >>
    > > > >> It seems to work because I can browse files and it has a preview
    > > > >> function which I've used to look at some of the images on the disk
    > > > >> successfully.
    > > > >>
    > > > >> They want US$190 for a license to activate it before I can actually
    > > > >> recover the data though. She's willing to pay it but first I wanted to
    > > > >> see if anyone has any experience with this or other software, or if
    > > > >> you think I should talk to someone like Computer Forensics NZ first,
    > > > >> or just if anyone can offer any other useful advice.
    > > > >>
    > > > >> Thanks a million
    > > > >
    > > > > Not an answer, but I think you should image it and work with that just to
    > > > > be safe.
    > > >
    > > > Indeed. Should be the first thing you do

    > >
    > > Why??? It will just be an image of a formatted disk. There is no way to
    > > read any underlying data (the image won't get that, so won't contain
    > > it).
    > >
    > > The main thing is to just ensure it is put in a PC as a non-master
    > > drive.

    >
    > No, no , no, no ,no you should do a sector image,
    > On a Mac using OSX you would do something like
    >
    > dd if=/dev/disk1 of=/dev/disk2
    >
    > or what ever the relevant disk IDs are.


    Shows you how much you know. dd doesn't do a full sector based image -
    just the boot sectors.

    You know what dd stands for? :)

    dd is pottentially a good file recovery program. I wouldn't use it as a
    sector based imager - because it isn't.

    ddrescue is a full sector based imager.

    dd can be very dangerous - and if the OP has not had experience with it,
    I would not recommend it.

    There are other much nicer (GUI) sector based imaging programs around -
    many commercial of course. I wouldn't use any of them though - as such
    an intensive read of the drive will only lessen the chance of data
    recovery. A few years back I used to deal with a data recovery dude in
    Palmy (Alan someone). He died of a heart attack a few years ago - so I
    don't deal with him anymore. He was good, *and* cheap (typically about
    $300 for a drive recovery - but it could be twice or three times that).
    I spoke to him on many occasions and his advice was NOT to (sector)
    image the drive. Just send it to him, with another new drive as big or
    bigger - and he'd send at least the latter back. I never got all the
    reasons from the dude about why it shouldn't be imaged - but one of them
    was a potentially bad controller. While the OP's HDD controller is
    probably good - it can't be ruled out entirely.

    The general technique I got from Allen (not sure that's his name now) -
    is that he would first examine the disk, dig in a bit. Try and find out
    what the problem is, based on the customer info and his initial
    forensics. Typically he never imaged the disk.

    Feel free to phone up some other data recovery specialists and ask them
    - they won't recommend you image the disk. And the probably won't image
    the disk if you send it to them. There is simply no need. For example,
    take Testdisk - it has backup functions on most of its write procedures.
    eg. you can save existing partition information before making changes.

    Here's an example page from their site...
    http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

    --
    Duncan.
     
    Dave Doe, Oct 8, 2010
    #10
  11. Nik Coughlin

    Dave Doe Guest

    In article <-september.org>,
    says...
    >
    > In article <>,
    > mer says...
    > >
    > > In article <-september.org>,
    > > Dave Doe <> wrote:
    > >
    > > > In article <>,
    > > > says...
    > > > >
    > > > > On 2010-10-06, Bret <> wrote:
    > > > > > On Tue, 5 Oct 2010 22:27:33 -0700 (PDT), Nik Coughlin wrote:
    > > > > >
    > > > > >> We got burgled today, great huh.
    > > > > >>
    > > > > >> My flatmate lost her laptop with years of work on it. Yeah, I know,
    > > > > >> backups right. She has some.
    > > > > >>
    > > > > >> She upgraded the hard disk some months ago and I have the old hard
    > > > > >> disk. It's been formatted but not used at all since being formatted.
    > > > > >>
    > > > > >> I'm able to see the files using a piece of software called SalvageData
    > > > > >> Mac:
    > > > > >>
    > > > > >> http://www.salvagedata.com/recovery-software/salvage-data-mac/
    > > > > >>
    > > > > >> It seems to work because I can browse files and it has a preview
    > > > > >> function which I've used to look at some of the images on the disk
    > > > > >> successfully.
    > > > > >>
    > > > > >> They want US$190 for a license to activate it before I can actually
    > > > > >> recover the data though. She's willing to pay it but first I wanted to
    > > > > >> see if anyone has any experience with this or other software, or if
    > > > > >> you think I should talk to someone like Computer Forensics NZ first,
    > > > > >> or just if anyone can offer any other useful advice.
    > > > > >>
    > > > > >> Thanks a million
    > > > > >
    > > > > > Not an answer, but I think you should image it and work with that just to
    > > > > > be safe.
    > > > >
    > > > > Indeed. Should be the first thing you do
    > > >
    > > > Why??? It will just be an image of a formatted disk. There is no way to
    > > > read any underlying data (the image won't get that, so won't contain
    > > > it).
    > > >
    > > > The main thing is to just ensure it is put in a PC as a non-master
    > > > drive.

    > >
    > > No, no , no, no ,no you should do a sector image,
    > > On a Mac using OSX you would do something like
    > >
    > > dd if=/dev/disk1 of=/dev/disk2
    > >
    > > or what ever the relevant disk IDs are.

    >
    > Shows you how much you know. dd doesn't do a full sector based image -
    > just the boot sectors.
    >
    > You know what dd stands for? :)
    >
    > dd is pottentially a good file recovery program. I wouldn't use it as a
    > sector based imager - because it isn't.
    >
    > ddrescue is a full sector based imager.
    >
    > dd can be very dangerous - and if the OP has not had experience with it,
    > I would not recommend it.
    >
    > There are other much nicer (GUI) sector based imaging programs around -
    > many commercial of course. I wouldn't use any of them though - as such
    > an intensive read of the drive will only lessen the chance of data
    > recovery. A few years back I used to deal with a data recovery dude in
    > Palmy (Alan someone). He died of a heart attack a few years ago - so I
    > don't deal with him anymore. He was good, *and* cheap (typically about
    > $300 for a drive recovery - but it could be twice or three times that).
    > I spoke to him on many occasions and his advice was NOT to (sector)
    > image the drive. Just send it to him, with another new drive as big or
    > bigger - and he'd send at least the latter back. I never got all the
    > reasons from the dude about why it shouldn't be imaged - but one of them
    > was a potentially bad controller. While the OP's HDD controller is
    > probably good - it can't be ruled out entirely.
    >
    > The general technique I got from Allen (not sure that's his name now) -
    > is that he would first examine the disk, dig in a bit. Try and find out
    > what the problem is, based on the customer info and his initial
    > forensics. Typically he never imaged the disk.
    >
    > Feel free to phone up some other data recovery specialists and ask them
    > - they won't recommend you image the disk. And the probably won't image
    > the disk if you send it to them. There is simply no need. For example,
    > take Testdisk - it has backup functions on most of its write procedures.
    > eg. you can save existing partition information before making changes.
    >
    > Here's an example page from their site...
    > http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step


    Sorry... I got a bit carried away and forgot to make the point I was
    gonna make.

    That being, data recovery is all about reading the disk's image. But
    that's not what whomever orginally said it, said. That you should take
    an image of the disk. As I replied, that will simply do an OS based
    image of a blank formatted disk (as that's the present condition of the
    disk).

    (That is, what I believe most people would read that as - as opposed to
    sector based reading - which is what most data recovery s/w will do).

    So yes, you *do* want to read the disk's image - that's what data
    recovery is all about - reading sector by sector / track by track -
    minimising the head movement (as opposed to an OS based attack, which
    will result in a FAT MFT read, and heading off into the file location,
    and back - and so forth.

    ddrescue (as opposed to dd) - would be a better approach - personally, I
    prefer Testdisk - it's easy to drive, and it works. (I used to use
    ddrescue).

    With Testdisk, you can try and read the old MFT/FAT/partition info - get
    it, and sector read and recover the data (no need to deeply analyse the
    entire disk). It's cool. (ddrescue can do the same IIRC).

    --
    Duncan.
     
    Dave Doe, Oct 8, 2010
    #11
  12. Nik Coughlin

    lizaright

    Joined:
    Jun 15, 2011
    Messages:
    1
    Mac operating system stores data in two file systems HFS or HFS+ file system. But sometimes you may lose data from Mac system because of many reasons including accidental deletion or software errors. In this case if backup copies are not available you can recover lost from Mac HFS or HFS+ partitions using HFS data recovery application.
     
    lizaright, Jun 15, 2011
    #12
  13. Nik Coughlin

    glasgowrecovery

    Joined:
    Jul 19, 2014
    Messages:
    1
    A hard drive may suffer a malfunction for a great number of reasons; these cross the spectrum from general degradation, to dropping the computer, mechanics coming into contact with any foreign substances or corrupt firmware; due to the complexity of the hardware, Hard Drive Data Recovery UK the list of possibilities is almost endless. As stated above, there are numerous reasons for hard drive malfunction; however,it may be that none of the above fit your case and your hard drive seems to have failed for no reason. We at Glasgow Data Recovery have the expertise and experience to identify and the issue and, using the best in data recovery tools, recover your personal data. While we may not always be able to identify the issue with your hard drive, you can rest assured that your data will be retrieved and returned in the most efficient way possible.
     
    Last edited by a moderator: Jul 22, 2014
    glasgowrecovery, Jul 19, 2014
    #13
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Author Tarun Tyagi
    Replies:
    0
    Views:
    729
    Author Tarun Tyagi
    Dec 29, 2004
  2. allen
    Replies:
    0
    Views:
    448
    allen
    Jan 19, 2004
  3. Digital Image Recovery
    Replies:
    1
    Views:
    1,274
  4. Author Tarun Tyagi
    Replies:
    1
    Views:
    5,654
    salvationxue
    Apr 3, 2009
  5. Digital Image Recovery

    Digital Image Recovery and Memory Stick Recovery; Recovery of Lost Photos

    Digital Image Recovery, Sep 10, 2004, in forum: Digital Photography
    Replies:
    0
    Views:
    1,123
    Digital Image Recovery
    Sep 10, 2004
Loading...

Share This Page