Data Recovery from a Mac disk

[Allen]

Hey all,

I have a friend who accidentally unplugged her Mac whilst working on it, now the Mac won't boot. I am assuming there are some damaged sectors on the drive and would like to assist in recovering the data on the drive.

I put the drive (Western Digital) into a PC and ran Data Lifeguard, SMART passes but both short and long tests fail immediately with the error "Completed: read failure". I couldn't get any software on the PC to read what was on the drive, despite using programs that claim to be able to read Mac drives (HFSExplorer, MacDrive etc). So I got Mac OS running on VMware Workstation and connected the drive via USB passthrough, but the software I tried first (Disk Drill, no idea if it's any good, was one of the first free options that came up from a Google search) ran for 15 hours and only showed 0.2% completion and advised it would take another 9 months to complete.

Does anyone have any other ideas on how to do this? What is a good piece of recovery software on Mac (free or reasonably priced, as long as it will work)? Other than sending it to a recovery specialist who are likely to charge several hundreds of pounds!

Cheers,

Allen

[b0redom]

Can you not get at any of the data on the disk when it's USB mounted at all? Sounds like it might be screwed if not. I'd recommend asking on Macrumors forums, they have a much larger userbase of Apple people than here.

Of course you could always recommend a restore from her Time Machine backup.

[peterb]

Unplugging it without powering down is unlikely to cause physical damage to the disk (unless the unplugging was the result of it falling off a desk)

If it is a recent Mac, the underlying OS is Unix based, using the hfs+ filesystem, which is fairly robust, but it is possible that the filesystem has become corrupt.

There is some guidance here

http://johnliu.info/mac/repair-apple...with-fsck_hfs/

Linux systems also have support for hfs+, and the tool, fsck.hfsplus (similar to other linux tools to check and repair the common linux filesystems) can be run on linux system.

I have not used fsck.hfsplus myself (although I do use fsck on my own system)

More info here

http://zzamboni.org/brt/2006/06/04/f...wto/index.html

[markwilliams279]

Use a Mac data recovery software to recover the lost data from your Mac OS.

[Kentker]

Just google search "Mac data recovery", it must be many of applications can do the job. I am using a iMac, but i have not had this issue, so i dont know how to do it.

[maggiemiao]

Hi, Allen,
I think you can search in google with data recovery mac to get an ideal tool which helps in recovering data from Mac drive. Personally, I think try Kvisoft Data Recovery for Mac which can help you recover deleted or lost files from your Mac drive.

[bytejunkie]

Of course you could always recommend a restore from her Time Machine backup.

unless its the TM backup thats corrupt, as in my situation.

unfortunately, fsck.hfs util can't fix it. and apple won't look at why the sparseimage got corrupted.

so do i feel confident in a time machine? no. i certainly wouldn't recommend it.

[peterb]

I've been looking at Time machine myself (as I have set up a time machine server on a Linux host). There is quite a lot going on in the background apart from the sparse image. You are not the first person I know who has had problems with TM backups - my own feeling is that keeping two TM backups is probably worthwhile - I keep my regular one on the linux box, but I have a separate 2.5" drive in a caddy and back up to that every week or so.

[b0redom]

Might be worth investing some time in SuperDuper - that generates a complete, bootable external drive.

[herulach]

this thread is pretty old, but whats wrong with a more sensible disk image + separate data partition backup strategy like you might use on a PC? Does that not work on macs for some reason?

[peterb]

TM does a graduated back up system on the grandfather/father/son model - doing a series of full and incremental backups. It backs up hourly on the current day, then retains the most recent daily back-up for seven days, and that data is held on a database. It can also be encrypted. The normal method of using TM is either an external disk via an airport device or OSX server software

So it is comprehensive, but does seem a bit fragile.

There is no reason why you couldn't do a manual back-up system on an Apple OSX PC, just as you would on a Windows based PC, but the whole point of TM is that it is automatic and transparent, I think it is run by a cron job in the background, but again I haven't looked into that aspect - my interest was setting up the server on my linux server.

[herulach]

TM does a graduated back up system on the grandfather/father/son model - doing a series of full and incremental backups. It backs up hourly on the current day, then retains the most recent daily back-up for seven days, and that data is held on a database. It can also be encrypted. The normal method of using TM is either an external disk via an airport device or OSX server software

So it is comprehensive, but does seem a bit fragile.

There is no reason why you couldn't do a manual back-up system on an Apple OSX PC, just as you would on a Windows based PC, but the whole point of TM is that it is automatic and transparent, I think it is run by a cron job in the background, but again I haven't looked into that aspect - my interest was setting up the server on my linux server.

Fair enough, I have my microserver pulling incremental backups of my data drives daily (full image is done monthly because it doesn't really change a lot) and image the OS drive pretty much everytime I change something significant. Since you've got effectively two nix machines anyway wouldn't you be better with just rsync & cron (thats what I use). Basically this script, http://www.mikerubel.org/computers/rsync_snapshots/ but operating on a remote filesystem mounted using samba (since theres no reliable equivalent to rsync for windows) and with the script modified to run hourly but only backup once/day and fail gracefully if it can't mount the fs (i.e. my main pc isn't on).

[peterb]

Yes, that would work, and rsync is installed on the Mac. However, that would be fine on my machine - however as all data is stored on the server anyway on a RAID system, and backed up to tape, it isn't an issue. It was an issue for my daughter backing up her macbook. I don't particularly want to start putting bespoke backup solutions on it, but using TM so it is seamless (i.e., when she connects to the network, it triggers the backup) has advantages. The only real snag is that the HFS+ filesystem can't be backed up using 'DUMP' but again I encourage her to copy important files manually to an ext3 volume which is backed up to tape. TM then becomes belt and braces.

That script looks quite elegant though!

[herulach]

Yes, that would work, and rsync is installed on the Mac. However, that would be fine on my machine - however as all data is stored on the server anyway on a RAID system, and backed up to tape, it isn't an issue. It was an issue for my daughter backing up her macbook. I don't particularly want to start putting bespoke backup solutions on it, but using TM so it is seamless (i.e., when she connects to the network, it triggers the backup) has advantages. The only real snag is that the HFS+ filesystem can't be backed up using 'DUMP' but again I encourage her to copy important files manually to an ext3 volume which is backed up to tape. TM then becomes belt and braces.

That script looks quite elegant though!

Tape? Did you get an old drive cheap - I looked at one a while ago on ebay, but the media seemed relatively expensive - we're way OT now I appreciate, but how many write cycles do you get? One of my offline HDDs is getting to the stage where I'd think about replacing it.

[peterb]

I use LTO, currently LTO2 but I've just acquired a used LTO4 drive. Works well and media isn't that expensive - cheaper than a hard drive and more robust! The LTO data suggests 250 full writes. Bear in mind it is a serpentine write process, so that is many hundreds of end to end passes. I append my backups so each backup is a full one and I only back up monthly, but obviously you would adjust that to your own requirement. http://en.wikipedia.org/wiki/Linear_Tape-Open


Going back towards the topic I found this explanation of TM, which is similar in concept to your backup script. http://pondini.org/TM/Works.html

[jamesrodey]

Here is the application which can recover almost everything from MAC hard drive. Go through Free trial version to recover data, in free version you can see the preview of recovered photos.
recoverfilesdata.com/mac-data-recovery-software.html