Recovery from Apple Fusion

slingshot

Member
Screen Shot 2018-11-08 at 19.29.07.png
These LBA's are positive and within range of the drive (5 billion left after these)

I've got the network version of R-Studio on the 3K rig and I've also got the Mac version on the MacBook Pro.
Both of them just see both drives as independent drives, I haven't tried to create a virtual partition or anything.

Screen Shot 2018-11-08 at 19.23.45.png
Although R studio can't see the APFS partition as APFS ?

How do I carve files from these ?
 

datahaze

Member
If you select the disks and do "scan" and "search for known file types", it will show a separate item that looks like a partition called "recognized files". That's the carved files. Photorec is also a good tool for this, which is free.
 

slingshot

Member
datahaze":ktuxk449 said:
If you select the disks and do "scan" and "search for known file types", it will show a separate item that looks like a partition called "recognized files". That's the carved files. Photorec is also a good tool for this, which is free.

Is this in R-Studio ?
 

slingshot

Member
ok cool, its only giving me a raw recovery option however testing a few jpegs and they open without issues. I'll try the photorec program and see how that gets on. Would you expect to get the files out as RAW data in a case like this ?
 

datahaze

Member
If the fusion drive can't be re-assembled then yes, I'd expect file carving to get back at least some of the data. JPGs will recover pretty well, other file formats work less well for file carving. On HFS I'd say ballpark you'd be getting back 70-80% of the JPGs but this is very dependent on fragmentation.
 

slingshot

Member
Its better than nothing LoL, at least this is an option when all else fails.

Not sure how well it would work when they want their Lightroom stuff or iPhoto stuff.... RAW is ugly :D :D :D

I will try the HFS+ spinner in R-Studio on the Mac tomorrow, I'm sure that version can see APFS. That may give me a file structure rather than RAW.

Thanks for your help getting this far though ;) Using the 3K for imaging was good but DE produced shite files.
 

Jared

Administrator
Staff member
Looks to me that the fusion was broken somehow. Most often I see this when they had gone to the Apple store first and the idiot tech there ended up formatting it or trying to re-install the OS on the SSD only (since the HDD isn't responding, only the SSD will be affected).

In Recovery Explorer can you browse and open files on just the SSD? My guess is they did something to the SSD.
 

slingshot

Member
Jared":2mu2vokx said:
Looks to me that the fusion was broken somehow. Most often I see this when they had gone to the Apple store first and the idiot tech there ended up formatting it or trying to re-install the OS on the SSD only (since the HDD isn't responding, only the SSD will be affected).

In Recovery Explorer can you browse and open files on just the SSD? My guess is they did something to the SSD.

Really wouldn't surprise me, they are dim, although they like to send work my way so can't complain too much :)

In Recovery Explorer the file structure is weird though, most of the data is inside the untitled folder.

Screen Shot 2018-11-08 at 22.53.08.png

Ive opened a lot of pics and pdf's with no problems off the SSD

I've since installed the latest R-Studio on the 3k rig and after the file carving it can see the APFS partitions now.

Screen Shot 2018-11-08 at 22.59.50.png

If I open the recognised 4 partition (untitled) I get a proper file structure as would expect to see in a Mac OS directory

Screen Shot 2018-11-08 at 23.05.05.png

I wish I could fathom out how to stitch these drives back together. I was doing some reading on R-Studio's pages about 'core storage' volumes and they make a lot of noise on how they are supported but there seems to be no info on how to use their product to go about re-creating the fusion drive. I'm going to try again tomorrow but with both drives on a Mac and see if R-studio can actually do anything with them. I like the UFS guys video of creating a virtual partition and extracting all the files but I just can't get that going on at all :(
 
Top