slingshot
Data Recovery Novice
Posts: 159
Joined: Fri Jul 21, 2017 7:26 pm

Recovery from Apple Fusion

Fri Nov 02, 2018 12:55 pm

Have had this case come in, DM has failed heads possibly with media damage but the SSD is functional.
Fusion setup of 128GB / 3 TB (ST3000DM001).

Not done one of these fusion recoveries before so not entirely sure how to go about stitching them back together once imaged etc.

Does anybody have any experience of these please ?

User avatar
Amarbir[CDR-Labs]
Data Recovery Pro
Posts: 507
Joined: Sat Jan 17, 2015 4:35 pm
Location: Chandigarh ,India
Contact: Website Skype

Recovery from Apple Fusion

Fri Nov 02, 2018 3:01 pm

Hello,
I See a Lot of Interesting Stuff Here -> https://www.youtube.com/channel/UCjeQEm ... -Han-11LgQ .BTW My suggestion is that you work on the 3TB first and only attempt this if te 3TB is Cloned ,These Models Are a Nightmare
Regards
Amarbir S Dhillon ,CDR Labs [ Chandigarh ,India ]
DataRecovery - The Affordable Way In India
Youtube Channel -> https://www.youtube.com/channel/UCbIeLFJWxTux8TQu_QSCsgQ?view_as=subscriber

datahaze
Data Recovery Novice
Posts: 76
Joined: Mon Jul 16, 2018 7:14 pm

Recovery from Apple Fusion

Fri Nov 02, 2018 9:01 pm

I had a similar case recently. R-Studio and PC-3000 RAID can both work with fusion drives, though in my case the FS/Partition table was damaged so R-studio didn't recognize it as a fusion drive. Luckily with Macs, file carving tends to work pretty well due to less fragmentation than NTFS. The SSD will only have the most frequently accessed files on it, the bulk of them will be on the HDD assuming they store more data than the SSD can hold.

Edit: If you can image both drives and don't have DR tools to re-build the Fusion drive, you can always attach both images to a Mac and make an image from the Disk Utility.

slingshot
Data Recovery Novice
Posts: 159
Joined: Fri Jul 21, 2017 7:26 pm

Recovery from Apple Fusion

Sat Nov 03, 2018 8:35 am

Amarbir[CDR-Labs] wrote:Hello,
I See a Lot of Interesting Stuff Here -> https://www.youtube.com/channel/UCjeQEm ... -Han-11LgQ .BTW My suggestion is that you work on the 3TB first and only attempt this if te 3TB is Cloned ,These Models Are a Nightmare


Thanks Amarbir, tried that but it doesn't seem to be very helpful in my case (not sure why yet)

slingshot
Data Recovery Novice
Posts: 159
Joined: Fri Jul 21, 2017 7:26 pm

Recovery from Apple Fusion

Sat Nov 03, 2018 8:46 am

datahaze wrote:I had a similar case recently. R-Studio and PC-3000 RAID can both work with fusion drives, though in my case the FS/Partition table was damaged so R-studio didn't recognize it as a fusion drive. Luckily with Macs, file carving tends to work pretty well due to less fragmentation than NTFS. The SSD will only have the most frequently accessed files on it, the bulk of them will be on the HDD assuming they store more data than the SSD can hold.

Edit: If you can image both drives and don't have DR tools to re-build the Fusion drive, you can always attach both images to a Mac and make an image from the Disk Utility.


I've only got the standard PC-3000 so thats not much use in this case of fusion rebuilding, however, I did try some things with R-Studio and it didn't reveal anything other than the 2 separate drives etc.

There is some strange goings on that Ive noticed though. The SSD is APFS yet the spinner is HFS+, I can only assume the customer has upgraded an OSX installation to High Sierra / Mojave and that has only converted the SSD side of things to APFS. I wonder if this is whats causing me some headache with it ? Can you marry up 2 different file systems ?

Im back in the office on Monday and will post some screen shots of the Mac utility with images attached, I did try to coerce the Mac to do some fusion mating but to no joy :lol:

I only need to get the iPhoto stack from the setup but its not on the SSD side of it as its way too small.

User avatar
Amarbir[CDR-Labs]
Data Recovery Pro
Posts: 507
Joined: Sat Jan 17, 2015 4:35 pm
Location: Chandigarh ,India
Contact: Website Skype

Recovery from Apple Fusion

Sun Nov 04, 2018 1:06 am

Well,
Thats what i said work on That POS 3TB first ,If you can make that work and clone it then we bother of al these ,The creater of UFS is great i can talk to him to help you incase you are interested but get that 3tb of its feet .75% it will have platter damage :mrgreen:
Regards
Amarbir S Dhillon ,CDR Labs [ Chandigarh ,India ]
DataRecovery - The Affordable Way In India
Youtube Channel -> https://www.youtube.com/channel/UCbIeLFJWxTux8TQu_QSCsgQ?view_as=subscriber

slingshot
Data Recovery Novice
Posts: 159
Joined: Fri Jul 21, 2017 7:26 pm

Recovery from Apple Fusion

Thu Nov 08, 2018 1:01 pm

So far I am losing this battle :(

Imaged the spinner on the 3K, head #2 is horrible but will read using the utility option, haven't read the entire platter for head #2 as it will take forever.

Imaged onto 4TB bare metal and set max LBA.

The partition on the spinner is messed up but partition analysis does give me a full file structure.

Screen Shot 2018-11-08 at 17.26.31.png


Recovering the user data from this doesn't give any errors. All file names, sizes etc. are fine, yet none of the files will open in their respective programs.

Try and use a Mac to see if it will give me any results from connecting both the SSD and the HDD.... Nothing, although I can boot from the SSD, log in etc. only basic data contained on the SSD. (I no longer have the original iMac so was using a MacBook Pro for this exercise, maybe part of the problem ?)

So, move onto this video and recovery explorer prohttps://www.youtube.com/watch?v=HIfx8xPH8D0

Imaged the SSD with RE pro (the SSD is healthy) and connected both drives to it

Screen Shot 2018-11-08 at 17.27.09.png


Followed instruction on the video but theres some options I am not presented with and also theres a difference in file systems :?

On the SSD I only have 2 partitions and not 3. Right clicking on the data partition (APFS) doesn't give me the option to open as a apple core storage volume so I can't make a virtual partition.

Screen Shot 2018-11-08 at 17.26.44.png


And the hex trick doesn't work either as I only have zeros at that address.

Screen Shot 2018-11-08 at 17.49.54.png


I am at a loss with this one and would appreciate any info pointing me in the direction of solving this beast.

Thanks guys.

datahaze
Data Recovery Novice
Posts: 76
Joined: Mon Jul 16, 2018 7:14 pm

Recovery from Apple Fusion

Thu Nov 08, 2018 2:00 pm

My guess is that the LBA's the HFS FS is saying files exist at only make sense when both drives are in the picture, hence why all the files are coming out garbage. You can always do carving.

slingshot
Data Recovery Novice
Posts: 159
Joined: Fri Jul 21, 2017 7:26 pm

Recovery from Apple Fusion

Thu Nov 08, 2018 2:09 pm

datahaze wrote:My guess is that the LBA's the HFS FS is saying files exist at only make sense when both drives are in the picture, hence why all the files are coming out garbage. You can always do carving.


You could be right, I re-read your original post and I will try to create an image (using utility) from both drives within OSX tomorrow.
I'm thinking I'll have to use high Sierra to do it as 1 volume is APFS.

What version of R-Studio do you use ? And are you using the Mac version of that to recognise 'fusion' drives ?

Edit:- what is carving, I don't know anything about such a term but am willing to try it :)

datahaze
Data Recovery Novice
Posts: 76
Joined: Mon Jul 16, 2018 7:14 pm

Recovery from Apple Fusion

Thu Nov 08, 2018 2:12 pm

slingshot wrote:
datahaze wrote:My guess is that the LBA's the HFS FS is saying files exist at only make sense when both drives are in the picture, hence why all the files are coming out garbage. You can always do carving.


You could be right, I re-read your original post and I will try to create an image (using utility) from both drives within OSX tomorrow.
I'm thinking I'll have to use high Sierra to do it as 1 volume is APFS.

What version of R-Studio do you use ? And are you using the Mac version of that to recognise 'fusion' drives ?


If you look at a particular file's record, you should be able to see the LBA range, if it's negative or beyond the range of that particular drive, it's most certainly what I'm describing here. Luckily HFS+ doesn't fragment much (not sure about APFS), so carving works well for it. I believe all versions of R-Studio should recognize fusion drives but I'm not 100% positive on that. You can always try the trial version on a Mac to see if it recognizes any differently.

Return to “Hard Drive Data Recovery”

Who is online

Users browsing this forum: No registered users and 0 guests