User avatar
pclab
Forum Moderator
Posts: 1601
Joined: Tue Jan 13, 2015 4:55 pm
Contact: Website Facebook

Recovery of HFS data

Wed Mar 22, 2017 6:32 pm

Hi Guys

A question please:

I have recovered a HFS+ HDD (imaged with only 250 bad sectors).
I can now see the files and folder using R-Studio, but after recovering them, the files don't open...
Can this be related with security of Apple?
But if so, I couldn't see the folder structure, right?
Any hints?

Thanks
www.pclab.com.pt
facebook.com/PCLAB.Assistencia.Tecnica

User avatar
300ddr
Data Recovery Novice
Posts: 55
Joined: Wed Mar 23, 2016 4:19 pm

Recovery of HFS data

Wed Mar 22, 2017 8:05 pm

Can't be encryption if you see file names AFAIK. What did you use to recover? You could try Data Rescue 4 and be sure to try adjusting allocation block layouts to see if any work.

User avatar
Bankole Oladoja
Experienced DR Tech
Posts: 322
Joined: Tue Jan 13, 2015 11:24 am
Location: Nigeria
Contact: Website Facebook Skype

Recovery of HFS data

Thu Mar 23, 2017 1:15 am

Be sure it's not a case of file overwritten... Someone might have dumped the unsuccessful recovery on the patient drive before binging it to you. Try a full scan of the image with R-Studio
Oladoja Bankole
Exclusive Data Recovery Lab. EDARLAB
Abuja, Nigeria.
http://www.edarlab.com
Tel: 08032419528

User avatar
pclab
Forum Moderator
Posts: 1601
Joined: Tue Jan 13, 2015 4:55 pm
Contact: Website Facebook

Recovery of HFS data

Thu Mar 23, 2017 5:50 am

For what I can see on PC3K utility, It indicates Lion File Vault. So, it's encrypted, right?

http://blog.acelaboratory.com/pc-3000-d ... crypt.html
www.pclab.com.pt
facebook.com/PCLAB.Assistencia.Tecnica

User avatar
Bankole Oladoja
Experienced DR Tech
Posts: 322
Joined: Tue Jan 13, 2015 11:24 am
Location: Nigeria
Contact: Website Facebook Skype

Recovery of HFS data

Thu Mar 23, 2017 7:50 am

pclab wrote:Source of the post Hi Guys
I can now see the files and folder using R-Studio, but after recovering them, the files don't open...
Can this be related with security of Apple?


If you are dealing with encryption, you are never gonna see any file structure or folder..
Oladoja Bankole
Exclusive Data Recovery Lab. EDARLAB
Abuja, Nigeria.
http://www.edarlab.com
Tel: 08032419528

michael chiklis
Data Recovery Novice
Posts: 109
Joined: Fri Jan 23, 2015 12:31 pm
Contact: Website

Recovery of HFS data

Fri Mar 24, 2017 5:33 am

If you have FileVault encryption, follow this guide:
https://derflounder.wordpress.com/2011/ ... oot-drive/

for safety, do first clone the drive before applying decryption on Mac command line.
I had similar case few months ago, and i was success.
I used virtual Mac OS machine (El Capitan) for this purpose.
Last edited by michael chiklis on Fri Mar 24, 2017 6:08 am, edited 2 times in total.

michael chiklis
Data Recovery Novice
Posts: 109
Joined: Fri Jan 23, 2015 12:31 pm
Contact: Website

Recovery of HFS data

Fri Mar 24, 2017 5:44 am

Bankole Oladoja wrote:Source of the post
pclab wrote:Source of the post Hi Guys
I can now see the files and folder using R-Studio, but after recovering them, the files don't open...
Can this be related with security of Apple?


If you are dealing with encryption, you are never gonna see any file structure or folder..


That's not really true, you could partially see folders and files structure if user forced to decrypt it while the drive was still working.
Probably his drive stopped to be detected while he was decrypting, this would explain partial FileVault decryption.

Return to “Logical Data Recovery & Data Recovery Software”

Who is online

Users browsing this forum: No registered users and 1 guest