Recovery of HFS data

[pclab]

Hi Guys

A question please:

I have recovered a HFS+ HDD (imaged with only 250 bad sectors).
I can now see the files and folder using R-Studio, but after recovering them, the files don't open...
Can this be related with security of Apple?
But if so, I couldn't see the folder structure, right?
Any hints?

Thanks

 

[300ddr]

Can't be encryption if you see file names AFAIK. What did you use to recover? You could try Data Rescue 4 and be sure to try adjusting allocation block layouts to see if any work.

 

[Bankole Oladoja]

Be sure it's not a case of file overwritten... Someone might have dumped the unsuccessful recovery on the patient drive before binging it to you. Try a full scan of the image with R-Studio

 

[pclab]

For what I can see on PC3K utility, It indicates Lion File Vault. So, it's encrypted, right?

http://blog.acelaboratory.com/pc-3000-d ... crypt.html

 

[Bankole Oladoja]

[post]7389[/post] Hi Guys
I can now see the files and folder using R-Studio, but after recovering them, the files don't open...
Can this be related with security of Apple?

If you are dealing with encryption, you are never gonna see any file structure or folder..

 

[michael chiklis]

If you have FileVault encryption, follow this guide:
https://derflounder.wordpress.com/2011/ ... oot-drive/

for safety, do first clone the drive before applying decryption on Mac command line.
I had similar case few months ago, and i was success.
I used virtual Mac OS machine (El Capitan) for this purpose.

 

[michael chiklis]

[post]7397[/post]

[post]7389[/post] Hi Guys
I can now see the files and folder using R-Studio, but after recovering them, the files don't open...
Can this be related with security of Apple?

If you are dealing with encryption, you are never gonna see any file structure or folder..

That's not really true, you could partially see folders and files structure if user forced to decrypt it while the drive was still working.
Probably his drive stopped to be detected while he was decrypting, this would explain partial FileVault decryption.