Page 1 of 1

Recovery of HFS data

Posted: Wed Mar 22, 2017 6:32 pm
by pclab
Hi Guys

A question please:

I have recovered a HFS+ HDD (imaged with only 250 bad sectors).
I can now see the files and folder using R-Studio, but after recovering them, the files don't open...
Can this be related with security of Apple?
But if so, I couldn't see the folder structure, right?
Any hints?

Thanks

Recovery of HFS data

Posted: Wed Mar 22, 2017 8:05 pm
by 300ddr
Can't be encryption if you see file names AFAIK. What did you use to recover? You could try Data Rescue 4 and be sure to try adjusting allocation block layouts to see if any work.

Recovery of HFS data

Posted: Thu Mar 23, 2017 1:15 am
by Bankole Oladoja
Be sure it's not a case of file overwritten... Someone might have dumped the unsuccessful recovery on the patient drive before binging it to you. Try a full scan of the image with R-Studio

Recovery of HFS data

Posted: Thu Mar 23, 2017 5:50 am
by pclab
For what I can see on PC3K utility, It indicates Lion File Vault. So, it's encrypted, right?

http://blog.acelaboratory.com/pc-3000-d ... crypt.html

Recovery of HFS data

Posted: Thu Mar 23, 2017 7:50 am
by Bankole Oladoja
pclab wrote:Source of the post Hi Guys
I can now see the files and folder using R-Studio, but after recovering them, the files don't open...
Can this be related with security of Apple?


If you are dealing with encryption, you are never gonna see any file structure or folder..

Recovery of HFS data

Posted: Fri Mar 24, 2017 5:33 am
by michael chiklis
If you have FileVault encryption, follow this guide:
https://derflounder.wordpress.com/2011/ ... oot-drive/

for safety, do first clone the drive before applying decryption on Mac command line.
I had similar case few months ago, and i was success.
I used virtual Mac OS machine (El Capitan) for this purpose.

Recovery of HFS data

Posted: Fri Mar 24, 2017 5:44 am
by michael chiklis
Bankole Oladoja wrote:Source of the post
pclab wrote:Source of the post Hi Guys
I can now see the files and folder using R-Studio, but after recovering them, the files don't open...
Can this be related with security of Apple?


If you are dealing with encryption, you are never gonna see any file structure or folder..


That's not really true, you could partially see folders and files structure if user forced to decrypt it while the drive was still working.
Probably his drive stopped to be detected while he was decrypting, this would explain partial FileVault decryption.