HFS file undelete - possible in version 7? Topic is solved

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
swinster
Posts: 4
Joined: 20 Aug 2012, 12:29

HFS file undelete - possible in version 7?

#1 Post by swinster »

Hi,

I have used TestRec/Photorec in the past, mainly in a few Windows disk and SD Cards, however, a friend has just come to me with a Mac (Intel based) which I know little about, a has suffered a SMART issue. The drive is SATA based but formatted as HFSPLUS. I can mount the drive when attached to a PC booted under a Linux environment (GParted) and I have used Clonezilla to take an image of the relevant data partition on the drive (although I think this is file based, not sector by sector). I have then been able to cat and mount the clonzilla image, which although appears as one large file the size of the original drive, I'm not sure if it actually will contain any "missing" data.

The file system has been screwed up somewhat to the point that the Mac will not boot. Looking at the file system from GParted shows a folder called "Recovered Items" which hold multiple (read hundreds of) other folders containing some data and some system files. Typically though, the data files they REALLY want aren't in these "Recovered Folders".

Will v7 of TestRec be able to look at HSF+ formatted drives and attempt file un-deletion? I don't think this is possible in v6.x but I can't see any documentation as yet WRT v7.

I suppose that the only other alternative would be to run PhotoRec (the file theat they want to recover happen to be Photo file).

Is it possible to take a full sector by sector based image of such a drive/partition and use the tools on that? If so, what to people recommend is the best method of doing this?

Cheers

Chris

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: HFS file undelete - possible in version 7?

#2 Post by cgrenier »

You can use gnu ddrescue to create an image of the disk or partition and next use PhotoRec on this image, several possibilities:
- Under Windows, select the image, righ-click, "Open with", select PhotoRec. There should be the equivalent under Mac.
- At the command line prompt (in a Terminal), enter the command "photorec" followed by the full filename of the image file.

swinster
Posts: 4
Joined: 20 Aug 2012, 12:29

Re: HFS file undelete - possible in version 7?

#3 Post by swinster »

Cheers cgrenier,

DDResure seemed to have made some thing, so just running Photorec now.

What about the Partition type - I'm guessing this should be MAC (as the original partition was HFS+) and there's a big warning saying DON'T select a type of NONE on a single partition.

swinster
Posts: 4
Joined: 20 Aug 2012, 12:29

Re: HFS file undelete - possible in version 7?

#4 Post by swinster »

Looks, like this has done the trick. Lots of things recovered, including I'm sure many thumbnails and the such.

Many thanks.

Locked