cgsecurity.org

Hi,

I have used TestRec/Photorec in the past, mainly in a few Windows disk and SD Cards, however, a friend has just come to me with a Mac (Intel based) which I know little about, a has suffered a SMART issue. The drive is SATA based but formatted as HFSPLUS. I can mount the drive when attached to a PC booted under a Linux environment (GParted) and I have used Clonezilla to take an image of the relevant data partition on the drive (although I think this is file based, not sector by sector). I have then been able to cat and mount the clonzilla image, which although appears as one large file the size of the original drive, I'm not sure if it actually will contain any "missing" data.

The file system has been screwed up somewhat to the point that the Mac will not boot. Looking at the file system from GParted shows a folder called "Recovered Items" which hold multiple (read hundreds of) other folders containing some data and some system files. Typically though, the data files they REALLY want aren't in these "Recovered Folders".

Will v7 of TestRec be able to look at HSF+ formatted drives and attempt file un-deletion? I don't think this is possible in v6.x but I can't see any documentation as yet WRT v7.

I suppose that the only other alternative would be to run PhotoRec (the file theat they want to recover happen to be Photo file).

Is it possible to take a full sector by sector based image of such a drive/partition and use the tools on that? If so, what to people recommend is the best method of doing this?

Cheers

Chris

You can use gnu ddrescue to create an image of the disk or partition and next use PhotoRec on this image, several possibilities:
- Under Windows, select the image, righ-click, "Open with", select PhotoRec. There should be the equivalent under Mac.
- At the command line prompt (in a Terminal), enter the command "photorec" followed by the full filename of the image file.

Cheers cgrenier,

DDResure seemed to have made some thing, so just running Photorec now.

What about the Partition type - I'm guessing this should be MAC (as the original partition was HFS+) and there's a big warning saying DON'T select a type of NONE on a single partition.

Looks, like this has done the trick. Lots of things recovered, including I'm sure many thumbnails and the such.

Many thanks.