How to fetch data out of dumped .diskimage and .dss files?

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
amar
Posts: 2
Joined: 28 Dec 2014, 04:04

How to fetch data out of dumped .diskimage and .dss files?

#1 Post by amar »

I ran photorec on my OSX drive and I ended up with four files:

[*]f53789331.diskimage (59.8GB)
[*]f212235002.dss (11.8GB)
[*]report.xml (2.6kB)
[*]f169876700.mp3 (2.6 kB)

in a directory named recup_dir.1.

I had ran photorec on my main disk as I had mistakenly deleted a lot of data from my OSX user folder - including photos, videos, and other files.

Is there anyway I can salvage files from the files above mentioned?

I am linking report.xml - http://pastebin.com/cQ5kMqNa.

PS. To be honest I am not sure whether I had run photorec or testdisk. I had used one of the available tutorials. I had never used the software before that day.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: How to fetch data out of dumped .diskimage and .dss file

#2 Post by cgrenier »

Have you enable data compression (available since Mac OS X Snow Leopard 10.6) or logical volume encryption (known as FileVault 2, available since Mac OS X Lion 10.7) ? It may explain why no valid files has been recovered (3 false positives).

amar
Posts: 2
Joined: 28 Dec 2014, 04:04

Re: How to fetch data out of dumped .diskimage and .dss file

#3 Post by amar »

cgrenier wrote: FileVault .
Yes, I had enabled FireVault (the disk encryption). So, there is no way to get the data back?

I am not sure but how does it work? I mean when I ran the program I was logged into the system and hence the disks were decrypted.

Locked