How to determine if drive has core storage

Data recovery from Hard Disk Drives with logical problems

Moderator: Dmitriy_TS


osity
User
Posts: 338
Joined: 06.12.15
Reputation: 4 / (38)

How to determine if drive has core storage

Postby osity » 17.11.18, 17:52

I'm imaging a MAC drive but platter 1 is in bad shape with loads of paltter damage. The other 3 heads read fine. After imaging all sectors with working heads and getting as much as possible with H1, I still have no file structure in DE, so I exported the data and ran a logical scan. I get a FAT, Exfat, RAW, and HFS+ partition. In the HFS+, FAT and RAW I find tons of TV shows, but not the files the client is after.
The HFS+ partition shows no user data at all. Could this be because it's got core storage? If this is the case, is the client out of luck, since it's not possible to completely image the core storage volume?
Last edited by osity on 28.12.18, 04:30, edited 2 times in total.

User avatar
DataMedics
Advanced user
Posts: 545
Joined: 15.12.15
Reputation: 16 / (157)

Re: How to determine if drive has core storage

Postby DataMedics » 18.11.18, 03:50

PC-3000 doesn't support core storage. Try mounting the task and see if the core storage is explorable with other data recovery software like R-Studio or Recovery Explorer.


Dmitriy_TS
Site Admin
Posts: 297
Joined: 01.04.13
Reputation: 8 / (75)

Re: How to determine if drive has core storage

Postby Dmitriy_TS » 26.12.18, 12:59

PC-3000 supports Core Storage. It can be either FileVault or Fusion.
To determine it please use RAW recovery, if you find nothing in RAW recovery it means that drive has FileVault and you need to enter FV password.
With best regards
ACELab technical support
ts.acelaboratory.com
blog.acelaboratory.com


osity
User
Posts: 338
Joined: 06.12.15
Reputation: 4 / (38)

Re: How to determine if drive has core storage

Postby osity » 26.12.18, 20:13

DataMedics wrote:Source of the post Try mounting the task and see if the core storage is explorable with other data recovery software like R-Studio


Data medics;
I essentially did that when I exported the data onto an external drive and scanned it on another machine. I’m assuming you have r-studio installed on your pc-3000 machine?

User avatar
DataMedics
Advanced user
Posts: 545
Joined: 15.12.15
Reputation: 16 / (157)

Re: How to determine if drive has core storage

Postby DataMedics » 28.12.18, 02:45

R-Studio, Recovery Explorer, UFSExplorer, Reclaime Pro, and pretty much every other data recovery program out there that's worthwhile.

You need a wide variety of tools to be successful in this business.


osity
User
Posts: 338
Joined: 06.12.15
Reputation: 4 / (38)

Re: How to determine if drive has core storage

Postby osity » 28.12.18, 03:58

Data medics, that wasn’t the point of my question, I have all those programs. I asked if you have the programs installed on your PC 3000 machine, I was just curious, as I do not.

I use a separate machine for logical scans if needed, that’s why I mentioned that I exported the data in my first post.

You asked me to mount the task (I’m assuming in the pc3000). Is this somehow different than exporting it to a drive ?

Also, are you confusing core storage with APFS? The PC-3000 does not support APFS.
Last edited by osity on 28.12.18, 04:36, edited 10 times in total.


osity
User
Posts: 338
Joined: 06.12.15
Reputation: 4 / (38)

Re: How to determine if drive has core storage

Postby osity » 28.12.18, 04:19

Dmitriy_TS, is it possible for a client to have a Core Storage volume without using the File Vault/Fusion options?
If so, can PC-3000 still view the file system using DE?

User avatar
DataMedics
Advanced user
Posts: 545
Joined: 15.12.15
Reputation: 16 / (157)

Re: How to determine if drive has core storage

Postby DataMedics » 28.12.18, 23:38

osity wrote:Source of the post I asked if you have the programs installed on your PC 3000 machine


Yes, all of them. You never know when you'll need to mount a task and analyze with a different program.


Dmitriy_TS
Site Admin
Posts: 297
Joined: 01.04.13
Reputation: 8 / (75)

Re: How to determine if drive has core storage

Postby Dmitriy_TS » 24.01.19, 10:14

osity wrote:Source of the post I asked if you have the programs installed on your PC 3000 machine, I was just curious, as I do not.


You can find CS structures in RAW recovery and manually add partitions for either FileVault (encrypted) or Fusion. But PC-3000 usually detects and mount it automatically.

osity wrote:Source of the post Is this somehow different than exporting it to a drive ?


We recommend to do all operations in Data Extractor.

osity wrote:Source of the post Also, are you confusing core storage with APFS? The PC-3000 does not support APFS.


CS is some kind of volume manager. HFS+ and APFS are file systems, it's a common case when CS has APFS inside. Also, I'd like to say that APFS will be supported in the next release.
With best regards
ACELab technical support
ts.acelaboratory.com
blog.acelaboratory.com


Doomer
New user
Posts: 54
Joined: 24.06.14
Reputation: 2 / (22)

Re: How to determine if drive has core storage

Postby Doomer » 24.01.19, 18:16

Dmitriy_TS wrote:Source of the post
osity wrote:Source of the post , it's a common case when CS has APFS inside.

This is very unlikely
APFS has its own container, Fusion and encryption


osity
User
Posts: 338
Joined: 06.12.15
Reputation: 4 / (38)

Re: How to determine if drive has core storage

Postby osity » 24.01.19, 19:40

Dmitriy_TS wrote:Source of the post APFS will be supported in the next release.

:thumbup:


Dmitriy_TS
Site Admin
Posts: 297
Joined: 01.04.13
Reputation: 8 / (75)

Re: How to determine if drive has core storage

Postby Dmitriy_TS » 29 minutes ago

Doomer wrote:Source of the post APFS has its own container, Fusion and encryption

You are right! My mistake.
With best regards
ACELab technical support
ts.acelaboratory.com
blog.acelaboratory.com


Return to “Data Extractor”

Who is online

Users browsing this forum: No registered users and 1 guest