Recovery formatted HFS+

Data recovery from Hard Disk Drives with logical problems

Moderator: Dmitriy_TS


antoniocangiano76
Newbie
Posts: 5
Joined: 04.05.19
Reputation: 0 / (0)

Recovery formatted HFS+

Postby antoniocangiano76 » 05.07.20, 21:58

Hi, I've a case with a HFS+ formatted drive and I'd like your opinion.
Disk (1Tb USB external with only user data, NO OS) was in hfs+ (round 1Tb full ) and client accidentally formatted it from disk utility on Mac.
Nothing else has been done. Disk was immediately delivered to my hands.
I tried :
1) Quick disk analisys. After a complete scan, it finds 5 hfs+ structure. No one of them contain user data.
2) RAW. It finds lot of 'Volume Header' but no one contain user data (I tried them with virtual partition).
3) GREP with only 2 keys for HFS+. IDEM
4) R-studio. Allow me to do a raw recovery with good results. BUT I NEED STRUCTURES....

Now the question ....
There is a way to recover original disk structure with folders and original file-names?
Or when an HFS+ disk is formatted, all structures are overwritten and RAW is the only chance?
I would never risk customer data proceeding by attempts so I also simulated with a laboratory disc. I copied some data and formatted but I can't go on.
Please help me
Bye

User avatar
d_d_recovery
New user
Posts: 71
Joined: 20.03.19
Reputation: 1 / (13)

Re: Recovery formatted HFS+

Postby d_d_recovery » 05.07.20, 23:16

Unfortunately this can happen with HFS. The best software I have found for rebuilding HFS is ReclaiMe. Try the demo version.

User avatar
d_d_recovery
New user
Posts: 71
Joined: 20.03.19
Reputation: 1 / (13)

Re: Recovery formatted HFS+

Postby d_d_recovery » 05.07.20, 23:17

The above is also assuming you have no bad sectors in the catalog file?


antoniocangiano76
Newbie
Posts: 5
Joined: 04.05.19
Reputation: 0 / (0)

Re: Recovery formatted HFS+

Postby antoniocangiano76 » 06.07.20, 09:04

Fortunately not, the disc is healthy.
I'd like to be able to rebuild HFS but I'm even more interested in understanding how it works.
Whether formatting results in a complete overwrite of :
- Volume Header (LBA 2) which contains informations and the location of the other metafiles.
- Allocation file. (like $bitmap) Keeps track of free and busy sectors.
- Catalog file. A B-Tree with files list with variable size records.
- others... (extents overflow , attributes, etc)
I think it is important to understand by formatting a disk (utility disk in HFS +) to what extent the file is overwritten.
If in Catalog file (following formatting) a very large area is overwritten, it is no point in talking about recovery with structure.
I will test on a lab record and report the results.
Thanks for recommending ReclaiMe, I will try the demo

User avatar
d_d_recovery
New user
Posts: 71
Joined: 20.03.19
Reputation: 1 / (13)

Re: Recovery formatted HFS+

Postby d_d_recovery » 06.07.20, 17:35

HFS is a very complex file system. Unlike NTFS which basically uses a table to store files, HFS uses inodes to make searching for files faster. Unfortunately when HFS is reformatted a lot of the old inode structure is replaced with new metadata. So the inode link to groups of files are overwritten.


antoniocangiano76
Newbie
Posts: 5
Joined: 04.05.19
Reputation: 0 / (0)

Re: Recovery formatted HFS+

Postby antoniocangiano76 » 06.07.20, 23:14

ok, only way for this case is RAW...or can I do more?

User avatar
d_d_recovery
New user
Posts: 71
Joined: 20.03.19
Reputation: 1 / (13)

Re: Recovery formatted HFS+

Postby d_d_recovery » 06.07.20, 23:19

Just try several scans with different software. One may get you some folder structure.


Return to “Data Extractor”

Who is online

Users browsing this forum: No registered users and 1 guest