HFS+ corrupted catalogue file

[SlingShot]

I find using R-Studio 8.1 to extract the data from the image usually works nicely however, when the partition has suffered corruption, extracting the data can be rather messy. The folder structure has gone into orbit and left behind tens of thousands of horribly named folders etc. The files contained within that structure are fine however its nightmare for the owner of the files to search them out and then reorganise them.

Question: is there a way to reconstruct the folder structures, maybe different software for data extraction, or is that as good as it gets ?

thanks in advance.

[omi786]

You can try UFS Explorer.

[SlingShot]

UFS doesn't come up with anything other than wrongly sized partitions. It can see a correctly sized raw partition containing errors though, but it does nothing with regards to recognising any file systems. At least R-Studio can get the data, albeit in a tangled mess

[labtech]

Tried PC3K DE?

[michael chiklis]

Clone the drive and try to fix tha catalog file with DiskWarrior.
Also, could it be that drive is partially encrypted with FileVault, if so then you should first decrypt it.

Don't decrypt and don't try to fix anything on source drive, work only on cloned drive. It's safer if you do a double clone and work only on that.

[merc88]

I find using R-Studio 8.1 to extract the data from the image usually works nicely however, when the partition has suffered corruption, extracting the data can be rather messy. The folder structure has gone into orbit and left behind tens of thousands of horribly named folders etc. The files contained within that structure are fine however its nightmare for the owner of the files to search them out and then reorganise them.

Question: is there a way to reconstruct the folder structures, maybe different software for data extraction, or is that as good as it gets ?

thanks in advance.

Was the platter scratched?

[SlingShot]

Tried PC3K DE?

At the moment I don't have a PC3K

Was the platter scratched?

I don't know as I haven't opened it up

Also, could it be that drive is partially encrypted with FileVault, if so then you should first decrypt it

What would show me if it was partially encrypted ?

[michael chiklis]

I had a case last year where customer hdd had a lot of bad sectors.
I cloned it on new drive, then i did scan clone drive in R-Studio but i could open only few files.
R-Studio also reported errors on filesystem when i tried to access into partition.

After a lot of working i found that drive was partially encrypted with FileVault, i really don't know why it was partially decrypted, i suppose that probably customer tried to unlock drive by disabling encryption but operation was interrupted at certain point due to bad surface.
This i think would explain partial decryption of a FileVault encrypted drive.
In my case, only files that were located in the first 50 GB of surface were readable but folder structure was all readable (no strange symbol on folders name).

After all i mounted clone drive into virtual machine with WMware, i emulated El Capitan OS, but partition was not readable by Mac OS, see pic:

Finally i decrypted all drive by following this guide:
https://derflounder.wordpress.com/2011/ ... oot-drive/

then i repaired few missing and damaged folders by using DiskWarrior.

All data were successfully recovered

[data-medics]

I've been finding that R-Explorer (the updated version of UFSExplorer) works really well for damaged HFS+. I actually bought their Tech license when I saw how good of results it got on a few cases I had where other software was struggling to make any sense of it.

And if all else fails, give Data Rescue 4 a spin and see what it finds. Just be sure to enable the advanced options as you sometimes have to adjust the partition starting offset to get data that actually opens.

[SlingShot]

Took a bit of time to get it ironed out but got it nailed in the end.

Cloned the disk image using the clone feature in data rescue 4 (my DDI was busy) and then used diskwarrior to repair its structure. Boom, done ! (took approx 10 hrs)

If I hadn't used diskwarrior on it, then extraction would have been the only option but it was taking 300GB's of data up to 2.7TB using both R-Studio and DR4 (loads of junk data).

Put in that effort only for the customer to call and say they have found back ups that would be sufficient for them and don't need it

Thanks for your help here.

[michael chiklis]

You welcome.
DiskWarrior is very good (not junk as chkdsk for windows), i'm sorry that your customer doesn't need data anymore.

[SlingShot]

You welcome.
DiskWarrior is very good (not junk as chkdsk for windows), i'm sorry that your customer doesn't need data anymore.

It is, your right, its very clever and Im glad its now in my toolbox
Not to worry about that customer, time to move onto the next customer who wants their data.