All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 6 posts ] 
Author Message
 Post subject: Problems trying to recover a HFSPlus partition
PostPosted: April 14th, 2021, 19:36 
Offline

Joined: February 15th, 2011, 22:05
Posts: 3
Location: New Zealand
I'm trying to recover data from a 500GB HFSPlus partition of a 1.5TB drive with two partitions.

This partition doesn't show up on macOS Disk Utility or Windows Disk Management. My initial attempt was to fix with testdisk and mount it, without success.

Then I followed a Technibble article to use ddrescue in Parted Magic to create an image. ddrescue didn't report any problems, zero read errors, zero bad sectors, zero bad areas. But I couldn't mount the image on Parted Magic*.

I then tried to use R-Studio on Windows, it also failed to mount the image**. I used the scan feature and it only found 26 files, most blocks were left under the unrecognised category. I tried to open the small recovered image files but nothing was rendered and I couldn't check the big ones because I'm using the demo version.

So I have two questions:

1. Is there anything else I can try? I'm completely out of ideas now.

2. WTH happened with this disk? I also lost another disk and I believe these happened because they were USB powered and turned off every time my notebook slept. But I'm surprised that R-Studio was only able to recover 26 files, is it the kind of thing that damages disks so much and no data gets recognized? It looks strange to me that ddrescue didn't report any bad sectors when creating the image.

Additional information:
* - Trying to mount the image on Parted Magic:
Code:
root@PartedMagic:/media/sda2# mount -t hfsplus -o loop,ro fatty500gb.img mountpoint > mount.txt
mount: /media/sda2/mountpoint: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error.

dmesg after trying to mount:
Code:
[ 1890.236622] loop0: detected capacity change from 894661248 to 0
[ 1890.248081] hfsplus: Filesystem was not cleanly unmounted, running fsck.hfsplus is recommended.  mounting read-only.
[ 1890.248300] hfsplus: invalid extent max_key_len 56433
[ 1890.248337] hfsplus: failed to load extents file

** - When trying to mount the image in R-Studio Windows:
Code:
Error          File System    14/04/2021     10:56:09 PM    $extentsFile: unexpected node type 82 at file header
Error          File System    14/04/2021     10:56:09 PM    $extentsFile: file is not valid
Error          File System    14/04/2021     10:56:09 PM    $attributesFile: unexpected node type 119 at file header
Error          File System    14/04/2021     10:56:09 PM    $attributesFile: file is not valid

Something else that's off: R-Studio reports the partition as having 201MB, the rest of the space is "Empty Space27" (no file system). Maybe I screwed something up when using testdisk.

Thank you!


Top
 Profile  
 
 Post subject: Re: Problems trying to recover a HFSPlus partition
PostPosted: April 15th, 2021, 12:13 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
Did you try with ReclaiMe and UFS?

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Problems trying to recover a HFSPlus partition
PostPosted: April 15th, 2021, 14:40 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
Examine the image file with a hex editor (eg HxD, freeware). If you drag the vertical scrollbar from top to bottom, do you see a lot of zeros?

Is your drive a WD Passport? These drives are affected by TRIM.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Problems trying to recover a HFSPlus partition
PostPosted: April 15th, 2021, 15:00 
Offline

Joined: May 21st, 2007, 16:10
Posts: 1592
Location: Gothenburg/ Sweden
Did you just image the partition or the whole drive? Is the drive internal or external? If you don't get more than 26 files when you scan that can indicate of an encryption.

_________________
Rescue IT Datarecovery service Sweden
Rescue IT Dataräddning Göteborg AB
http://www.rescue-it.se


Top
 Profile  
 
 Post subject: Re: Problems trying to recover a HFSPlus partition
PostPosted: April 18th, 2021, 23:27 
Offline

Joined: February 15th, 2011, 22:05
Posts: 3
Location: New Zealand
Thank you all for your replies, it really means a lot to me.

fzabkar wrote:
Examine the image file with a hex editor (eg HxD, freeware). If you drag the vertical scrollbar from top to bottom, do you see a lot of zeros?

Is your drive a WD Passport? These drives are affected by TRIM.

I used UFS to view hex contents of the image and indeed more than 80% is zeros.
It is an external WD Passport HDD. I don't know much about how trim can affect HDDs, what can I do in this case?

mr_spokk wrote:
Did you just image the partition or the whole drive? Is the drive internal or external? If you don't get more than 26 files when you scan that can indicate of an encryption.

It's just a partition image of an external HDD. I may be wrong but I don't think I used encryption, it was a plain HFS+ format.

Arch Stanton wrote:
Did you try with ReclaiMe and UFS?

I tried UFS multiple times without luck, for some reason it's not working, it just goes back to the start scan screen after the scan is finished, I never get to see the results. I'll try ReclaiMe when I'm on Windows.


Top
 Profile  
 
 Post subject: Re: Problems trying to recover a HFSPlus partition
PostPosted: April 23rd, 2021, 14:37 
Offline

Joined: May 21st, 2007, 16:10
Posts: 1592
Location: Gothenburg/ Sweden
mr_spokk wrote:
Did you just image the partition or the whole drive? Is the drive internal or external? If you don't get more than 26 files when you scan that can indicate of an encryption.

Roberto_sc wrote:
It's just a partition image of an external HDD. I may be wrong but I don't think I used encryption, it was a plain HFS+ format.

Passport drives use encryption by default for the speed-up of datatransfer...could be a problem with that as you you don't see any real data when scanning the drive.
But as you said that 80% of the drive contained zeros, that could indicate TRIM....if you had more then 20% of data to begin with...if not I would take it to someone that has DR tools that can do a full drive clone and take out the keys from the firmware and setup the drive in that tools.

_________________
Rescue IT Datarecovery service Sweden
Rescue IT Dataräddning Göteborg AB
http://www.rescue-it.se


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 81 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group