All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 2 posts ] 
Author Message
 Post subject: No files detected on MacBook w/ Windows through Parallels
PostPosted: November 11th, 2017, 13:36 
Offline

Joined: July 7th, 2014, 6:44
Posts: 192
Location: Switzerland
Hi,

We received a MacBook A1398 (2015) with liquid damage for data recovery.
Prior coming to us, the MacBook was sent by our customer to the online shop where it had purchased it.
The merchant way not providing data recovery service and hence the Macbook was sent back to our customer.

The 256 GB SSD in the MacBook that we received should be the original one (not a replacement).
It had some kind of dryied syrup drops when we received it and we cleaned them.
It was a little strange, because our customer told and confirmed to us that the damage occured with water, not syrup or so.
However, the MacBook was very dirty inside and the sticky nature of the drops could come from this dirt.
The SSD is a Samsung MZ-JPU256T/0A6.

The SSD is reachable, has GPT partitioning scheme and three partitions: 200 Mo, 232.96 Go and 650 Mo.
All three partitions are healthy.
(I assumed that the 3rd partition was the one for system recovery, but it may be wrong in this case.)

According to our client, the SSD was running Windows OS through Parallels and had no encryption as it would have bored him. He also told us that the drive should be fast full.

Two security clones of the whole SSD were done.

Despite having HFS+ for Windows from Paragon, the second partition doesn't mount on Windows, nor does the third partition.

Running ReclaiMe Ultimate doesn't detect any HFS+ file system after 20% scan, and only one file was found in RAW.
It's 4096 MB in size (4 GB) and starts with a "P69.-" signature.
I assume this file could be one component Parallels virtual hard drive system.
No JPEG or any other file could be found by ReclaiMe's file signatures database.

I understand Parallels as a virtual maching running from within Mac OS and using files for virtual drives.
So I hoped finding an HFS+ system. If I remember well, the second partition was shown as HFS+ by fdisk -l.

Should I scan 3rd partition hoping to find there MacOS, and extract from there the location of the virtual HDD?

I tried booting a PC from one of the two clones, to see if something happened but no operating system was found.


Top
 Profile  
 
 Post subject: Re: No files detected on MacBook w/ Windows through Parallel
PostPosted: November 12th, 2017, 9:17 
Offline
User avatar

Joined: July 12th, 2010, 4:38
Posts: 1418
Location: Portugal
Do you have another macbook/Apple?
You could try to connect the ssd to it using an adapter and try to see if it mounts there.

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 2 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 16 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group