All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 11 posts ] 
Author Message
 Post subject: HPS-recovery
PostPosted: December 1st, 2019, 4:44 
Offline

Joined: October 20th, 2014, 5:25
Posts: 108
Location: Sweden
We got a 240GB SSD-drive from a waterdamaged MacBook (2010). The computer itself was full or rust and other kinds of corrosion, but somehow the drive managed to survive (corrosively speaking). I mirrored the drive (0 read errors) and launched DMDE to extract the contents, but alas it was not that simple. DMDE tells me that the filesystem is Unknown. Doing a raw scan I find a lot of jpegs and such, so the drive is not encrypted. I tried to do a HFS-rescan and it finds some fragments but not enough to rebuild the whole filesystem.

Is DMDE the culprit here, for not knowing how to handle this filesystem? What other tools can we try to rebuild the filesystem?

(It is cruical for the customer to get the full file hierarchy back. Carved photo files are useless for her, even if we manage to carve every single file out of the disk)


Attachments:
Untitled.png
Untitled.png [ 105.33 KiB | Viewed 673 times ]
Untitled2.png
Untitled2.png [ 18.92 KiB | Viewed 673 times ]
Untitled3.png
Untitled3.png [ 11.29 KiB | Viewed 673 times ]
Top
 Profile  
 
 Post subject: Re: HPS-recovery
PostPosted: December 1st, 2019, 5:25 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3351
Location: Massachusetts, USA
I think R-Studio and R-Explorer/UFS Explorer would be better choices for Mac work.
Have you tried them yet? Same findings as DMDE?

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: HPS-recovery
PostPosted: December 1st, 2019, 5:44 
Offline

Joined: October 20th, 2014, 5:25
Posts: 108
Location: Sweden
99% of our recoveries are from NTFS and DMDE is awesome for that so we have never had to bother buying other software.

I will take a look on R-studio / UFS and see what they say. Thanks for the tip.


Top
 Profile  
 
 Post subject: Re: HPS-recovery
PostPosted: December 2nd, 2019, 5:33 
Offline

Joined: February 19th, 2011, 11:05
Posts: 271
Location: Toronto
I believe that the main culprit is the SSD drive itself.

_________________
Data recovery, backup, protection.
R-Tools Technology, Inc


Top
 Profile  
 
 Post subject: Re: HPS-recovery
PostPosted: December 2nd, 2019, 6:52 
Offline

Joined: January 8th, 2008, 5:21
Posts: 889
Location: uk
In this kind of scenario I would normally use UFS or R-Studio.
However one time I seem to remember I had a similar problem with a mac HFS recovery so I tried Reclaime Pro and got a 100% recovery with the full file system.
I never managed to work out why the other software couldn't handle it.


Top
 Profile  
 
 Post subject: Re: HPS-recovery
PostPosted: December 2nd, 2019, 8:56 
Offline

Joined: October 20th, 2014, 5:25
Posts: 108
Location: Sweden
I took a look at UFS Explorer but that software doesn't seem to be able to open from an UNC path or a network mapped drive, only local drives. If that's by design then that's a very bad design, because all our cloned disk-images are on a separate server that everyone works against using UNC / Samba so the software is pretty much useless.

Will see if I get any better luck with R-studio.


Top
 Profile  
 
 Post subject: Re: HPS-recovery
PostPosted: December 2nd, 2019, 9:59 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2253
Location: Ontario, Canada
I've never had any issues opening images with UFS over a network connection.

_________________
Luke
RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: HPS-recovery
PostPosted: December 2nd, 2019, 10:05 
Offline

Joined: October 20th, 2014, 5:25
Posts: 108
Location: Sweden
Maybe it's my fault then somehow, because the software does not respond to when I type B:\ (mapped drive), refuses to let me enter \\storage\clients in the open dialog and does not list anything else than the C / D-drives.

I also tried the R-studio demo and it managed to identify the drive as an APFS but only found a corrupt filesystem and suggested me to use "scan" to see if something's possible. Still waiting for it to finish.


Top
 Profile  
 
 Post subject: Re: HPS-recovery
PostPosted: December 6th, 2019, 8:42 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3351
Location: Massachusetts, USA
Any update on the scan?

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: HPS-recovery
PostPosted: December 6th, 2019, 8:59 
Offline

Joined: October 20th, 2014, 5:25
Posts: 108
Location: Sweden
Sorry, I forgot to update.

I have now tried R-Studio, DMDE, and hpfsrecovery and all give the same result: files can be rescued (some without correct names, most with), but the file structure cannot be rebuilt. Despite the drive giving no read errors when cloning it, somehow it seems that some data relevant to the file structures has gone FUBAR for reason unkown to us. Maybe some NAND-cells got killed because of the humidity, maybe some other factors, but if that's the case then we should most likely have had read errors while cloning. That's what confusing me here.

We had an idea that maybe it's possible to do a chip off-recovery and see if there are any older NAND-headers to use for rebuilding the structure, but given the customer's budget we are unsure if that's worth the time and efforts.

This kind of error is new to me, and I am definately stumped since I do not know the root cause for it. Humidity damage is my best guess, but I cannot verify it.


Top
 Profile  
 
 Post subject: Re: HPS-recovery
PostPosted: December 6th, 2019, 9:26 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3351
Location: Massachusetts, USA
In the raw results of R-Studio, does it show files? Many? Any good? Also, time stamps on the files, any showing consistent with when the customer said the drive failed?

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 11 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 10 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group