HPS-recovery

[bos]

We got a 240GB SSD-drive from a waterdamaged MacBook (2010). The computer itself was full or rust and other kinds of corrosion, but somehow the drive managed to survive (corrosively speaking). I mirrored the drive (0 read errors) and launched DMDE to extract the contents, but alas it was not that simple. DMDE tells me that the filesystem is Unknown. Doing a raw scan I find a lot of jpegs and such, so the drive is not encrypted. I tried to do a HFS-rescan and it finds some fragments but not enough to rebuild the whole filesystem.

Is DMDE the culprit here, for not knowing how to handle this filesystem? What other tools can we try to rebuild the filesystem?

(It is cruical for the customer to get the full file hierarchy back. Carved photo files are useless for her, even if we manage to carve every single file out of the disk)

Attachments

Untitled3.png (11.29 KiB) Viewed 17798 times

[labtech]

I think R-Studio and R-Explorer/UFS Explorer would be better choices for Mac work.
Have you tried them yet? Same findings as DMDE?

[bos]

99% of our recoveries are from NTFS and DMDE is awesome for that so we have never had to bother buying other software.

I will take a look on R-studio / UFS and see what they say. Thanks for the tip.

[Alt(R-TT)]

I believe that the main culprit is the SSD drive itself.

[dick]

In this kind of scenario I would normally use UFS or R-Studio.
However one time I seem to remember I had a similar problem with a mac HFS recovery so I tried Reclaime Pro and got a 100% recovery with the full file system.
I never managed to work out why the other software couldn't handle it.

[bos]

I took a look at UFS Explorer but that software doesn't seem to be able to open from an UNC path or a network mapped drive, only local drives. If that's by design then that's a very bad design, because all our cloned disk-images are on a separate server that everyone works against using UNC / Samba so the software is pretty much useless.

Will see if I get any better luck with R-studio.

[lcoughey]

I've never had any issues opening images with UFS over a network connection.

[bos]

Maybe it's my fault then somehow, because the software does not respond to when I type B:\ (mapped drive), refuses to let me enter \\storage\clients in the open dialog and does not list anything else than the C / D-drives.

I also tried the R-studio demo and it managed to identify the drive as an APFS but only found a corrupt filesystem and suggested me to use "scan" to see if something's possible. Still waiting for it to finish.

[labtech]

Any update on the scan?

[bos]

Sorry, I forgot to update.

I have now tried R-Studio, DMDE, and hpfsrecovery and all give the same result: files can be rescued (some without correct names, most with), but the file structure cannot be rebuilt. Despite the drive giving no read errors when cloning it, somehow it seems that some data relevant to the file structures has gone FUBAR for reason unkown to us. Maybe some NAND-cells got killed because of the humidity, maybe some other factors, but if that's the case then we should most likely have had read errors while cloning. That's what confusing me here.

We had an idea that maybe it's possible to do a chip off-recovery and see if there are any older NAND-headers to use for rebuilding the structure, but given the customer's budget we are unsure if that's worth the time and efforts.

This kind of error is new to me, and I am definately stumped since I do not know the root cause for it. Humidity damage is my best guess, but I cannot verify it.

[labtech]

In the raw results of R-Studio, does it show files? Many? Any good? Also, time stamps on the files, any showing consistent with when the customer said the drive failed?

[HddDonorMarket]

I have 3 Tb drive. Customer have lost partitions doesnt know why. Drive health 100%. No phsical problem.
I have tried so many programs and MRT DE. All found some folders but not all folders in drive.
Just DMDE found customers unfound folders that more programs couldnt find.
I intend to buy DMDE .

Before I had another case. I have mounted ex partitions with DMDE. Same , other programs and MRT DE coulnt find that partitions.