All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 14 posts ] 
Author Message
 Post subject: Data recovery from dmg file from failed ssd
PostPosted: November 25th, 2017, 7:20 
Offline

Joined: November 25th, 2017, 6:41
Posts: 8
Location: Norway
Hello! My first post :D

- Failed crucial ssd for macbook pro
- Ssd had encryption (I have the passwords)
- I manage to do a raw recovery wich is a dmg file of the intire ssd
- I no longer have this ssd
- I am not 100% sure if the file extention was dmg when I recovered it with stellar recovery ( I might have changed to try to mount it, but I can't remember)

This is a long time ago, but due to someone proffesional was able to recover another failed ssd with same system by clone it to a new hard drive, that was accessable from my macbook. This makes me believe I can recover this if I can clone it over to a new hard drive.

- Tried restoring the dmg file to a new hard drive from disk utility: "Could not validate source - Invalid argument"

So my questions is:
1. How do I clone it over the new hard drive?
2. There probably was bad blocks on the ssd. Is this something that is relevant with the dmg file?

I appologize if my questions are kinda dumb. I'm kinda new with this stuff.
However if anyone can help me I would really apriciate it!


Top
 Profile  
 
 Post subject: Re: Data recovery from dmg file from failed ssd
PostPosted: November 26th, 2017, 11:12 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI
Have you tried just renaming the file back to .dmg and double click it on a Mac computer?

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Data recovery from dmg file from failed ssd
PostPosted: November 26th, 2017, 11:24 
Offline

Joined: November 25th, 2017, 6:41
Posts: 8
Location: Norway
Yes it says "image not regognised". The ssd was not able to mount when I cloned it.


Top
 Profile  
 
 Post subject: Re: Data recovery from dmg file from failed ssd
PostPosted: November 26th, 2017, 14:39 
Offline

Joined: November 25th, 2017, 6:41
Posts: 8
Location: Norway
I'm pretty sure I need to clone it to an harddrive and make it bootable somehow, so I can enter my password. Or else I would not get access to anything cos it's encrypted. Is this possible when the image is not recognised or is it just a waste of time trying?


Top
 Profile  
 
 Post subject: Re: Data recovery from dmg file from failed ssd
PostPosted: November 26th, 2017, 14:44 
Offline

Joined: January 8th, 2008, 5:21
Posts: 925
Location: uk
I think I would download an evaluation version of UFS Explorer Pro on to a Windows computer and attempt to scan your image file for any partitions. I would have thought any partitions on the ssd would show even if the partitions contain encrypted data.


Top
 Profile  
 
 Post subject: Re: Data recovery from dmg file from failed ssd
PostPosted: November 27th, 2017, 10:49 
Offline

Joined: November 25th, 2017, 6:41
Posts: 8
Location: Norway
Thanks for the help! This program has a mac version also, but I have windows os aswell if that is better to use.

It was not in the list, but I added it by using "open storage". Only 0,01GB partition (the dmg file is 1tb). See attached image.

Anything I can do with this?


Attachments:
File comment: Screenshot
Screen Shot 2017-11-27 at 15.40.57.png
Screen Shot 2017-11-27 at 15.40.57.png [ 203.5 KiB | Viewed 10443 times ]
Top
 Profile  
 
 Post subject: Re: Data recovery from dmg file from failed ssd
PostPosted: November 27th, 2017, 11:10 
Offline

Joined: November 9th, 2006, 15:15
Posts: 2983
Can you view the content of the file with a hex editor to check that it looks OK in that it is populated with hex data? I guess it was encrypted with File-vault and its likely that the encrypted partition is not the first partition (generally it is the second of 3 partitions) and it wont be viewable in UFS this way, but assuming the encrypted partition is OK but partition information is bad, no host system will even know the partition exists. Can you view sector 1 and 2 in hex editor and see any useful data? Usually the second sector contains data about any partitions present including whether filevault is active on any.


Top
 Profile  
 
 Post subject: Re: Data recovery from dmg file from failed ssd
PostPosted: November 27th, 2017, 11:11 
Offline

Joined: November 25th, 2017, 6:41
Posts: 8
Location: Norway
Then content on this partition is flash player. I remember the data recovery company said something about trying to install flash on the ssd to make something apear. I guess I must have copied it after they gave up. In hex view it is pretty much 99% zeros.


Top
 Profile  
 
 Post subject: Re: Data recovery from dmg file from failed ssd
PostPosted: November 27th, 2017, 11:57 
Offline

Joined: November 25th, 2017, 6:41
Posts: 8
Location: Norway
It is 99% zeros. The partition is a flash player the data recovery company tried to install btw.

Is this what you where looking for?


Attachments:
Screen Shot 2017-11-27 at 16.49.40.png
Screen Shot 2017-11-27 at 16.49.40.png [ 30.23 KiB | Viewed 10370 times ]
Screen Shot 2017-11-27 at 16.24.38.png
Screen Shot 2017-11-27 at 16.24.38.png [ 99.11 KiB | Viewed 10370 times ]
Screen Shot 2017-11-27 at 16.27.23.png
Screen Shot 2017-11-27 at 16.27.23.png [ 64.22 KiB | Viewed 10370 times ]
Screen Shot 2017-11-27 at 16.48.58.png
Screen Shot 2017-11-27 at 16.48.58.png [ 101.6 KiB | Viewed 10370 times ]
Top
 Profile  
 
 Post subject: Re: Data recovery from dmg file from failed ssd
PostPosted: November 27th, 2017, 15:21 
Offline

Joined: November 25th, 2017, 6:41
Posts: 8
Location: Norway
It is pretty much just zeros. except a few places like this:


Attachments:
File comment: 2
Screen Shot 2017-11-27 at 16.27.47.png
Screen Shot 2017-11-27 at 16.27.47.png [ 66.6 KiB | Viewed 10398 times ]
File comment: 1
Screen Shot 2017-11-27 at 16.27.23.png
Screen Shot 2017-11-27 at 16.27.23.png [ 64.22 KiB | Viewed 10398 times ]
Top
 Profile  
 
 Post subject: Re: Data recovery from dmg file from failed ssd
PostPosted: November 28th, 2017, 4:37 
Offline

Joined: January 8th, 2008, 5:21
Posts: 925
Location: uk
Erik9999 wrote:
Then content on this partition is flash player. I remember the data recovery company said something about trying to install flash on the ssd to make something apear. I guess I must have copied it after they gave up. In hex view it is pretty much 99% zeros.
I have to say that's crazy!
Have you scanned through the rest of the drive looking for traces of data? You would be looking for large blocks of hex in the hex editor.


Top
 Profile  
 
 Post subject: Re: Data recovery from dmg file from failed ssd
PostPosted: November 28th, 2017, 5:33 
Offline

Joined: November 9th, 2006, 15:15
Posts: 2983
Erik9999 wrote:
It is pretty much just zeros.


the entire image file is mostly zeros? If this is the case then your data is not recoverable as it is not written here. Also, partition tables is not correct and do not reflect the structure you would expect.

There is an interesting article about what you should see here: http://forensicsfromthesausagefactory.b ... apple.html

It is never good practice to write to the patient device during any recovery attempts, so I cannot see any real reason why this would have been or any real need for it. Also, this is not the result of installing an application this is a new logical partition created - maybe its possible this data was already present on the destination medium and the attempted image never actually transferred any content?

You said you no longer have the original SSD - is there no possibility to get it back?


Top
 Profile  
 
 Post subject: Re: Data recovery from dmg file from failed ssd
PostPosted: November 30th, 2017, 10:32 
Offline

Joined: November 25th, 2017, 6:41
Posts: 8
Location: Norway
dick wrote:
Erik9999 wrote:
Then content on this partition is flash player. I remember the data recovery company said something about trying to install flash on the ssd to make something apear. I guess I must have copied it after they gave up. In hex view it is pretty much 99% zeros.
I have to say that's crazy!
Have you scanned through the rest of the drive looking for traces of data? You would be looking for large blocks of hex in the hex editor.


I have scrolled through it it is just occationally small blocks of hex.

hddguy wrote:
Erik9999 wrote:
It is pretty much just zeros.


the entire image file is mostly zeros? If this is the case then your data is not recoverable as it is not written here. Also, partition tables is not correct and do not reflect the structure you would expect.

There is an interesting article about what you should see here: http://forensicsfromthesausagefactory.b ... apple.html

It is never good practice to write to the patient device during any recovery attempts, so I cannot see any real reason why this would have been or any real need for it. Also, this is not the result of installing an application this is a new logical partition created - maybe its possible this data was already present on the destination medium and the attempted image never actually transferred any content?

You said you no longer have the original SSD - is there no possibility to get it back?


Thanks for the article!

Not sure. All I was told was that they tried to install flash player on my ssd to see if something would apear or smth. I guess they created this partition.

I could allways try. I sent it back to crucial in exchange for a new ssd long time ago. I will send them a email and ask.


Top
 Profile  
 
 Post subject: Re: Data recovery from dmg file from failed ssd
PostPosted: November 30th, 2017, 15:33 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI
Sounds to me that the data was T.R.I.M.ed out. Probably when the SSD failed it went nuts wiping all the data.

That having been said, it's not uncommon for an Apple drive to have the data spread out all across the entire drive, even if it's only 5% full. So it may look vary sparse and mostly like zeros, but you'll be surprised how much you find when you actually scan for data.

that tiny partition you see is just a system one. It's unnecessary. Most likely the data partition starts at sector 409640 or possibly 35520 but you won't be able to do much with R-Explorer since it can't work with FileVault. You'll probably have to rebuild the partition table manually so that MacOS or R-Studio actually thinks there's a filevault partition there and you have option to input a password.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 14 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 21 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group