HFS+ Repair / Data Recovery

[febrile42]

Hi all! First post -- advance apologies if I am posting this in the wrong place or in the wrong way. Please let me know what I'm doing wrong and I'll fix it.

I'm working with an Apple-branded Toshiba 500GB 2.5" drive (HDD2J62) from my friend's daughter's Macbook -- and having no luck getting at the data. I've had great luck using Debian to repair, mount, and recover data from myriad "broken" hard drives, but this one is stumping me, and I'm ready to point the finger square at HFS+. Thankfully this is not critical business data, but apparently there's quite a bit of college work stuck on this drive.

parted reports:

Code:

Model: TOSHIBA MK5065GSXF (scsi)
Disk /dev/sdc: 500GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number  Start   End    Size   File system  Name                  Flags
1      20.5kB  210MB  210MB  fat32        EFI system partition  boot
2      210MB   499GB  499GB  hfs+         Customer
3      499GB   500GB  650MB  hfs+         Recovery HD


It's a hard drive, hooray. Let's mount that second partition and get the data:

Code:

# mount -t hfsplus /dev/sdc2 usbdrive
mount: /dev/sdc2: can't read superblock


(Side notes: "usbdrive" -- I'm using a SATA to USB adapter. Also /dev/sdc3 mounts and shows the generic Apple recovery tools as expected.)

Oh. Okay, can we repair it at all?

Code:

# fsck -t hfsplus /dev/sdc2
fsck from util-linux 2.20.1
** /dev/sdc2
** Checking HFS Plus volume.
** Checking Extents Overflow file.
   Invalid leaf record count
   (It should be 425 instead of 453)
** Checking Catalog file.
   Invalid sibling link
(4, 34279)
** Volume check failed.


Oh dear. Maybe the hfs tools themselves will have better luck?

Code:

# hpfsck /dev/sdc2
*** Checking Volume Header:
Volume was not cleanly unmounted
Reserved attribute in use: 6000
Reserved attribute in use: 80000000
Volume was last Mounted by unknnown implemenatation:
kcsf
Invalid total blocks 743D818, expected 0                                       Done ***
*** Checking Backup Volume Header:
Unexpected Volume signature '  ' expected 'H+'
hpfsck: hpfsck: This is not a HFS+ volume (Unknown error -1)


And ... I'm stuck. Are there tools out there that have a shot at repairing this? As you probably noticed, I'm not afraid of CLI (or learning morning about HFS+/superblocks), but I don't know what to try next.

Any and all help is welcome -- thanks for reading!

[lcoughey]

Please tell me that you are working with a full sector-by-sector clone of the drive and not the original, right?

[febrile42]

Please tell me that you are working with a full sector-by-sector clone of the drive and not the original, right?

Hi Luke ... Of course, now that you mention it, that makes total sense. "Data recovery" in my world usually consists of mounting a drive and finding somewhere with enough room to copy the files -- please excuse my inexperience with professional recovery practices. All I've done to the drive so far is in my post above, so hopefully I haven't ruined any chance of getting the data.

Thanks!

[lcoughey]

I just posted a blog on my company website on the steps you should follow for every data recovery job...even if the drive appears to be healthy.

http://www.recoveryforce.com/data-recovery-process/

One of the main frustrations of data recovery professionals is that they are called on to clean up the mess because computer technicians blindly skip the first few steps and just try to recover data from failing hard drives...causing irreversible damage to the client's hard drive.

[febrile42]

Thanks for the link, Luke. If I find myself in a situation where data recovery services are likely needed, it's very helpful to know what not to do on my own.

Unfortunately for this drive, it will never meet a data recovery professional. As mentioned, this is a friend's daughter's drive out of her laptop. There is zero budget for data recovery; I'm just trying my best to help someone in need with the tools I have available -- including asking for help on a very knowledgeable forum.

[jono-ats]

You have to be able to differentially diagnose between a software / directory issue and a failing head or other hardware problem.

DiskWarrior will fix directory type issues. No software will fix a failing hard drive. Best practice is to clone the drive and work on the copy. Failing that, you can try DW but STOP if you get the message that the program is slowing down due to a hardware failure.

Jon

[lcoughey]

Thanks for the link, Luke. If I find myself in a situation where data recovery services are likely needed, it's very helpful to know what not to do on my own.

Unfortunately for this drive, it will never meet a data recovery professional. As mentioned, this is a friend's daughter's drive out of her laptop. There is zero budget for data recovery; I'm just trying my best to help someone in need with the tools I have available -- including asking for help on a very knowledgeable forum.

You have it all wrong. The link is what you must do if you choose to do it on your own.