I used data recovery 3 with the deep scan option when my hdd failed. It came up with a bunch of folders but no files were found; one stood out in particular: a folder named zip, and almost 5gb in size! I have tried and tried to unzip the files, but nothing works. (Actually the zip files unzip, but the bz2 and gz files will not)

this is on my macbook pro...








Please help!?

I don't work with Macs but, in general, this sort of result is not uncommon after doing a raw recovery (which I guess is what that software means by a "deep scan"). From your story, I'm not sure which of (a) or (b) applies:

(a) If you were not expecting to recover those bz2 and gz files, then they are just the mis-recognition of whatever file signature that recovery software uses, to try to recognise those types of file. I've seen this (lots of "phantom" compressed files incorrectly recognised) when someone tries to do a raw recovery of an encrypted disk.

(b) If you were expecting to recover those bz2 and gz files, and your only concern is that they cannot be opened, then they were fragmented on the disk, and a raw recovery (which doesn't use the filesystem) cannot follow the individual fragments of each file.

IMHO more background detail is needed about the original disk, original symptom(s), and a clear list of what you have done already and the results at each stage, for readers to better understand your situation and see if there is any further advice that can be offered.

I was running a macbook pro 15" mid 2010, and had a time machine backup configured to an external hdd (western digital 500gb).

Then my macbooks internal hdd failed.

Thinking that all my data was backed up to the external hdd, I replaced my macbooks internal hdd quickly and tossed the shot one.

Upon realizing I couldn't restore the time machine backup to my macbook (don't remember why) I ran the program data rescue 3 to retrieve my previous files on the external hdd.

That is when i got a list of gzip and bz2 files that i could not unzip....

Scratch that above.....




I was running a macbook pro 15" mid 2010, and had a time machine backup configured to a "my book essential usb 2.0" (western digital 500gb w/ preloaded backup software) ***I used time machine, not the preloaded software.

Then my macbooks internal hdd failed.

Thinking that all my data was backed up to "my book essential", I replaced my macbooks internal hdd quickly and tossed the shot one.

Before I could restore my macbook to its original state, i accidently snapped the usb port off "my book essential." I then ordered a new 3.5" external hdd enclosure and put it in there.

My macbook was not recognizing the external hdd (my book essential) and so i decided to run a program called data rescue 3.

Data rescue 3 brought me up a list of folders containing the one labeled "zip"...


Most of the folders contained files from the preloaded software(like images, thumbnails, etc)

The bulk of the files are shown as gzip and bz2 format.

So i think my question would be.... Are these files related to time machine's backup mechanism?


Sorry for not elaborating.... I now realize how vague I was before.

Thanks. Please let me know if you need more information.

Thanks for the info - the situation is now much clearer.


Assuming that you mean the drive has definitely been thrown away permanently, then that's a shame - it may have been recoverable by others, even if it wasn't recoverable by you. So focusing on the external drive...


That's exactly what I suspected - you can't do that (i.e. you can't "transplant" the internal SATA drive into another enclosure) with many of the external WD drives, and expect to be able to read the data from them. That's because the USB-SATA adapter board in many original WD enclosures would have been doing (transparent) encryption of your data, even if you didn't know about it. As I said before, I've seen similar results (i.e. lots of "phantom" compressed files being detected) by recovery software when the disk is encrypted. (The one part of the external disk that you are able to read correctly, is the small unencrypted part which contains the preloaded WD Smartware software.)


I expect your Macbook is recognising the drive itself, just not the data on the drive, and that's due to the encryption that I explained above. Using Data Rescue 3 is the wrong approach, as your data is encrypted and such recovery software will never recover it (i.e. decrypt it) into its original state.

This situation has been the subject of many previous threads here (try searching the forum for terms like encryption, encrypted and smartware) and many people who know these drives better than me have contributed their expert views in those previous threads, so please read them. There are a few different approaches - some try to minimise the risks of you making things worse, depending on the value of the data to you, your budget, your electronics skill, your expectations of support etc. I don't have time for a full reply, but I'll try to give a short summary - some other readers might give extra or alternative options...

If you still have that USB-SATA board from the original WD enclosure, then someone with suitable skills may be able to (even just temporarily) attach the USB connector for long enough to allow the data to be recovered. Ultimately you (or a DR company) will likely need to use a equivalent replacement USB-SATA board, to the one whose USB connector snapped off (which is a definite weak point of their design ), or use the original one after it's been repaired, to decrypt the data on the drive. Beware that there are many potential pitfalls in any DIY recovery approach and if you are unlucky or make a critical mistake, you might make things worse or even change a recoverable into a totally unrecoverable situation. If the data is valuable and you don't want to take risks, or you are unsure of your capabilities, or you need a quick result etc., then some of the DR pros on here would be able to recover your data. Your choice... Good luck!

Vulcan is totally correct, your data on the WD drive is encrypted.

You need to mend the original USB-SATA bridge board, or get an identical one.

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

+1.

Either repair the original MyBook enclosure or buy an identical one, and connect your drive to it. You should be good to go then.
There is no other way to do this.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

so i really screwed myself if my wd hard drive has been formatted, and i only have the folder with the reconstructed files?

...

I believe you meant to say Data Rescue 3 instead of Data Recovery 3.

However, there is another factor here - the time machine backup structure and how data is stored and so on, and then the role that plays when formatting. So, with everything that has happened and all this other stuff, mhhh, not quite sure what the best outcome would be.

Data Rescue is pretty good. It is likely as best of a result you can get, even as RAW data as in the Reconstructed Files.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

Yeah that is okay, the information wasn't all that important (besides some pictures). I just want to prevent future mistakes. So i have another question.


Currently I am running a desktop with a raid1 system hooked up via usb 3.0 (2tb seagate hds).

I am using EaseUs Todo Backup to backup my primary ssd (64gb) and a secondary drive (320gb) used for games.

I chose the option for a disk/partition backup scheduled on a regular incremental basis. (None of the drives are partitioned)

Is this the best way to go? For the reason of restoring my system if a drive fails? And how would i go about doing it?

Thanks.

RAID 1 is fine.

Personally, I do not trust automatic backups. I like to see things backing up with my eyes and then extremely important is to test the backup.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

Hi labtech, thanks for response. what do you mean automatic backups? and what programs offer "backing up with your eyes?"

Maybe I misinterpreted your plan, but scheduling an incremental backup sounds like an automatic process. I do not have confidence in the reliability and accuracy of software automatically creating backups. One does not know what it is doing, especially in unexpected situations.

As result, I am more comfortable with manual backup, me clicking on things.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

Totally agree on the manual initiation and selection of backups. If and when recovery time comes; you'll be confident you got the right datasets.

If you do anything automated, you need to test your results under a variety of scenarios.

_________________
On a clear disk you can seek forever.

thanks for the responses. i think i will switch over to the drag and drop option for backing up files. I would defintely feel a lot more comfortable with it.

I should add that the term "automated" can mean a lot of different things in various contexts. The whole point is to be on top of whatever your backup software is doing. Test it. Build confidence in it. Be sure you can restore from it.

Drag'n'drop for select files is easy to verify. But scheduled incremental imaging somewhat more difficult to verify. Selective parts of databases over a large network - just as bad. To use a phrase.

_________________
On a clear disk you can seek forever.