All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 12 posts ] 
Author Message
 Post subject: HFS+ corrupted catalogue file
PostPosted: July 22nd, 2017, 12:25 
Offline

Joined: March 6th, 2017, 15:27
Posts: 53
Location: United Kingdom
I find using R-Studio 8.1 to extract the data from the image usually works nicely however, when the partition has suffered corruption, extracting the data can be rather messy. The folder structure has gone into orbit and left behind tens of thousands of horribly named folders etc. The files contained within that structure are fine however its nightmare for the owner of the files to search them out and then reorganise them.

Question: is there a way to reconstruct the folder structures, maybe different software for data extraction, or is that as good as it gets ?

thanks in advance.


Top
 Profile  
 
 Post subject: Re: HFS+ corrupted catalogue file
PostPosted: July 22nd, 2017, 14:59 
Offline

Joined: May 19th, 2010, 13:31
Posts: 80
You can try UFS Explorer.


Top
 Profile  
 
 Post subject: Re: HFS+ corrupted catalogue file
PostPosted: July 22nd, 2017, 15:48 
Offline

Joined: March 6th, 2017, 15:27
Posts: 53
Location: United Kingdom
UFS doesn't come up with anything other than wrongly sized partitions. It can see a correctly sized raw partition containing errors though, but it does nothing with regards to recognising any file systems. At least R-Studio can get the data, albeit in a tangled mess :lol:


Top
 Profile  
 
 Post subject: Re: HFS+ corrupted catalogue file
PostPosted: July 22nd, 2017, 22:00 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3274
Location: Massachusetts, USA
Tried PC3K DE?

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: HFS+ corrupted catalogue file
PostPosted: July 23rd, 2017, 2:58 
Offline

Joined: December 5th, 2011, 5:38
Posts: 1173
Location: Italy
Clone the drive and try to fix tha catalog file with DiskWarrior.
Also, could it be that drive is partially encrypted with FileVault, if so then you should first decrypt it.

Don't decrypt and don't try to fix anything on source drive, work only on cloned drive. It's safer if you do a double clone and work only on that.


Top
 Profile  
 
 Post subject: Re: HFS+ corrupted catalogue file
PostPosted: July 23rd, 2017, 3:25 
Offline

Joined: June 27th, 2017, 7:07
Posts: 15
Location: Malaysia
SlingShot wrote:
I find using R-Studio 8.1 to extract the data from the image usually works nicely however, when the partition has suffered corruption, extracting the data can be rather messy. The folder structure has gone into orbit and left behind tens of thousands of horribly named folders etc. The files contained within that structure are fine however its nightmare for the owner of the files to search them out and then reorganise them.

Question: is there a way to reconstruct the folder structures, maybe different software for data extraction, or is that as good as it gets ?

thanks in advance.


Was the platter scratched?


Top
 Profile  
 
 Post subject: Re: HFS+ corrupted catalogue file
PostPosted: July 23rd, 2017, 5:16 
Offline

Joined: March 6th, 2017, 15:27
Posts: 53
Location: United Kingdom
labtech wrote:
Tried PC3K DE?

At the moment I don't have a PC3K :(

merc88 wrote:
Was the platter scratched?

I don't know as I haven't opened it up

michael chiklis wrote:
Also, could it be that drive is partially encrypted with FileVault, if so then you should first decrypt it

What would show me if it was partially encrypted ?


Top
 Profile  
 
 Post subject: Re: HFS+ corrupted catalogue file
PostPosted: July 23rd, 2017, 8:00 
Offline

Joined: December 5th, 2011, 5:38
Posts: 1173
Location: Italy
I had a case last year where customer hdd had a lot of bad sectors.
I cloned it on new drive, then i did scan clone drive in R-Studio but i could open only few files.
R-Studio also reported errors on filesystem when i tried to access into partition.

After a lot of working i found that drive was partially encrypted with FileVault, i really don't know why it was partially decrypted, i suppose that probably customer tried to unlock drive by disabling encryption but operation was interrupted at certain point due to bad surface.
This i think would explain partial decryption of a FileVault encrypted drive.
In my case, only files that were located in the first 50 GB of surface were readable but folder structure was all readable (no strange symbol on folders name).

After all i mounted clone drive into virtual machine with WMware, i emulated El Capitan OS, but partition was not readable by Mac OS, see pic:
Attachment:
not readable drive in mac virtual machine.jpg
not readable drive in mac virtual machine.jpg [ 163.81 KiB | Viewed 2591 times ]


Finally i decrypted all drive by following this guide:
https://derflounder.wordpress.com/2011/ ... oot-drive/

then i repaired few missing and damaged folders by using DiskWarrior.

All data were successfully recovered :)


Top
 Profile  
 
 Post subject: Re: HFS+ corrupted catalogue file
PostPosted: July 23rd, 2017, 12:21 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1872
Location: Providence, RI
I've been finding that R-Explorer (the updated version of UFSExplorer) works really well for damaged HFS+. I actually bought their Tech license when I saw how good of results it got on a few cases I had where other software was struggling to make any sense of it.

And if all else fails, give Data Rescue 4 a spin and see what it finds. Just be sure to enable the advanced options as you sometimes have to adjust the partition starting offset to get data that actually opens.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: HFS+ corrupted catalogue file
PostPosted: July 25th, 2017, 13:53 
Offline

Joined: March 6th, 2017, 15:27
Posts: 53
Location: United Kingdom
Took a bit of time to get it ironed out but got it nailed in the end.

Cloned the disk image using the clone feature in data rescue 4 (my DDI was busy) and then used diskwarrior to repair its structure. Boom, done ! (took approx 10 hrs)

If I hadn't used diskwarrior on it, then extraction would have been the only option but it was taking 300GB's of data up to 2.7TB using both R-Studio and DR4 (loads of junk data).

Put in that effort only for the customer to call and say they have found back ups that would be sufficient for them and don't need it :evil: :evil:

Thanks for your help here.


Top
 Profile  
 
 Post subject: Re: HFS+ corrupted catalogue file
PostPosted: July 25th, 2017, 16:20 
Offline

Joined: December 5th, 2011, 5:38
Posts: 1173
Location: Italy
You welcome.
DiskWarrior is very good (not junk as chkdsk for windows), i'm sorry that your customer doesn't need data anymore.


Top
 Profile  
 
 Post subject: Re: HFS+ corrupted catalogue file
PostPosted: July 25th, 2017, 16:55 
Offline

Joined: March 6th, 2017, 15:27
Posts: 53
Location: United Kingdom
michael chiklis wrote:
You welcome.
DiskWarrior is very good (not junk as chkdsk for windows), i'm sorry that your customer doesn't need data anymore.

It is, your right, its very clever and Im glad its now in my toolbox :D
Not to worry about that customer, time to move onto the next customer who wants their data.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 12 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 28 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group