3 replies to this topic

[MJD]

I have a mac book where the hard drive has failed and I was wondering how I could possibly recover the data. The drive is still functioning as I can test it and see a plethora of bad sectors. This is my first Mac, I have had hard drives fail before and have always used GetDataBack NTFS, but they do not have a version for HSF+. Any suggestions?

[lars77]

Try looking into using ddrescue & Testdisk. You will need to be somewhat comfortable using a Linux live disc, & will probably need at least 1 extra hard drive (plus one of those hard drive to USB adapters helps!). It's not exactly straightforward, on the other hand you'll get plenty of practice & will be able to recover all sorts of data once you know how

The idea is to use ddrescue to recover as much as you can from the failing hard drive before the drive completely dies, & write that data into an image file on another hard drive (preferably) or directly to another hard drive. Once you managed to recover what you could, you can use Testdisk to attempt further data recovery from the data you got via ddrescue, particularly if the drive partition(s) were messed up. After all that you can basically plug in the drive w/ the recovered data into a Mac (or try loading the fixed hard drive image file, not sure how to do that on a Mac) & see what data was recovered.

Some more info:
http://www.cgsecurit...maged_Hard_Disk

[MJD]

Thanks so much lars! Looks like I have found my weekend project! One question just to clarify... I assume you run Testdisk on the new drive that has all the copied information.. is that correct? Thanks again!

[lars77]

Yup, Testdisk would be run on whatever data you managed to recover with ddrescue.

You can run Testdisk on a hard drive directly, but I'd strongly recommend against that in your current case b/c you'd end up accidentally creating more bad sectors in the process. (the more you use the bad drive the more bad sectors are going to start popping up).. you prob already know that

(on the other hand, if you're ever dealing with a drive that had a bad system crash that wiped out the partition tables Testdisk would be able to fix that for you)

One other thing I forgot to mention, if the drive ends up being so scrambled that, even after Testdisk, you're not seeing anything when you plug it into your Mac, then another option is to try out Photorec on the recovered data. It'll basically try to find any readable files inside the recovered data & let you copy them somewhere else, similar to Recuva & other apps in that category. You usually won't get to that point, but mentioned it just in case.

For what it's worth, last time I did this I found this site useful:
http://www.forensics...g/wiki/Ddrescue
..they'll talk about using ddrescue to save the data into an image file, but if you're short on hard drives & USB adapters you can save the data directly to another drive as long as the other drive is big enough.