Professional Web Applications Themes

Recoving an accidentally erased, but almost UNTOUCHED (since) volume... - Mac Programming

About a year ago, I accidentally erased an 80GB HFS+ (MacOSX) volume (Drive Setup, MacOS9, NO low-level format) Knowing that was stupid, I haven't touched the disk since then, only to mount it (which has probably created a few catalog nodes and files somewhere in the mounting process, and I've run it through the Norton UnErase and Data Rescue mill a few times (DR only once - it took all night to scan the damn think!) Unfortunately, DR didn't come up with much - mainly a bunch of "nib,class,object" parts of application bundles, and almost none of the data files ...

  1. #1

    Default Recoving an accidentally erased, but almost UNTOUCHED (since) volume...

    About a year ago, I accidentally erased an 80GB HFS+ (MacOSX) volume
    (Drive Setup, MacOS9, NO low-level format) Knowing that was stupid, I
    haven't touched the disk since then, only to mount it (which has probably
    created a few catalog nodes and files somewhere in the mounting process,
    and I've run it through the Norton UnErase and Data Rescue mill a few
    times (DR only once - it took all night to scan the damn think!)

    Unfortunately, DR didn't come up with much - mainly a bunch of
    "nib,class,object" parts of application bundles, and almost none of the
    data files at all - there were a LOT of source files on the disk (other
    people's OSS, not mine fortunately)

    This seems kind of odd to me. As far as I can guess, not knowing
    exactly how the 'quick format' option in Drive Setup worked, I would
    imagine that the simplest thing it would do it to either destroy, or just
    disconnect the root node in the catalog, and extents B-Trees, and
    recreate a new root catalog and extent nodes, and that would render the
    disk seen as "empty" to anything looking at the trees to find files or
    free space.

    So, IF this is indeed what 'quick erase' does, and considering the disk
    has barely been touched in the past year - unless the mounting and
    attempted-recovery process (which should be read-only) hose other parts
    of the B-tree, it seems like the chances should be good that a program
    could scan for the first-level of the B-Trees, recreate a new root for
    each, and then go from there (then probably verify the whole thing to
    make sure no extents were lost).

    The drive had never been optimized, so I don't know how spread out the
    catalog itself would be (and doesn't HFS+ allocate clumps in a
    semi-random pattern across the disk to reduce fragmentation, instead of
    sequential allocation, which would leave the catalog spread all over the
    disk potentially?)

    Now, I don't know exactly how the B-Trees nodes are organized (or if
    HFS+ has other critical structures beyond just catalog and extents
    files/trees), so I don't know if it would be simple at all for a program
    could look at a block, determine if it was the beginning of a level-1
    node, and stick it on a stack to reconnect to a new root.

    I don't know if this question is more suited for mac.apps or a
    programming group, which is why I'm cross-posting. There doesn't seem to
    be a "Mac Volume Structure" group out there., so...

    Jim
    Jim Guest

  2. #2

    Default Re: Recoving an accidentally erased, but almost UNTOUCHED (since) volume...

    In article <c6reat$b8d$uits.indiana.edu>,
    Jim Witte <bloomington.nospam.in.spam.us> wrote:
     

    Sorry, you have very little hope of recovering much of anything from
    this drive. This is why a UNIX admin is only as good as his last
    backup. There may be tools out there that might recover stuff from a
    drive like Norton, but you've found them to be less than useful.

    At this point, I'd ask myself "How much is it worth it to me?" If it
    were really important, I'd find a Mac-knowledgable data recovery service
    and lay down the $$$$ to have the drive investigated. These companies
    don't promise they'll do much of anything, so be aware of that.

    Now, unless you're an experimentalist-type, you could try piecing
    together the volume yourself. Some people like replacing the entire
    drive train in their cars.

    My advise is to move on. The data is lost.

    --
    DeeDee, don't press that button! DeeDee! NO! Dee...



    Michael Guest

  3. #3

    Default Re: Recoving an accidentally erased, but almost UNTOUCHED (since)volume...

    Jim Witte wrote:
     

    I think your only realistic hope is to send it to a data recovery
    service. Pricey, but they'll get whatever's still there.

    -jcr
    John Guest

Similar Threads

  1. Replies: 2
    Last Post: August 30th, 08:41 PM
  2. Accidentally Saved A Collapsed Window???
    By Trey_Walsh@adobeforums.com in forum Adobe Indesign Macintosh
    Replies: 4
    Last Post: December 12th, 06:59 PM
  3. Choosing to install turns off laptop. HD is untouched.
    By Ted Mittelstaedt in forum FreeBSD
    Replies: 0
    Last Post: February 19th, 09:03 AM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139