R-Studio: Data Recovery from an Erased HFS or HFS+ Disk

Apple computers running Mac OS use the HFS/HFS+ file system. This file system is a proprietary file system developed by Apple. Windows systems cannot read or write to HFS/HFS+ disks without third party software. Linux systems can read from HFS disks, but they cannot write to them. For internal system disks used on a Mac, the file system will always be HFS/HFS+. Likewise, if you have an external disk that is only used for Apple computers, it's highly likely that it is an HFS or HFS+ device.

To demonstrate how R-Studio recovers data from an HFS or HFS+ disk, we'll walk you through a typical data recovery scenario for a Mac. In this case, we'll be working with an HFS+ hard drive that has been formatted.

Before We Begin
If you are following along our procedure with your own data recovery scenario, it's important to make sure that your situation is similar enough to our test case. Make sure to check the following before proceeding:

The drive you are attempting to recover is a disk with an erased HFS/HFS+ partition.
This article only applies to HFS/HFS+ formatted devices.

Your disk is in good physical condition
We presume that your disk is in good physical shape. If not, it's best to seek out the services of a professional data recovery specialist. Beyond checking that the cables are firmly connected, any "do it yourself" data recovery efforts may actually worsen your chances of recovering the data if your disk has a serious physical malfunction. Signs that a disk has a physical failure include:

  • The system does not recognize the device at all, or it appears with an unusual or garbled name.
  • A S.M.A.R.T. (Self-Monitoring, Analysis and Reporting Technology) utility warns that a severe hardware failure event has occurred. R-Studio can check S.M.A.R.T. conditions of your disk, and we explain how to do that below.
  • The hard drive makes unusual noises, clicks, or takes a very long time to spin up and initialize.
  • Bad blocks continually appear on the drive.

All these cases are best handled by qualified data recovery professionals. They have special equipment, software, and, most importantly, the required skills to work with such drives. Neither R-Studio nor other data recovery software will help you in such cases. Moreover, any further tampering with such a drive will very likely inflict more damage to your data. Quite often, such damage will render the data completely irrecoverable, even by a data recovery professional.

And one last reminder...
Do not write anything on the disk from which you're going to recover data! The new data may overwrite your old files, and you may lose them for good.

Test Disk Setup: Initial Folder Structure and Files on the Drive
For our test disk, we set up a drive with a number of different file types in various folders.

Documents:

  • Archives: .zip files created in WinZip
  • PDFs: .pdf files created in Adobe Acrobat
  • Microsoft Office: .doc and .docx files created in Word; .xls and .xlsx files created in Excel
  • OpenOffice: .odt and .docx files created in Writer; .ods and .xlsx files created in Calc

Multimedia:

  • Music: .mp3 files
  • Pictures: .jpg and .png files
  • Video: .avi, .flv, .m4v, .mov, .mp4, .mpeg, .mts, and .mkv files.

The root folder of the test disk is shown in Fig. 1.
Data_Recovery_After_Erase_HFS_01.png
Fig.1: Root folder of the test disk
Click image to enlarge

After setting up the files, we erased the disk using the Disk Utility in the Mac OS X. Upon doing this, the disk will initially appear completely blank.

Data recovery process
Preliminary preparation:

  • Before you begin, prepare a storage place large enough to store all recovered files. It may be any disk visible by the operating system including an external or network drive. Do not try to save the files on the same disk from which the files are being recovered.
  • If you haven't already, download and install R-Studio. Right now, it is not necessary to buy and register the program. R-Studio in its demo mode allows you to perform all the necessary data recovery operations, except saving the recovered files. This lets you see if it can successfully recover your files and therefore, if it's worth buying. You will not have to re-install or restart R-Studio to register it.
    Note: Note: We'll use the Mac version of R-Studio to show the data recovery process, but these directions are fully applicable to the Linux and Windows versions of R-Studio. The panels and dialog boxes will have a different look and feel, but the functionality is the same.

1. Connect the disk to the computer running R-Studio.

Tip: Disk scans and data recovery operations can take a long time to process, particularly if the capacity of the disk is very large. For this reason, it's important to use the fastest interface available. Thunderbolt is the fastest interface, followed by eSATA, USB 3.0, and FireWire. Many external drives will have one or more of these interfaces. USB 2.0, while most common, is the slowest interface and may not be sufficient for larger disks.

2. Start R-Studio and locate the erased disk and the disk where the recovered files will be stored. In our case this is the computer's main disk.
Data_Recovery_After_Erase_HFS_02.png
R-Studio main panel with the erased disk
Click image to enlarge

Before proceeding, check the S.M.A.R.T. attributes for the reformatted disk:

  • If the health status is CAUTION, there may be minor problems with the disk, but it should be safe to use the disk for data recovery purposes. The problems are likely to worsen, so check the S.M.A.R.T. parameters periodically to ensure that the health status hasn't gone to BAD. Creating an image of the disk is recommended, but this will require additional storage space.
  • If the health status is BAD, the disk conditions are critical and chances of hardware failure are high. The best recommendation for this case is to stop working with the disk and bring it to professional data recovery specialists. You may continue to work with the disk at your own risk, but disk imaging is very strongly recommended.

If the S.M.A.R.T. attributes of the disk are OK, we can start data recovery.

3. Select the connected disk and click the Scan button. The Scan dialog box will appear.
Data_Recovery_After_Erase_HFS_03.png
Fig.3: Disk scan dialog box
Click image to enlarge

Since we know the file system we are trying to recover from, we can improve R-Studio's results and performance by specifying the file system of the connected disk. Click the Change... button next to File Systems and leave only the HFS file system selected.

Tip: Check "Save to File" and specify a save location to save the scan information. This is useful if you want to recover data in multiple sessions, or if you are scanning a large disk and expect interruptions. When you save the scan information, you can stop the scan and resume from the spot where you left off in the next session.

4. Check that the Extra search for Known File Types option is selected and click the Known File Types... button.
Data_Recovery_After_Erase_HFS_04.png
Fig.4: Known File Types dialog box
Click image to enlarge

Specify only those file types that you believe resided on the erased disk. The best way to do that is to click the Clear button and then select the necessary types in the list. Then click the OK button and return to the Scan dialog box. Click the Scan button.

5. R-Studio will start scanning the disk showing the progress.
Data_Recovery_After_Erase_HFS_05.png
Fig.5: Disk scan in progress
Click image to enlarge

6. Inspect the scan results and find the recognized partition which corresponds to the erased disk.
Data_Recovery_After_Erase_HFS_06.png
Fig.6: Scan results
Click image to enlarge

In our case, this is the Recognized1 partition.

R-Studio may also find other partitions that previously resided on the disk. You will have to determine which of the recognized partitions is the one you are looking for. In most cases, the partition you are attempting to recover will be the same size as the existing logical disk. See R-Studio online help for more details: Data Recovery Using R-Studio.

7. Double-click the Recognized1 partition. R-Studio will enumerate the files on it and show the folder tree.
Data_Recovery_After_Erase_HFS_07.png
Fig.7: Files and folders found on the erased disk
Click image to enlarge

When Mac OS X erases an HFS/HFS+ disk, the file system is completely erased. This means that the file names and folder structure are lost, but oftentimes, the underlying data is intact. In this case, R-Studio can identify the files based on their file signatures. This data recovery method is known as a "raw file recovery" or a "search for known file types". Using this method, R-Studio can restore the files, but typically cannot restore the file names and folder names or other file attributes. Some file types, such as Word documents and photos, have file tags and other metadata that R-Studio can use to recreate meaningful file names and timestamps. Otherwise, R-Studio will automatically generate a filename, such as 0256.docx

If you are searching for a particular file or set of files, you can use the advanced find and mark capabilities of R-Studio. See R-Studio help for more details: Searching for a File.

8. Use the built-in Previewer to estimate chances for successful data recovery. This is particularly useful with large picture files. Double-click a file to preview it.
Data_Recovery_After_Erase_HFS_08.png
Fig.8: File preview
Click image to enlarge

If several files appear correctly, you can purchase a license and register R-Studio. Now you may start saving recovered files.

9. Select the files and folders you want to recover and choose a location to save the recovered files.
Data_Recovery_After_Erase_HFS_09.png
Fig.9. Files marked for recovery and recovery options
Click image to enlarge

If necessary, specify other recovery parameters. See R-Studio on-line help for details. Then, click the Recover Marked button.

10. R-Studio will start recovering files showing its progress.
Data_Recovery_After_Erase_HFS_10.png
Fig.10: Data recovery process
Click image to enlarge

11. When the recovery finishes, R-Studio will show a final report with the recovery results.
Data_Recovery_After_Erase_HFS_11.png
Fig.16: Data recovery results
Click image to enlarge

Data recovery results
To view the recovered files, browse to the folder you selected in step 9 of the data recovery process.
Data_Recovery_After_Erase_HFS_12.png
Fig.17: Data recovery results
Click image to enlarge

Conclusions
Using R-Studio in its demo mode, you can evaluate your chances of successfully recovering data from an HFS or HFS+ disk 100% risk-free. As long as the disk is in good physical condition and no new data is written to it after it has been formatted, your chances of recovering data from it are very high. All of R-Studio's disk scan and data recovery features are fully functional in the demo modeā€”the only restriction is that you cannot save recovered files. You can, however, use the built-in file previewer to see if R-Studio has successfully recovered your files. If so, you can register your software on-the-fly and save your files without reinstalling and re-scanning.

© Copyright 2000-2017 R-Tools Technology Inc.