Sunday, October 17, 2010

Overwritten MAC disk

I recently received a MAC disk for data recovery. The disk imaged without any sectors errors, and a scan of the disk indicated there was about 70GB of data. However, when I read it, only about 20MB was recovered. The fist thought is that all the daya had been deleted which is not good news for a MAC. When a MAC file is deleted, it also removes the metadata from the directory, making intelligent recovery impossible. The only recovery approach is data carving.However, looking through the disk, several files looked rather PC based, and there were also som FAT32 directory structures. A scan of the disk using the CnW Partition function showed there were about 300 FAT sub directories on the drive. This indicates that the drive was intially a FAT32 drive that had been reformatted as a MAC drive. A bit more examination also indicated that much (but not all) of the FAT was still intact.CnW was set to recognise the partition as a FAT32 and a very complete recovery was made. By examining the log (and sorting on start location) it was clear that the area that th MAC writes most directory information was one where only a few system files originally existed, and so it was likely that very few useful files were lost.Moral - when only a few files have bee found on a disk, it is always worth investigating if it has been reformattted, either to the same, or a different file system.

No comments:

Post a Comment