[Cialug] File Recovery on Mac OS-X

[Claus]

Wow, you guys are true bit geeks if you recover files without using more 
advanced utilities.  That would be something way beyond of what I would 
be willing to do.

I got to borrow a Notron Utilities Disk that did recover a huge amount 
of office files and with a little luck the one we're looking for is 
under them.  It was a file delete, no system or hard drive failure. 
User failure I guess. ;)

Thanks for your help and input.


On 5/10/2006 4:42 PM, Paul Gray wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On Tue, May 09, 2006 at 11:52:56AM -0500, Claus wrote:
>> I'm not a Mac guru at all but I need to help someone to recover some 
>> deleted files on a Mac OS-X computer.
>>
>> Although the budget for this is $0 the files are important.
>>
>> It looks pretty bleak to me so I could use any advice on how to approach 
>> this issue.
>>
>> Is there any bootable CD with a file recovery tool out there (thinking 
>> of Knoppix)?  And how does one go about to use it?
>>
> 
> The best approach would be to pull the drive, dd off the contents, and work
> with the resulting file. 
> 
> How were they deleted?  Using rm? or with a mkfs? Drive errors?
> 
> The best approach for an rm-style deletion recovery is to try to locate the
> first block of the file (using grep, as was already mentioned).  Then use
> dd on the block(s) and pray that the files are small or at least contiguous.
> If they're not contiguous, then you'll want to use debugfs + dd to pull 
> out the disparate blocks based upon the references in the inode.
> 
> This has been quite a term for drives going bad it seems.  My laptop drive went
> belly-up in the middle of a backup ... a backup that was underway to preserve
> my class grades.  I ended up doing my own platter swap to recover the data 
> (pictures available).  At the same time, the doofuses in our campus' building
> management thought that it would be a good idea to trip all the breakers on the
> floor for an hour, and didn't think anything of the harmony of UPS beeps going
> off in my lab during the time.  Two systems not on the not-so-graceful 
> shutdown of the UPS had all files in /lost+found after booting to a 
> mandatory fsck.  Also this term, a student approached me with a laptop drive
> that wasn't booting (Windows NTFS) and asked if I could pull her data off for
> her, which I did, and unintentionally learned more than I wanted to about 
> her social life in the process.  Aargh!  
> - -- 
> Paul Gray                                         -o)
> 323 Wright Hall                                   /\\
> University of Northern Iowa                      _\_V
> Message void if penguin violated ...  Don't mess with the penguin
> No one says, "Hey, I can't read that ASCII attachment ya sent me."
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (GNU/Linux)
> 
> iD8DBQFEYl5aOH45TZW7mh4RAsTsAJ9vQFxAZQ4TEltalwh1/EDrV60eXwCfWwya
> uXOU39+lbN9fZTld7RvVUbs=
> =MbUz
> -----END PGP SIGNATURE-----
> _______________________________________________
> Cialug mailing list
> Cialug at cialug.org
> http://cialug.org/mailman/listinfo/cialug
> 
>