PC-3000 Forum

Hi, I've a case with a HFS+ formatted drive and I'd like your opinion.
Disk (1Tb USB external with only user data, NO OS) was in hfs+ (round 1Tb full ) and client accidentally formatted it from disk utility on Mac.
Nothing else has been done. Disk was immediately delivered to my hands.
I tried :
1) Quick disk analisys. After a complete scan, it finds 5 hfs+ structure. No one of them contain user data.
2) RAW. It finds lot of 'Volume Header' but no one contain user data (I tried them with virtual partition).
3) GREP with only 2 keys for HFS+. IDEM
4) R-studio. Allow me to do a raw recovery with good results. BUT I NEED STRUCTURES....

Now the question ....
There is a way to recover original disk structure with folders and original file-names?
Or when an HFS+ disk is formatted, all structures are overwritten and RAW is the only chance?
I would never risk customer data proceeding by attempts so I also simulated with a laboratory disc. I copied some data and formatted but I can't go on.
Please help me
Bye

Unfortunately this can happen with HFS. The best software I have found for rebuilding HFS is ReclaiMe. Try the demo version.

The above is also assuming you have no bad sectors in the catalog file?

Fortunately not, the disc is healthy.
I'd like to be able to rebuild HFS but I'm even more interested in understanding how it works.
Whether formatting results in a complete overwrite of :
- Volume Header (LBA 2) which contains informations and the location of the other metafiles.
- Allocation file. (like $bitmap) Keeps track of free and busy sectors.
- Catalog file. A B-Tree with files list with variable size records.
- others... (extents overflow , attributes, etc)
I think it is important to understand by formatting a disk (utility disk in HFS +) to what extent the file is overwritten.
If in Catalog file (following formatting) a very large area is overwritten, it is no point in talking about recovery with structure.
I will test on a lab record and report the results.
Thanks for recommending ReclaiMe, I will try the demo

HFS is a very complex file system. Unlike NTFS which basically uses a table to store files, HFS uses inodes to make searching for files faster. Unfortunately when HFS is reformatted a lot of the old inode structure is replaced with new metadata. So the inode link to groups of files are overwritten.

ok, only way for this case is RAW...or can I do more?

Just try several scans with different software. One may get you some folder structure.