3

Backstory: After I went to the Apple Store today, the drive in my Mac was wiped by an employee as I was supposed to have it replaced. The replacement unit had an issue though, so they gave me my old machine back with the SSD already reset to factory.

As the employee probably just used the DiskUtil UI to wipe the drive, I was wondering if there was any way for me to get my data back by rebuilding the HFS volume tables back to their previous state for instance. Using a backup would take days to get everything back and I want to try the other options before restoring a backup that would corrupt the data and prevent any further recovery.

Small issue: I only have a Sierra Recovery USB stick, so I can only use the terminal with whatever is already installed, like gpt, diskutil or pdisk. TestDisk for instance doesn’t work as it seems like it’s lacking some dependencies in this recovery environment.

  • You have to ask the Apple Store employee what she/he did. If the partition table was the only thing to be destroyed it's recoverable. If the "drive" was erased (= partition table renewed & a new more or less empty file system was written) you hardly will be able to restore single files but in no way the whole file system with all system files/files. – klanomath Jul 19 '17 at 18:44
  • @klanomath He used the Disk Utility app from the recovery OS, and just erased the drive from there. By this I mean that Disk Utility now shows the internal drive has 1 partition named Macintosh HD (which isn’t the name I used). The file system should is the same (HFS), so maybe it was rewritten, but I’m not sure in which of the two case it would correspond to. Any insight? – LaX Jul 19 '17 at 18:50
  • 2
    Erasing a volume: a new file system is written and all previous fs structures (allocation file/catalog file/attribute file/etc. ~200-300 MB) are gone/replaced/usually overwritten on an HDD-maybe overwritten on an SSD, but at least difficult to recover. – klanomath Jul 19 '17 at 19:31
  • @klanomath OK, looks like I’m out of luck then as the erase most probably erased any structure. – LaX Jul 19 '17 at 20:09
1

There are several professional, commercial data recovery options.

One is DiskWarrior, as an external boot media, which can recover corrupted file systems. However, as your file system was completely wiped, you will need to do block-by-block scanning of the raw data.

DataRescue is the tool of choice here. Starting it from a different Mac, connect your current machine via FireWire or Thunderbolt in target disk mode (start the current machine while pressing and holding the t key). It will show up as an external drive on the other Mac. Select the drive as source in DataRescue and run a full scan. This will take hours. After it finishes, you can choose which of the reconstructed files should be saved to a new location.

Direct manipulation on-disk is not possible, especially not now that a new OS appears to have been already installed. Without the partition table and metadata information, data is just on the disk but in an unusable way. That's why modern filesystems save the metadata information to several locations on the disk, so it is more likely to be recoverable even when the sector containing the superblock is damaged. But wiping the information manually wouldn't even help there.

So your best bet is reconstructing files with DataRescue. You could also ask your cloud backup provider to send you your data on disk. It will be quite expensive but if the data is important, just do it and consider it a hard-learned lesson for the future.

  • I reinstalled the new OS since, but when I was asking this question, it wasn't. Only a new file system was created from the data wipe. My question might not be clear enough, but as I already have a backup, recovering just a few files wouldn't be enough as I can already do that. I want to recover the whole drive in its original state. – LaX Jul 20 '17 at 15:03
  • In this case, the answer to your question is that what you're asking for is impossible. – herrbischoff Jul 20 '17 at 19:37
0

If you have a backup, that's the way to go. How big is the drive? It should restore it in less than 12 hours with a USB2 connection. If you are restoring from a cloud backup, it will take a long time. But it's still probably your best option.

You can try to find a data recovery tool, but SSD drives have garbage collection routines that frequently wipe "deleted" data. If the drive got reformatted, and then had the OS reinstalled, everything is likely gone. In any event, it's probably too much hassle to bother with unless you don't have a backup for some reason.

  • No, because the backup is a cloud one, and the drive is a 512 Gb one. I only had this backup to gradually restore documents to my replacement machine as I needed them because I wanted to start fresh, but the backup will be deleted in 30 days if I can’t restore everything. But on the older machine I currently have I would like to keep everything as before if it’s possible. – LaX Jul 19 '17 at 18:35
  • Ouch. I thought you were just hesitant to do a time machine restore. – Morgan Rodgers Jul 19 '17 at 20:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .