0

I have a LaCie P9227 2TB drive partitioned 500GB for Time Machine and 1.5TB for Archive purposes. Two days ago the disk started failing (DriveDx utility indicated it as Failing), the TM partition unmounted during the First Aid trial via macOS Recovery mode and, since then, I have kernel panics every time I attach the disk to my 2016 MacBook Pro and try to do anything with it. The repair failed with "Error at -8".most positive state

I would purchase DiskWarrior but if I have only a 2-minute window I fear that will not be enough (Seagate Recovery software ended in a kernel panic before completing the first scan). Seagate asked me EUR 850 for recovery and I do not want to discuss the price here, just assume I cannot pay.

Professional data recovery is still done by humans—I guess—so I would like to know what I can do on my own: what software / hardware do I need? It should be possible to learn.

1

If you think you might be able to afford professional data recovery, and that is a path you want to try later, then I would advise doing that sooner rather than later as the chance of data recovery diminishes over time.

If you're sure you do not want to go with professional data recovery, but rather want to try do it yourself, I would strongly advice that you stop your attempts with file system repairs, mounts, etc. right away. These tend to do more harm than good. Instead the best way to proceed is to take a copy of the disk and only work on that copy - never touch the original hardware.

In order to take the copy, I would recommend using the program "ddrescue". First install Home Brew, and then run this command in the Terminal:

brew install ddrescue

The ddrescue program allows you to take a bit-for-bit copy of the drive. Compared to ordinary dd, the ddrescue program can skip unreadable sections of the drive, and it is possible to do multiple attempts at reading problematic parts of the drive.

Familiarize yourself with the documentation here:

https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html

You can find the device name of the disk in Disk Utility. For example it might be /dev/disk2. First ensure that all partitions on the drive are unmounted.

Then the ddrescue command to copy the disk could look something like this for doing maximum of 3 retries on each read:

ddrescue -d -r3 /dev/rdisk2 mydiskimage mydiskmap

Make sure that you have enough disk space on the location where you want to save the "mydiskimage" file.

Now that you have the copy of the disk, you can use various disk recovery / forensics tools to try getting your data back.

In regards to your question about the hardware needed to do professional data recovery yourself: Even though I can confirm that it is done by humans, it is not something the ordinary home user can do themselves. It requires special training as well as special hardware and environment. In theory it is of course possible to arrange for that yourself, but building your own clean room, buying microscopes, etc. is going to cost you a lot more than the professional data recovery company charges for their services.

  • Thank you! As soon as I get a new drive I will attempt copying what is possible. Just to be sure I understood the command line: rdisk is “read disk”, mydiskimage is the path or what should I put there? And what in mydiskmap? Sorry but I want to be sure about that. Agreed on the hardware for professional data recovery. I plan not to fall again in this situation with at least one backup for every potentially failing drive. – NotationMaster Mar 11 at 22:40
  • Ah, I forgot: what will ddrescue do when it sees that the disk has two partitions? Will it just copy the data? – NotationMaster Mar 11 at 22:41
  • 1
    rdisk is not "read disk", but rather "raw disk". This means that it accesses the drive directly without going through a data caching layer. "mydiskimage" is filename you want to store the copy in. You can specify a full path if you want (i.e. /Users/myname/thisfile.img) or just a filename to store in the current folder. "mydiskmap" is similarly a file that is stored. In rough terms it is a kind of "map" over what sections of disk were copied and which were skipped because of errors. It allows you to stop the copy and restart later where you left of, and to make more attempts if you want. – jksoegaard Mar 11 at 22:45
  • 1
    Regarding partitions: Everything on the drive is copied over, no matter how many partitions you have. The partition table and the structure of the data is intact so that data recovery software can see the individuals partitions and do their job according to the file system on each partition. – jksoegaard Mar 11 at 22:46
  • I deleted previous comment because reading the documentation is shedding light: here it says “the device or partition to be rescued should be not mounted at all”. Should I try to connect the disk and unmount the one partition still mounted? Should I do so via the Terminal or via Disk Utility. Assume I have already removed that partition from Spotlight indexing (this gives me a few extra minutes to work with it). – NotationMaster Mar 12 at 7:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .