Difference between revisions of "Datarecovery with open-source software"

From LogiWiki
Jump to navigation Jump to search
 
Line 46: Line 46:
 
after you have a 90%+ clone, you can try to mount APFS partition with APFS Fuse(link above) or use known good data recovery tools like Diskwarrior (HFS-only) iBoySoftware or Diskdrill. In some cases you might be able to mount cloned drive or fix it with MacOS disk utility
 
after you have a 90%+ clone, you can try to mount APFS partition with APFS Fuse(link above) or use known good data recovery tools like Diskwarrior (HFS-only) iBoySoftware or Diskdrill. In some cases you might be able to mount cloned drive or fix it with MacOS disk utility
  
 +
Some interesting articles for further research:
  
 +
[https://www.stderr.nl/Blog/Software/Linux/HfsFilesystemRecovery.html HfsFIleSystemRecovery]
 
Images and corrections pending, by questions you can reach me on Rossmann's discord as @inwerp
 
Images and corrections pending, by questions you can reach me on Rossmann's discord as @inwerp

Latest revision as of 17:10, 17 July 2021

There are some cases when customer can't afford data recovery and it does not hrt if you fail or make it worse. Following procedure should not be considered as any sort of sollution for important data recovery - if data worth recovery lab(400-600€ ++ ) - DO NOT TRY IT.

Software/Hardware:

  1. Linux (Ubuntu/Mint/etc)
  2. gddrescue (sudo apt install gddrescue). Read its manual at least briefly.
  3. APFS Fuse
  4. SSD Adapter. It does not really matter if you use USB-SATA or direct SATA connection. For macbook drives use usb-apple adapter, thats totally fine (there are gen.4 PCI-E cards, but they are difficult to find / too expensive. Check Apple SSD page for some links
  5. KVM switch or USB with on/off button

IMPORTANT NOTE: you should disable SSD trim on data recovery device especially if you use some file signature-search software like Diskdrill or Photorec.

Ubuntu/Mint: sudo rm /etc/cron.weekly/fstrim

Windows: fsutil behavior set disabledeletenotify 1

MacOS: sudo trimforce disable

Theory:

  1. If you have failing/freezing SSD drive, you should try to make an image of it as soon as possible. You may try to copy 1-2 most important files if you can mount it but never try to transfer big amounts of data. Obviously Photo Library is actually a huge folder with thousands of files. After you cloned the drive you may try data recovery software, disc utility repair, etc. DO NOT ATTEMPT TO FIX ORIGINAL DRIVE.
  2. Note on Apple-Samsung SSDs: they tend to freeze once they hit a bad block. If it is frozen, you need to power-reset the drive and continue data recovery. This might skip few block of data, but in most cases it is 0.1-5% of whole drive so it might not be critical for most of the data

Recovery(Terminal commands):

sudo lsblk 

this will show you list of block devices. if you cant understand it, simply open Disk utility or gparted to see dist identities in graphical manner. Linux disks look like that: /dev/sdXY where X is disk number and Y is a partition.

my normal command looks like that:

sudo ddrescue -df -r0 /dev/sdX /dev/sdZ customername.log

X is a SOURCE ID , Z is TARGET ID. -df uses forced overwrite (to write on other drive) -r0 means it will not retry failed block and go further. Log is necessary so if you re-run the command it will continue from the point it was stopped.

I usually use a physical drive as target, brand new clean drive or pre-wiped(owerwritten with zeroes) one.

now you should see whats going on with the cloning process: if it goes through with couple of errors - you are lucky. If it freezes for more than 10-20 seconds, disconnect the drive ( or use KVM switch ad a reset button).

Example bash script for such cases:

#!/bin/bash
while :
do
	sudo ddrescue -df -r0 /dev/sdX /dev/sdZ customername.log
	sleep 5
done

if device disappears, ddrescue quits and script sleeps a little bit. After you restart it it starts with the next block and goes further. if you have 100-300Mb/sec transfer rate, it might take you 1-2 hours to clone a drive.

after you have a 90%+ clone, you can try to mount APFS partition with APFS Fuse(link above) or use known good data recovery tools like Diskwarrior (HFS-only) iBoySoftware or Diskdrill. In some cases you might be able to mount cloned drive or fix it with MacOS disk utility

Some interesting articles for further research:

HfsFIleSystemRecovery Images and corrections pending, by questions you can reach me on Rossmann's discord as @inwerp