We have been offering Apple Mac Data Migration as a service for many years now. Here’s a quick reminder about this service which we call Mac Setup. You are bound to be over the moon when you are told that we have recovered your lost data, but in many cases this is only half the battle.
We wrote a detailed blog on the subject back in November 2011, but it still appears to trouble many customers.
We still often get the questions: “What do I do with the recovered data once I receive it?” and “How do I get the data back into it’s original places on my Mac?” For out-of-warranty Macs, this is where our Mac Setup comes into play. For a fixed cost we will provide you with a new installed hard drive, with all your recovered data migrated into it’s original locations, so that when you receive your Macintosh computer back, hey presto! it’s as if your Mac had never failed in the first place, everything up and running as it was.
When developing our iPhone data recovery process we had to make a few decisions about the devices we can support. The newer iPhones (4s +) are not accessible in the same way as older models.
With the iPhone 4 and below we can extract the data using a forensically clean process. What this means is that we can take the data off without writing anything to the NAND chips (storage) inside the iPhone. This fits in perfectly with our regular data recovery process as we never write data to a device we receive.
With the iPhone 4s, Apple changed the part of the system we use to access the iPhone’s memory. There is a chance that a new method of extraction for iPhone 4s will become available, but until it does we will not be recovering files from these devices.
iPhones store their data on NAND chips which are soldered to the main circuit board of the phone. The data can only be correctly decoded if we also have access to other parts of the circuit board, so it is crucial that the iPhone is electronically functional. If water damage has shorted the iPhone then we have no way to access the data externally. It’s not that it’s impossible, just that the work would be unreasonably expensive and time consuming.
Another potential barrier for iPhone recovery is down to the way files are stored. Since iOS4 most files including iPhone camera photos and videos are encrypted before being written to storage, using unique encryption keys. This means every file ends up with a different header. When files are deleted there is nothing to distinguish a photograph from any other random collection of bytes.
Another problem with the file based encryption is that if you restore the iPhone using iTunes, those encryption keys get erased and new ones are generated. This prevents recovery of the old data, which is good for security but bad for data recovery.
Apple have recently announced a recall program for all iMacs with internal 1TB Seagate Hard Drives. These hard drives fail unexpectedly with no prior warning. We noted the failure of these hard drives in a post back in 2009. You can check whether your iMac has an internal 1TB Seagate Hard Drive by entering your iMac Serial Number at this link.
This recall program has now ended. If you have one of these hard drives that has failed you may be interested in our Mac Data Recovery Services.
This immense 2TB iMac drive may be heavy, but have you ever wondered why?
When we recover these drives we often have to work on individual heads. As you can see from the image, this monster has 10 heads (the first is numbered zero). This means there are 5 spinning disks inside the drive.
From the outside, the only clue that these drives are so rammed full of disks is their weight. They are no bigger physically than any other desktop hard drive.
When you boot up your computer, you expect to see all your familiar files on the desktop, or maybe in the documents folder. What you may not realise is that those folders are actually a bit harder to find if you look at the disk externally. It depends what operating system you use so below is a general guide of locations for Mac & PC users.
Windows Operating System
All user data should be stored within the user profile folder, which is created when the PCs is first used. This is usually located in the following locations depending on the version of Windows:
Windows 95, 98, NT, 2000 & XP
Local Disk C:\Documents and Settings\User ( for example C:\Documents and Settings\John )
C:\Users\User ( For example C:\Users\John )
In systems earlier than Windows 7, some software may be stored in the “Program Files” folder in the root of the drive. This was considered bad practice so in Windows 7 any Program Data should be found in the “Program Data” folder on the root of the drive and not in “Program Files.” Sage Accounts can often be found within the C:\Program Files\Sage\ folder.
Macintosh Operating System
All user data should be stored within the user folder, which is created when the Mac is first used. This is located in the following location:
Macintosh HD/Users/user ( for example Macintosh HD/Users/john )
In the vast majority of cases, deleted data is actually still lurking around on your hard drive. If you put data in the Recycle Bin or Trash, and them empty it, all you are actually doing is telling the system that it can reuse those parts of the disk when it wants. Until you replace those areas with new data, the old data will still be there.
The Filing Cabinet
The tried and trusted analogy is of a filing cabinet. When you delete a file, you are removing the index card from the front of the drawer, but the actual file is still in there.
This is why it is really important to switch off your computer as soon as possible if you have accidentally deleted some files. You may not realise but even small actions like checking e-mail or browsing the internet can write cache files to the disk. That is when data could be lost.
Overwritten / Deleted Data
We often hear about the FBI being able to recover overwritten files. While this may have been possible on very old – low capacity hard drives (~100MB), it is unlikely to be possible on modern hard drives. The magnetic material is far too densely packed. Even then, it would only be tiny fragments of data recovered, and not whole files.
The Problem With SSDs
Solid state drives bring a whole new problem of their own. Due to the way the data is distributed around the device, known as wear levelling, you can never be sure of which sector you are writing or overwriting. Wear levelling is necessary to prolong the life of an SSD, but it means the drive could be moving data around behind the scenes, making deleted files much more difficult to track down.
In most cases, we can recover deleted files with the original file names and folders. With deleted Mac data, this is often not possible. In that case we have to use a special type of scan, which finds all files of a given type and saves them to numbered files. This means camera photos may be recovered into a JPG folder, with files named like photo0001.jpg, photo0002.jpg and so on.
If required we can process certain types of these files into more meaningful order. For photos we can arrange into folders by date taken, and for music files we can arrange into Artist / Album order.
The Important Bit
If you accidentally delete some files, they are likely to be recoverable. It’s the actions you take next which can make the recovery difficult – if not impossible.
My main computer is an old MacBook Pro. I often download Linux ISOs to install on other computers. In recent Debian-esque releases this is actually really simple.
1. I find it quicker and easier to install from USB so first insert a USB pen / stick of some sort.
Note: This USB stick will be erased, so don’t use one with data that you need to keep!
2. Next we need to find out which number has been assigned to the USB stick. If you only have one disk in your Mac then the USB will usually be disk1, but always check first. (Note: Disks are numbered from zero, so your internal drive should be disk0) On your Mac open Disk Utility, which is located within Applications / Utilities. (See Image)
Select the USB stick from the lefthand window and then click the Info button which is on the toolbar. (See Image)
You will get a pop up window with loads of information about the device. We only need the Disk Identifier. Make a note of this for later.
3. To allow us to write data to the USB stick we need to unmount any volumes currently on there. (see image)
4. Now comes the actual writing. First locate the Terminal application, again within Applications / Utilities. (see image)
5. Remember to change the code to match your Disk Identifier from earlier. There are a few things to note about the following command.
sudo – allows you to run dangerous commands, so will require an administrator password
Instead of typing the location of the ISO file you can just drag the ISO onto the terminal when required.
“if” means input file (in this case the ISO file), “of” means output file (the USB stick)
When we found out the Disk Identifier, it was disk1. That will work in the command, but we use rdisk1 instead, which gives us raw access to the disk. This may not be necessary, but it works for me.
There is a lot of discussion about block sizes, but I find 4MB is reasonable for writing ISOs to USB. In Linux we often type bs=4M, however the Mac prefers it like bs=4096 instead. It’s the same thing, just expressed differently.
sudo dd if=[drag iso here] of=/dev/r[disk number] bs=4096; sync
If you’ve got it right, you shouldn’t get any feedback until it finishes. Your USB stick may have a blinking LED whilst the data is being written. For reference the 200MB debian-netinst ISO took just over a minute to write.
Once complete you should get something like:
48896+0 records in
48896+0 records out
200278016 bytes transferred in 95.151719 secs (2104828 bytes/sec)
This means you’re finished. Now eject the USB and try to boot your PC with it. The Mac may complain that the disk is not readable but just ignore that and try it on a PC.
We have just completed a complex data recovery, where a Mac system had been inadvertently overwritten with Windows. The Mac drive originally had over 500GB of data, so we expected to get most of it back, we just didn’t know how good the structure would be.
It helps to visualise the layout of the data on the disk. before it was overwritten, the data would have looked something like this:
Although the fresh Windows system is much smaller than the original data, it prevents you from seeing any of that old Mac data.
Once we made copies of the drive, we were able to reconstruct the missing parts of the Mac data, and could see all the original files and folders, with their original structure.
Luckily nobody had tried to fix the problem with this drive. Often the fixes people attempt are worse to recover from than the original problems.
I recently read a brilliant article about the guy that wrote the original Prince of Persia game for the Apple II in the 80’s. He had long since lost the original source code, until an old box of floppy disks was uncovered in his father’s apartment.
Sensibly, he enlisted some experts to help with the data extraction, and after a day of collaboration was able to release the source code online.
This got me thinking. Although I am meticulous with my backups of current data, I still have boxes of old software on floppy disks, which are happily degrading as we speak. John even found an old 212.6MB hard drive with some vintage data recovery software on it. Now this stuff isn’t always useful, but occasionally a really old drive comes down to us, and it is only this old software that can do the job.
As a result, John and I have started a project to get all of our old data recovery software from floppy disks and hard drives, and back it up to our file server. The 212.6 MB hard drive in the picture had 128MB of old DOS recovery software, which would easily fit on my mobile phone. Who knows when we might need it, but we now have it available when the need arises.