Dataquest

Data Recovery You Can Trust

Category: Apple

MacBook Pro Data Recovery Boot AnimationIn the course of recovering data for our Apple & Mac Data Recovery Services, we often blog about the various problems and issues we see.

  • iPhone Data Recovery – Obstacles

    Hardware

    iPhone Data Recovery
    iPhone Data Recovery

    When developing our iPhone data recovery process we had to make a few decisions about the devices we can support. The newer iPhones (4s +) are not accessible in the same way as older models.

    With the iPhone 4 and below we can extract the data using a forensically clean process. What this means is that we can take the data off without writing anything to the NAND chips (storage) inside the iPhone. This fits in perfectly with our regular data recovery process as we never write data to a device we receive.

    With the iPhone 4s, Apple changed the part of the system we use to access the iPhone’s memory. There is a chance that a new method of extraction for iPhone 4s will become available, but until it does we will not be recovering files from these devices.

    Physical damage

    iPhones store their data on NAND chips which are soldered to the main circuit board of the phone. The data can only be correctly decoded if we also have access to other parts of the circuit board, so it is crucial that the iPhone is electronically functional. If water damage has shorted the iPhone then we have no way to access the data externally. It’s not that it’s impossible, just that the work would be unreasonably expensive and time consuming.

    Deleted Files

    Another potential barrier for iPhone recovery is down to the way files are stored. Since iOS4 most files including iPhone camera photos and videos are encrypted before being written to storage, using unique encryption keys. This means every file ends up with a different header. When files are deleted there is nothing to distinguish a photograph from any other random collection of bytes.

    Another problem with the file based encryption is that if you restore the iPhone using iTunes, those encryption keys get erased and new ones are generated. This prevents recovery of the old data, which is good for security but bad for data recovery.

     

  • Apple iMac 1TB Seagate Hard Drive Recall

    Apple have recently announced a recall program for all iMacs with internal 1TB Seagate Hard Drives. These hard drives fail unexpectedly with no prior warning. We noted the failure of these hard drives in a post back in 2009. You can check whether your iMac has an internal 1TB Seagate Hard Drive by entering your iMac Serial Number at this link.

    This recall program has now ended. If you have one of these hard drives that has failed you may be interested in our Mac Data Recovery Services.

  • How Your HDS722020ALA330 Looks To Us

    This immense 2TB iMac drive may be heavy, but have you ever wondered why? 

    HDS722020ALA330 2TB iMac Drive
    HDS722020ALA330 2TB iMac Drive

    When we recover these drives we often have to work on individual heads. As you can see from the image, this monster has 10 heads (the first is numbered zero). This means there are 5 spinning disks inside the drive.

    From the outside, the only clue that these drives are so rammed full of disks is their weight. They are no bigger physically than any other desktop hard drive.

  • Recovering Deleted Data

    In the vast majority of cases, deleted data is actually still lurking around on your hard drive. If you put data in the Recycle Bin or Trash, and them empty it, all you are actually doing is telling the system that it can reuse those parts of the disk when it wants. Until you replace those areas with new data, the old data will still be there.

    Recovering Deleted Data

    The Filing Cabinet

    The tried and trusted analogy is of a filing cabinet. When you delete a file, you are removing the index card from the front of the drawer, but the actual file is still in there.

    This is why it is really important to switch off your computer as soon as possible if you have accidentally deleted some files. You may not realise but even small actions like checking e-mail or browsing the internet can write cache files to the disk. That is when data could be lost.

    Overwritten / Deleted Data

    We often hear about the FBI being able to recover overwritten files. While this may have been possible on very old – low capacity hard drives (~100MB), it is unlikely to be possible on modern hard drives. The magnetic material is far too densely packed. Even then, it would only be tiny fragments of data recovered, and not whole files.

    The Problem With SSDs

    Solid state drives bring a whole new problem of their own. Due to the way the data is distributed around the device, known as wear levelling, you can never be sure of which sector you are writing or overwriting. Wear levelling is necessary to prolong the life of an SSD, but it means the drive could be moving data around behind the scenes, making deleted files much more difficult to track down.

    Specifics

    In most cases, we can recover deleted files with the original file names and folders. With deleted Mac data, this is often not possible. In that case we have to use a special type of scan, which finds all files of a given type and saves them to numbered files. This means camera photos may be recovered into a JPG folder, with files named like photo0001.jpg, photo0002.jpg and so on.

    If required we can process certain types of these files into more meaningful order. For photos we can arrange into folders by date taken, and for music files we can arrange into Artist / Album order.

    The Important Bit

    If you accidentally delete some files, they are likely to be recoverable. It’s the actions you take next which can make the recovery difficult – if not impossible.

  • Burning Linux ISO to USB Using a Mac

    My main computer is an old MacBook Pro. I often download Linux ISOs to install on other computers. In recent Debian-esque releases this is actually really simple.

    1. I find it quicker and easier to install from USB so first insert a USB pen / stick of some sort.

    Note: This USB stick will be erased, so don’t use one with data that you need to keep!

    2. Next we need to find out which number has been assigned to the USB stick. If you only have one disk in your Mac then the USB will usually be disk1, but always check first. (Note: Disks are numbered from zero, so your internal drive should be disk0) On your Mac open Disk Utility, which is located within Applications / Utilities. (See Image)

    Disk Utility
    Disk Utility

    Select the USB stick from the lefthand window and then click the Info button which is on the toolbar. (See Image)

    USB Info
    USB Info

    You will get a pop up window with loads of information about the device. We only need the Disk Identifier. Make a note of this for later.

    Disk Identifier
    Disk Identifier

    3. To allow us to write data to the USB stick we need to unmount any volumes currently on there. (see image)

    Unmount USB
    Unmount USB

    4. Now comes the actual writing. First locate the Terminal application, again within Applications / Utilities. (see image)

    Mac Terminal
    Mac Terminal

    5. Remember to change the code to match your Disk Identifier from earlier. There are a few things to note about the following command.

    • sudo – allows you to run dangerous commands, so will require an administrator password
    • Instead of typing the location of the ISO file you can just drag the ISO onto the terminal when required.
    • “if” means input file (in this case the ISO file), “of” means output file (the USB stick)
    • When we found out the Disk Identifier, it was disk1. That will work in the command, but we use rdisk1 instead, which gives us raw access to the disk. This may not be necessary, but it works for me.

    There is a lot of discussion about block sizes, but I find 4MB is reasonable for writing ISOs to USB. In Linux we often type bs=4M, however the Mac prefers it like bs=4096 instead. It’s the same thing, just expressed differently.

    The command:

    sudo dd if=[drag iso here] of=/dev/r[disk number] bs=4096; sync

    Example:

    sudo dd if=/Users/dan/Desktop/linux.iso of=/dev/rdisk1 bs=4096; sync

    If you’ve got it right, you shouldn’t get any feedback until it finishes. Your USB stick may have a blinking LED whilst the data is being written. For reference the 200MB debian-netinst ISO took just over a minute to write.

    Once complete you should get something like:

    48896+0 records in
48896+0 records out
200278016 bytes transferred in 95.151719 secs (2104828 bytes/sec)

    This means you’re finished. Now eject the USB and try to boot your PC with it. The Mac may complain that the disk is not readable but just ignore that and try it on a PC.

    Debian Boot
    Debian Boot

  • Accidentally Installed Windows On Top Of Mac OS X

    We have just completed a complex data recovery, where a Mac system had been inadvertently overwritten with Windows. The Mac drive originally had over 500GB of data, so we expected to get most of it back, we just didn’t know how good the structure would be.

    It helps to visualise the layout of the data on the disk. before it was overwritten, the data would have looked something like this:

    Overwrite Mac With Windows

    Although the fresh Windows system is much smaller than the original data, it prevents you from seeing any of that old Mac data.

    Once we made copies of the drive, we were able to reconstruct the missing parts of the Mac data, and could see all the original files and folders, with their original structure.

    Luckily nobody had tried to fix the problem with this drive. Often the fixes people attempt are worse to recover from than the original problems.

  • What is a Digital Negative

    We see various types of camera media come into us for data recovery, with surprisingly varied file formats. Many camera manufacturers use their own raw format, alongside various JPG options.

    This raw format is sometimes known as a digital negative, containing (mostly) untouched data straight from the camera. These raw format images can be ten times the size of JPG images.

    The benefits of raw files are to allow post-processing without the loss of quality from JPG files. Settings like sharpness, saturation and white balance can be changed at a later date using photographic software. Below are a few of the different raw file types in use.

    The following is a description about some RAW formats:

    • CRW – Canon Digital Camera Raw Image Format. Raw image format for some Canon digital cameras. Raw images are basically the data as it comes directly from the CCD detector in the camera. Raw files can also contain text information about the picture and conditions in the camera when the picture was taken.
    • CR2 – Canon Digital Camera Raw Image Format version 2.0. Raw files can also contain text information about the picture and conditions in the camera when the picture was taken. These images are based on the TIFF image standard.
    • NEF – Nikon Digital SLR Camera Raw Image File. Raw image format for some Nikon digital cameras.
    • RAF – Fuji CCD-RAW Graphic File. Exif (Exchangeable Image File) information is within the file along with the image.
    • X3F – Sigma Camera RAW Picture File. Use the SIGMA Photo Pro software provided with the camera to download and manipulate the photos. The Foveon X3 direct image sensor captures all three colors at every pixel location and requires special software to manipulate the RAW files.
    • BAY – Kodak/Roper Bayer Picture Sequence. A specific Kodak picture format used by some high speed video cameras such as Kodak HRC-1000.
    • ORF – Descent 3 Outrage Room Format.
    • MRW – Minolta Diamage Raw Image File. Raw image format for some Minolta digital cameras.
    • RAW – Image Alchemy HSI Temporary Raw Bitmap
    • SRF – Sony DSC-F828 Raw Image File. CCD-Sensor RAW Data File from Sony DSC-F828 8 megapixel digital camera.

     

  • Help! My Mac Won’t Start

    Here is a simple flow chart for diagnosing Mac startup problems. This will help you find out if your hard drive is the cause. If it is then we can recover the data.

    Help! My Mac Won't Start
    Help! My Mac Won’t Start

     

     

    An alternative text version is below:

    (more…)

  • Apple Mac Time Machine Back Up

    I have lost count on the amount of times we have received hard drives for data recovery from Mac customers, who are not aware of the Time Machine back software. Time Machine has been preinstalled in every version of OS X since 10.5. This software is easy to setup, and once the first backup of the internal hard drive is complete, it will then carry on backing up as you create new data.

    As a small business or personal user it is ideal for your everyday backup needs.

     

  • ST9320421ASG Head Crash

    This hard drive was from a Macbook Pro. As you can see in the image, loss of data was caused by a severe head crash.  The damage is so severe you can actually see through the top foil layer to the glass platter beneath. Another good reason why Mac users should make sure they backup regularly.

    ST9320421ASG Head Crash
    ST9320421ASG Head Crash