Dealing With RAW Data

What is Hard Drive Encrytion

What is RAW data?

Raw Data Recovery 1
Some Raw Word documents

Raw data is what we get when we recover files without their folder and file names. Instead of a My Documents folder, with photos and documents arranged into separate folders, what we get is a folder named JPEG for example, with thousands of consecutively numbered jpg files. The same with office documents, you would get a folder with thousands of doc, xls, docx or xlsx files.

These raw files will be fully usable and contain all the same info that they did originally. You will still be able to open them, edit them and save them, they are just unnamed.

Why is this data in RAW format?

When we recover data, we always prefer to get it back in the original structured form. When data has been deleted from a Mac, or when a hard drive has been reformatted and then partially overwritten, it can be impossible to rebuild all of the data in structured form, as the structure has been overwritten or damaged. This is when we opt for RAW files.

With a RAW recovery, what we are basically doing is searching the whole hard drive for files in known formats. This means we usually get a lot of office documents, jpg images, photoshop psd files and some others. If we need to find an unusual file type then we need a few sample files to be able to generate the correct scan info. RAW recovery is not always possible for every type of file. An example is Apple Garageband project files, which are actually just folders with the name .band on the end. On the mac, these folders are treated as packages, with folders and files inside that you don’t usually see,  (If you right click one and choose ‘Show Package Contents’ you will see what I mean,)  but for the purposes of RAW recovery we cannot get back those files. (We would however get back the RAW AIFF files and recordings from within the projects. It’s not ideal but may be better than nothing.)

What to do with the RAW files

If there is only a small number of files, then you can manually open them all up, see what’s inside and then rename them to something useful. Luckily, for certain file types, there are other ways to make sense of them. It’s called meta data, meta tags or EXIF data.

This meta information is stored inside the files, so even if the file and folder names are lost, we still have the tags.

A brilliant piece of software called Amok EXIF sorter will plough through thousands of jpg files, read their date tags and then place them in dated folders. It can also do other fancy things with tags, but default setting will create a decent structure.

For music, iTunes or any other music manager will usually rename the files in the library based on the artist and album tags. In iTunes, just make sure it is set to: ‘Keep iTunes media folder organised.’

Document files such as doc, docx, xls and xlsx also have some useful tags that we can use to make sense of the masses of numbered files.

Raw Data Recovery
Raw File Tags

In Windows, set the View to ‘Details’ and you should see a series of headings such as Name, Date Modified, Type, and Size. Date modified will show the date that the files were recovered so is useless for this task, however if you right click on this heading you will see other available columns, with ticks beside a few of them. The ‘More…‘ option at the bottom contains loads of tags that we can use to sort the data.

Good headings for office documents are Author and Date last saved. You can experiment and see if any of the other tags are more useful to your specific data.

Good headings for jpg files are Date taken (Date picture taken) and Camera model. Again, there are others which may be useful.

Raw Data Recovery
Raw Files Showing Author Tag

iPhone Skype Warning

Cult of Mac have warned of an exploit in the Skype app which allows hackers to execute code on your device simply by sending a chat message. iPhone and iPod Touch are both affected. Skype is apparently aware of the problem and will be fixing it soon. Meanwhile be careful!

Read on Cult of Mac

Farewell Steve Jobs

As long time Mac users we want to pay tribute to the man behind the iconic Macs we use every day. Our business depends on Macs and also makes our daily office work that much more bearable. Hopefully Tim Cook is able to continue with the innovation and attention to detail that we all love.

Read More On Slashdot

Apple iMac 1TB Seagate Hard Drive Replacement Program

We at Dataquest have been aware of the problem with 1TB Seagate drives for some time. It is pleasing to see that Apple are also recognising the problem and are offering their customers a free swap out. These drives are mainly seen in iMacs, but you may also get them in the Mac Pro so make sure your back ups are up to date.

OS X Lion

Apple have announced it’s new and most advanced operating system to date. Due to release in July and with over 250 new features, including Multi-touch Gestures. OS X Lion is a snip at around £21, surely the buy of the year so far.

Mac Hard Drive Quick Diagnosis Fail Guide

For Mac users who cannot get their Mac to boot, this is a quick guide to find out the level of the problem with your internal hard drive. If on start up you get to the Apple logo and beyond, then this means that your Mac can read the internal hard drive. For this to happen the drive will have carried out it’s own start up process when you pressed your mac power on button. This therefore tells you that your drive is functional to a point, but has some reading problems.

If however on start up your Mac shows a folder with a question mark, then this means that your Mac cannot read the drive at all. Therefore your drive may have a more serious problem.

PGP vs 10.6.5 Don’t Update

PGP 10.6.5 Don't Update
PGP 10.6.5 Don't Update

Users of PGP Whole Disk Encryption for Mac are advised agains the recent system update to Snow Leopard 10.6.5. Reports of users getting stuck in a reboot loop after the update have been appearing on PGP forums. The official advice is to first decrypt, then install the update, then encrypt again. More details of this can be found on Threatpost, with links for people that have already performed the update and are now locked out of their systems.

Free Mac Antivirus


Sophos have recently announced a free version of their Antivirus software for Mac. The software has low system requirements and will find and quarantine Mac and Windows viruses, trojans and worms.

One word of caution comes from a Mac user who lost his entire Time Machine backups while using the new software. Sophos have been quick to mention that their software has been used on Macs for many years, and by hundreds of thousands of new free users without problems.

What this really shows is that if you delete files from you mac then your Time Machine volume is no longer a backup but the only live copy of the files. Either make multiple backups or leave the files on the original volume after backing them up. Also be aware when installing new software that you should have backup copies of your data in case it all goes wrong.

Update 11-11-2010:

It appears that this guy was having some problems with Time Machine before any of this happened.