Is there a way to recover deleted files from a Mac hard disk, from within Windows?

[d3v]

Hi guys, my neighbour has asked me to upgrade her old A1224 Mac memory, and also do perform a data salvage of her photos which she accidentally managed to delete from the trash can.

I do not have access to a Mac computer so hoping there is some software that can recognize HFS+ and scan and recover deleted files?

I have TransMac installed in order to see and browse the Mac partition, but nothing to scan and salvage any data from it!

 

[Markverhyden]

http://www.r-tt.com/

 

[phaZed]

+1 on Mark's recommendation. Also, virtually any Linux distro will allow for HFS+. Make sure 'hfsprogs' is installed and your good to go.

If it's an HFS+ Journaled partition you may have a heck of a time, however.

 

[300DDR]

RS will only recover ALL files, not just deleted. So, the lost files will be recovered (if possible), but there will be a lot of data to sift through. To recover only deleted files from HFS+ you'll need to use Data Rescue 4 on a Mac.

 

[TurricanII]

Try loading up the free FTK Imager program and open (i.e. 'Add') the Mac drive.It will let you pull files from Linux and Mac drives in Windows. This has been handy when our Windows clients are sent USB formatted drives from Mac users.

I do recall seeing an orphaned files folder or similar - and it does seem to let you recover deleted files although I have not done it:

http://accessdata.com/product-download/digital-forensics/ftk-imager-version-3.4.2

http://www.computersecuritystudent.com/FORENSICS/FTK/IMAGER/FTK_IMG_313/lesson2/index.html

 

[Computer Bloke]

If you're trying to recover deleted Mac files from a Windows machine then you're doing it the hard way. And if you're upgrading your client's Mac's memory then you do have access to a Mac, and an excellent reason to use it.

You'll find it much easier if you clone the drive first and then use the Mac version of R-Studio (which is awesome) or something similar to recover the deleted files from the copy. That way you can install the software on your client's computer and recover data directly onto it without overwriting the file fragments you're trying to recover, but I'm sure you already know that.

Native tools tend to work better than cross-platform ones. There's no good reason for this, it's just true!

 

[d3v]

Hello guys sorry I havn't concluded this thread in a timely manner.

What I did was use R-Studio to deep scan and then set it to search for all JPG files. The result was roughly 120 thousand images, which I then painstakingly sorted to around 2000 to spare the lady the trouble of doing it herself! The main method I used to get rid of the bulk was to sort the images by filesize and delete all that were under 20kb, which got rid of the majority of them. Then it was a case of every now and then I'd spend an hour or so just manually deleting the crap, being careful not to delete legitimate photos.

As for getting the Mac up and running I downloaded Lion OS X which figuring that anything later than 2011 may not work on this mid-2007 mac. Once downloaded I used TransMac to burn the dmg to a duel layer DVD and then simply held down command and booted to the CD to finally reinstall OS X.

What a relief!


p.s having read through the comments here it is obvious that I've a lot to learn when it comes to Mac's and look forward to implementing these solutions with any future Mac's I get, which is not often compared to Windows PC's.

 

[Computer Bloke]

What I did was use R-Studio ... What a relief!

Excellent result! Was this the Mac or Windows version of R-Studio?

Either way, I think you did the right thing to reinstall Lion - one of the more stable versions of OSX in my experience and well suited to a machine of that age. The chances are that the machine originally ran Leopard (10.5) but the only advantage of that is that it supports PowerPC applications - it's unlikely that you'll find many people still running these, but there's always one!

If you're likely to get more Mac work then it's definitely worth investing in a fairly recent used Mac to play on, ideally running Mavericks or later. Many Mac users seem to have inflated ideas about how much their old machines are worth but if you keep an eye out there are some bargains around.

 

[Markverhyden]

Great to hear!

 

[altrenda]

Thanks for the update. good work.

If you're likely to get more Mac work then it's definitely worth investing in a fairly recent used Mac to play on, ideally running Mavericks or later. Many Mac users seem to have inflated ideas about how much their old machines are worth but if you keep an eye out there are some bargains around.

Great advice and a true statement. Apple charges premium prices and people are told that Macs hold their value, but they are often overpriced on the resale market.