Unable to see Mac's directory structure with R-studio

[Zin Ho]

Hello all, 

I am trying to recovery a deleted file from a Mac's SDD. I scanned the clone drive with RStudio and for some reason, it doesn't build the directory structure for me. See attached of a screenshot from RStuido. When I click into one of the partitions, I only see Extra Found Files and Metafiles. All files under Extra Found Files have numbers as the file name.

What am I doing wrong? If you need more information, let me know. TIA!

[Carlos Marmolejos]

It is possible you have an encrypted HDD there. Try to write that img to a physical drive and mount it at an apple system. 

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To post to this group, send email to datarecovery...@googlegroups.com.
Visit this group at https://groups.google.com/group/datarecoverycertification.
For more options, visit https://groups.google.com/d/optout.

--

Carlos Marmolejos Data Recovery Engineer + DR Data Recovery Telf: 809 533 1679 Email: sop...@datarecovery.com.do Web: www.datarecovery.com.do Dirección: Avenida Tiradentes, esq. Presidente González. Plaza Galerías de Naco, local C-4, Santo Domingo, 10122 ​ Salva un árbol, no imprimas este mensaje si no es necesario Think green. Do not print if it is not necesary.

Síguenos por:

[hdd_Sand]

This type of SSD has TRIM enable, when you delete a file or format the drive it will wipe it almost immediately.

[t...@desertdatarecovery.com]

As Carlos has already said it could be encrypted, so make a clone (not an image) and load it on a Mac, it should recognize the encryption and mount the drive for you.

 

It also looks like you are using a very old version of R-Studio which does not recognize APFS which is Apples new file system. So download a new copy of R-Studio and use it in demo mode, at least you will know if its APFS.

 

And as the other Carlos said (I might change my name to Carlos too…) if its HFS/APFS and an SSD, the data is more than likely unrecoverable.

--

[Zin Ho]

My first thought when I saw the SSD was the chance of recovery is slim to none because of trim. I won't know unless I give it a good old college try.  As for the version of R-Studio, you are correct. That is the copy I got from Scott's course, about 4-5 years ago. Thank you all for the valuable information.     

On Friday, August 31, 2018 at 1:11:02 PM UTC-7, Tim wrote:

As Carlos has already said it could be encrypted, so make a clone (not an image) and load it on a Mac, it should recognize the encryption and mount the drive for you.

 

It also looks like you are using a very old version of R-Studio which does not recognize APFS which is Apples new file system. So download a new copy of R-Studio and use it in demo mode, at least you will know if its APFS.

 

And as the other Carlos said (I might change my name to Carlos too…) if its HFS/APFS and an SSD, the data is more than likely unrecoverable.

 

 

From: datarecovery...@googlegroups.com <datarecovery...@googlegroups.com> On Behalf Of Zin Ho
Sent: Friday, August 31, 2018 12:37 PM
To: DataRecoveryCertification <datarecovery...@googlegroups.com>
Subject: Unable to see Mac's directory structure with R-studio

 

Hello all, 

 

I am trying to recovery a deleted file from a Mac's SDD. I scanned the clone drive with RStudio and for some reason, it doesn't build the directory structure for me. See attached of a screenshot from RStuido. When I click into one of the partitions, I only see Extra Found Files and Metafiles. All files under Extra Found Files have numbers as the file name.

 

What am I doing wrong? If you need more information, let me know. TIA!

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.

To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertification+unsub...@googlegroups.com.

[Zin Ho]

Tim, you are correct! The new version of R-Studio detects the file format correctly. It now shows up as APFS. Thank you!

[t...@desertdatarecovery.com]

No problem. At least you will get a new version of R-Studio out of it 😊

 

 

From: datarecovery...@googlegroups.com <datarecovery...@googlegroups.com> On Behalf Of Zin Ho
Sent: Friday, August 31, 2018 1:58 PM
To: DataRecoveryCertification <datarecovery...@googlegroups.com>
Subject: Re: Unable to see Mac's directory structure with R-studio

 

Tim, you are correct! The new version of R-Studio detects the file format correctly. It now shows up as APFS. Thank you!

On Friday, August 31, 2018 at 1:43:23 PM UTC-7, Zin Ho wrote:

My first thought when I saw the SSD was the chance of recovery is slim to none because of trim. I won't know unless I give it a good old college try.  As for the version of R-Studio, you are correct. That is the copy I got from Scott's course, about 4-5 years ago. Thank you all for the valuable information.     

On Friday, August 31, 2018 at 1:11:02 PM UTC-7, Tim wrote:

As Carlos has already said it could be encrypted, so make a clone (not an image) and load it on a Mac, it should recognize the encryption and mount the drive for you.

 

It also looks like you are using a very old version of R-Studio which does not recognize APFS which is Apples new file system. So download a new copy of R-Studio and use it in demo mode, at least you will know if its APFS.

 

And as the other Carlos said (I might change my name to Carlos too…) if its HFS/APFS and an SSD, the data is more than likely unrecoverable.

 

 

From: datarecovery...@googlegroups.com <datarecovery...@googlegroups.com> On Behalf Of Zin Ho
Sent: Friday, August 31, 2018 12:37 PM
To: DataRecoveryCertification <datarecovery...@googlegroups.com>
Subject: Unable to see Mac's directory structure with R-studio

 

Hello all, 

 

I am trying to recovery a deleted file from a Mac's SDD. I scanned the clone drive with RStudio and for some reason, it doesn't build the directory structure for me. See attached of a screenshot from RStuido. When I click into one of the partitions, I only see Extra Found Files and Metafiles. All files under Extra Found Files have numbers as the file name.

 

What am I doing wrong? If you need more information, let me know. TIA!

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.

To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To post to this group, send email to datarecovery...@googlegroups.com.
Visit this group at https://groups.google.com/group/datarecoverycertification.
For more options, visit https://groups.google.com/d/optout.

--

You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.

To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

[TrumanHW]

Tim's a damned genius. 

CONFIDENTIALITY NOTICE: 

The contents of this email message and any attachments are intended solely for the addressee(s) and may contain confidential and/or privileged information and may be legally protected from disclosure. If you are not the intended recipient of this message or their agent, or if this message has been addressed to you in error, please immediately alert the sender by reply email and then delete this message and any attachments. If you are not the intended recipient, you are hereby notified that any use, dissemination, copying, or storage of this message or its attachments is strictly prohibited.