Time Machine Question

[Philip Shaw]

Good afternoon. A customer did a Time Machine backup on her Macbook Pro and then wiped the computer with the intention of loading the backup back to the computer (don't ask me why). It didn't work. I am looking at the external drive and it has three backups - previous, interrupted, and in progress. I can drill down to documents, pictures, etc. and see files but the first sector on all files points to garbage and the files are unopenable. A partial raw recovery gives me pictures and documents but it doesn't seem like a lot of stuff. Is there any hope of getting the folder structure to work?

Thanks. 

[Markus Bauer]

Try cloning the drive to another disk.

Run then one or more RAW-recoveries. Then connect it to a Mac and let the Mac run it's automatic repair. Most times that helps to get at least a partial useable filesystem. Sometimes restoring directly from finder results in a "folder is causing a circle" error.

You can try to run that Python script on the Mac: https://opensource-data-recovery-tools.com/scripts.php?t=Merge_time_machine_backup_folders 

That should give you all different versions of all files which are left by the automated repair. Hopefully that should give you some parts of the structure and all missing files could be found then in the RAW-recovery results. I often run multiple recoveries with multiple tools and merge them afterwords to increase the chance to recover all.  

That solution is not really elegant but the best I came up with when I faced a badly damaged FS of a TimeMachine backup. It would be better to repair the FS somehow bot that would take a lot of time and all tools I tested (DMDE, UFS, r-Studio and DiskDrill) failed on the case I had. You could try also "Data Rescue 5" according to Fraser. Maybe that helps in your case...

Good luck! 

[Alandata Recovery]

Speculating here but perhaps the iTunes backup works by first creating a directory structure and then filling in the file data

In that case the in progress and interrupted backups would have a bunch of pointers to files that are garbage

But the previous backup sounds like it's a complete one

So you could drill down into the previous directories files and see if those all look good

The in progress and interrupted backups probably have files that are good at the beginning where the beginning is in alphabetical or chronological order probably alphabetical so look to the end of the alphabet directories to see if those files are garbage compared to beginning of the alphabet files

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/10afa91d-37b4-4e63-ac8b-7738c0323061n%40googlegroups.com.

[Alandata Recovery]

Correction I meant time machine

[Markus Bauer]

@Alandata

That's basically exact what my script does - it restores the newest backup, then it merges it with the 2nd newest backup by comparing MD5 sums of files. Then it merges it with the next older backup, etc.

So finally you end up with all files from all backups without duplicate files. 

[t...@desertdatarecovery.com]

Great work Markus!

 

Tim Homer - Lead Engineer

Desert Data Recovery

t...@desertdatarecovery.com

www.desertdatarecovery.com

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/a025fbb8-aaec-43ff-a4d4-d770f1b766dan%40googlegroups.com.

[wayne horner]

wow that is just awesome !

Must take quite a while to run having to md5 hash every file.

You know what would be a cool trick....

If you could get the mac to give you the list of disk addresses for each file

then

for each file

  get filename + block-list and md5 hash it.

then

  to compare the newer version you just compare the hash of the blocklist

  if its the same disk addresses then its the same file.

seems simple but must be harder than it looks

even carbon copy cloner just says that it wont process backup folders.

apple has some weird kluge going where they hard/symboliic link directories through the .hfs-private/ folder 

Awesome script

and so small

need to learn me some python....

Alandata Data Recovery -  (949)287-3282  
"Cleanroom Data Recovery of RAID, VMware, Network Attached Storage, Linux, Tape, Disk, Forensics"

www.AlanData.com   www.AlanDataRecovery.com

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/011101d81461%2465562fc0%2430028f40%24%40desertdatarecovery.com.

[Markus Bauer]

Maybe it's not that hard but I am not the best coder and I don't mind wasting a few hours of computing time.

A script like that can be fiddled together in a very short time - maybe it's not the most efficient way to do it but I am also not sure if I will have such cases very often. I used MD5 as it's a pretty fast hash and in my opinion for that purpose still a valid choice. I would rather slap another pc together from old parts which I have laying arround and "loose" a few USD / month for the energy consumption of that extra PC instad of investing days or weeks in tweaking the scripts.

Python is not great performing but it's like lego and you basically glue already existing modules with a bit of your own code together to create a tool.