Recovery of files form Macintosh disks

Apple Macs use a file system called HFS, and HFS+.  CnW Recovery has routines to assist in reading and recovering such drives. The CnW, PC Windows program will often read and recover disks that standard Mac tools cannot touch.  Files recovered are stored on the PC, but fortunately, Macs can always read PC CDs and DVDs, so transfer back to a Mac is not an issue

Many Mac drives do start differently as they do not have a compatible boot sector, but a Mac drive will typically start with a sector where the first 2 bytes are always ‘ER’  The next few sectors start with the letters ‘PM’.  Details of partitions are stored in these sectors, but typically Mac disks only have a single partition.  CnW Recovery software will allow for 3 partitions.

Current Mac systems do have a more compatible master boot sector.  It has a single entry with a file partition type of 0xEE.  Following this sector are up to 31 partition sectors, and the first one always starts “EFI PART”.  Details of each logical partition are then stored in 128 byte entries.

When CnW reads a Mac disk it will detect that it is a Mac disk and go to the Macintosh Recovery screen where various parameters on the disk will be displayed.  This includes the option to scan the disk for existing partitions, as well as the ability to change the values for possible starts of a partition, block size and other parameters.

There three ways that files may be recovered, a full logical, a mode that extracts every leaf node from the catalog, and final one that scans the compete disk for catalog leaf nodes.  Where a complete directory path cannot be generated, dummy directory names will be created. There are several tools that allow for scanning of the disk and locating possible partition starts and catalog starts so that truly corrupted disk can still be recovered without too much trial and error.

Resource forks

A Mac stores data in two sections, a data fork and a resource fork. For most files the resource fork is empty, but for certain files, both forks exist. On the Mac, both forks are stored in the same file, and so only one name is used.  The method used to store these files on a PC is to use the AppleDouble format which is compatible with OS X.  This creates a separate file for each data fork, and each resource fork.  The resource fork file also contains metadata giving details of the application that should be used to open the file.  If the main file is testfile.doc, the the associated resource fork will be a hidden file ._testfile.doc

Copy problem - resolved

When copying files from a PC disk to a Mac it has been common to see the error message below displayed on the Mac

'The operation cannot be completed because you do not have sufficient privileges for some of the items'

CnW Recovery have worked on a solution that so far appears to help.  The problem has been tracked down to short cuts and hypertext links pointing to non existent files or applications.  To overcome this problem, CnW software now examines the resource forks of files being created and removes the ‘slnk’ and hlnk’ values in these files.  The current results are encouraging, and copy copies of recovered disks can now be performed with out stopping for errors.  A recent recovery involved copying 400GB of data from a CnW created NTFS disk of files to a Mac.  This copy proceeded without a pause, and all files copied.

Recovery from a Remote Wipe - it may be possible!


[CnW Recovery] [Downloads] [Purchase Now] [CnW Wizard] [User Manual] [Main menu] [Partitions] [Logs] [Hard drive recovery] [NTFS data recovery] [FAT data recovery] [Data carving] [exFAT] [CD ROM data recovery] [Photo Recovery] [Damaged disks] [Fragm'ted Files] [File Filter] [Deduplication] [File validation] [Deleted file recovery] [Macintosh] [Unix Recovery] [MTF .BKF] [CD and DVD output] [RAID disks] [Data repair] [Forensic DR] [Video recovery] [Forensic Tools] [What will it do?] [Product Details] [FAQ & Links] [Case Studies] [Technical Notes] [Updates] [Development] [Testimonials] [About us] [Site Map] [Contact Us]