Can't find my files, wrong offset ?

malakov · September 08, 2019, 06:51:01 AM

Hi all,

I've been throught the first and second step with HFS+ Rescue, but when using the --list parameter, I can't see my files.
I've read and tried the "Find the HFS+ Volume Header or Alternate Volume Header and the partition start offset". The first Volume Header offset is 0, that's what I used for the s1 step, which took almost 12hours and found many files (not so many, around 2xxx), but not my precious datas.
The first Alternate Volume Header offset is 4096, and when I try step one (s1) with this offset, it seems quite unhappy about it : unknown signature.
In fact, I tried other offset, trying to remove the --first option from the --find-vh command line, they all seem to have a provide signature, but when using their offset for step one, it ends with an unknown signature.
I know my files are I there, cause I did use another software before on this disk and it was able to list my files. Just, this software can't restore the structure of directories, with I need.

So my question is : how can I find the right offset ? Both volume header and alternate volume header (with --first) gave me wrong offset.

Thank you all in advance !

Malakov.

Elmar · September 09, 2019, 09:34:29 AM

Hello,

after the first try, did you also run -s2 (step 2) before you used --list?

Best regards
Elmar

malakov · September 09, 2019, 11:53:37 AM

Hello Elmar,

Yes, I dis step 2 :-)

Best Regards,
Malakov.

Elmar · September 09, 2019, 11:58:55 AM

When files are found during -s1, then the are available with --list after -s2 has been done. Please try it again.

Best regards
Elmar

malakov · September 09, 2019, 13:48:43 PM

If you mean using hfsprescue --list right after s1, I did it and I can't find my files.
Is that what you mean ?

Elmar · September 09, 2019, 13:55:16 PM

Quote from: malakov on September 09, 2019, 13:48:43 PM
If you mean using hfsprescue --list right after s1, I did it and I can't find my files.
Is that what you mean ?

First you have to complete s1 (takes much time)
Then you have to complete s2 (takes a few seconds)
Then you can use --list

malakov · September 09, 2019, 15:37:20 PM

Yes, that's what I did, that was my introduction sentence : "I've been throught the first and second step"

s1 took about 11 hours.
s2 was almost instant.
Then I used --list, and I can't find any of my files.

Elmar · September 09, 2019, 17:50:00 PM

Do you mean with "my files" you personal files or any file on the drive?

malakov · September 13, 2019, 09:45:30 AM

I mean my personnal files

I find files on the drive, like usual working files from different softwares, but not my datas.
For example, I'm searching for some JPG files, but I can only find 4 JPG, all belonging to a software (background.jpg for example).
That's why I think I'm mis-using your soft and thought of a wrong offset.

Elmar · September 13, 2019, 09:56:52 AM

Okay, when other files have been found but not yours, then this means that either

the wrong partition has been scanned
or the partition table is defect and not the whole partition has been scanned
or my program is not able to detect your files

What was the reason for the defect file system?

malakov · September 13, 2019, 14:51:47 PM

I wanted to save my whole disk, but I mistakenly formatted the source disk

So, the partition was formatted. Once I realized that, I just unplugged the disk. I haven't copy or installed anything on it, in order to be able to recover my files.
There is only one partition on the disk, that tooks all the available space, 3Tb. So I guess that invalidates the "wrong partition has been scanned" possibility.
so, remains :
- the partition table is defect and not the whole partition has been scanned : I think the whole partition was scanned, since your programs cleverly displays the amound of data scanned. And it scanned almost 3Tb, which should corresponds to all the disk.
- my program is not able to detect your files : maybe, but I really hope not

. So far, your program is the most promissing, and seems the most serious software available for HFSP partitions. If yours can't, I guess none can. Which would be a pity cause it's not just some songs or party photo's, it's my work, my job on it. I erased it all be mistake, thinking I was formatting my new disk to save all my precious work.

Elmar · September 13, 2019, 19:30:00 PM

Difficult situation, especially I am not in front of your computer. I am sure, you would have said if it is the case, but anyway I ask. Did you use any encryption or other security methods or another coding than UTF-8?

What OS version was running?

If you not already did, then buy an external USB drive and make a sector based copy of the defect drive. I will give you support for the copy process.