A really technical HDD recovery

[lotsoflemon]

Okay, so I am basically ****ed if this is impossible. I am looking for highly competent people, and i'm willing to pay if someone can point me in the right direction.

I have an internal 500 Gb drive with a 488 Gb partition. This partition contains a lot of very large video files, some +20 Gb. It also contains FCPX projects and events data. I think the power was cut during sleep. When i waked up my Mac Pro, the disk was unmountable.

1. The disk is visible in Disk Util, but the repair option gives the dreaded "B-tree node size error".
2. I checked for physical errors. SMART is clean and the other smaller partition on the drive is doing just fine.
3. I started scanning with Data Rescue 3. I got most of the video files out, EXCEPT certain ones that is unplayable. I have a feeling these are the files that were open in FCPX.
4. I opened up the damaged files in Treasured (a fantastic program for video recovery). It generates preview images of certain frames. This is were it looked bad: the files contain mostly the right data, except for around 10-20% of the time. This data was either "missing" or actual video from some of the other video files.
5. From this, i conclude that i have an error in the directory (what data goes in what files). FCPX was probably writing to it at the time of the crash, so now certain portions of the disk i somewhat unorganised. However, given that the actual problems are so few (10-20% of 10% of the files), maybe this is quite a simple error, but in the worst possible place.
   
6. So i boot up with my trusty Disk Warrior, as this is designed to fix directory errors.
   
   Weird sidenote: version 4.3 recognizes the disk and scan it, no prob (remember it doesn't mount), but version 4.4 doesn't even see the disk. Hm?
   
   Disk Warrior rebuilds the disk with no waiting time. I will provide a picture with the results, if necessary (didn't take one unfortunately). BUT most of the video files, even the ones that Data Rescue got right, are shortened to around 14,3 Mb. So Disk Warrior is unable to find the original error, instead it tries to fix the results of the error. Of course i don't replace with the new directory

So i start thinking about some sort of manual repair. I start reading about how HFS+ is structured and so forth; essentially a waste of time given my non-existent background in the area. This would also require a complete bit-for-bit backup of the drive, something i understand the UNIX command dd can facilitate. But can this work on an unmountable disk? And is there anyone out there with the sufficient knowledge (of HFS+, how the directory is read and written, what errors may arise), capable of assisting me?

As mentioned, I am willing to pay for this, if the answer can be found. Not a lot, but I really need these files.

Please let me know, if you know someone who can fix this. Either on this board or elsewhere (or IRL). Thank you.

 

[switon]

RE: perhaps mount it on another system...

Hi,

First of all, I am not the "highly competent" person you are looking for...given that, I would suggest the following strategy.

I take it from your description that this 500GB drive is not your boot drive. Take it out of your Mac Pro and put it in an external drive case. Try to mount it on another machine, such as a Linux box. The Linux box may be able to mount it even though Mac OS X cannot, and then you can use "dd" to extract a block copy of your corrupted drive. You might also try "ditto" to copy files off of the corrupted drive, "ditto" is fairly robust and won't halt when it fails to copy a single corrupted file.

Or, take your corrupted drive to a professional service that specializes in retrieving data from corrupted drives (this will be expensive).

Good luck,
Switon

 

[lotsoflemon]

Thank you switon.

Great advice! Instead of switching the drive though, i am downloading a bootable Linux DVD (KNOPPIX). This should be faster, but give me the same results. I will post my findings.

Yes, that will be the unfortunate alternative...

Thank you!

 

[lotsoflemon]

When i try to mount the volume in KNOPPIX, i get
Error mounting: mount exited with exit code 1

dmesg tail gives me
[ 309.982701] hfs: Filesystem was not cleanly unmounted, running fsck.hfsplus is recommended. mounting read-only.
[ 310.002186] hfs: invalid extent max_key_len 54463
[ 310.002194] hfs: failed to load extents file

What does this say about the nature of the corruption?

 

[switon]

RE: fsck...

Hi,

Can you run the fsck.hfsplus utility? It might be able to repair the extents file, but I don't hold out much hope, but you never know until you try.

Switon

 

[lotsoflemon]

Hi.

I'd rather not, given that this might write to the disk, making things worse. Or will it only read?

I am calling some professional data recovery guys tomorrow.

 

[switon]

RE: fsck ...

Hi,

You can have fsck simply look for and record the type of volume errors, or you can have it attempt to correct simple problems.

Switon