Don't ask me why but a client of mine updated their OS via recovery mode instead of a normal upgrade. Following that, they chose the option to restore data from a Time Machine backup (despite the fact that the computer already had all the current data on it). Surprise surprise, the most recent backup was 2 years ago. So the computer now has 2 year old data instead of current data and there's no more recent backup. Any hope for the data that was on the computer previously?
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Any chance for data recovery on this guy?
- Thread starter cameronjpu
- Start date
- Sort by reaction score
Not without spending a bunch of $$ at a data recovery service. Your client overwrote the data that was previously there with old data. No way to sort it out without professional data recovery.
I'm guessing no way.
If the computer is up and running, the disk contents are changing as long as it's up. Probably wiped a good deal (most?) away with the "update" and Time Machine copy.
If FileVault was turned on or Mac is T1/T2 equipped, then none of the original data will be recoverable: encrypted files and storage with keys wiped during "update".
If the computer is up and running, the disk contents are changing as long as it's up. Probably wiped a good deal (most?) away with the "update" and Time Machine copy.
If FileVault was turned on or Mac is T1/T2 equipped, then none of the original data will be recoverable: encrypted files and storage with keys wiped during "update".
You say your client restored from Time Machine but the data was already there. Unless your client formatted the drive first. It should still be there. As Time Machine restores don't delete what's already there. They create a new user folder and put the files in the new folder. So, check the user folders for the old user. Also check the drive for partitions/containers. In case they just made a new partition/container for the new install.
Once the data is written over it’s toast. I know that theoretically it is possible. But this was in the days of floppy disks and 100MB Hard Drives where the read head is placed off center to read the residual data. As storage density was so low. There was a lot of room for a residual magnetic signature.
My understanding is that even fifteen years ago. The chance of recovering a single bit was around 50%. You'd need to get eight in a row for a byte. Just think of how many you'd need for one file.
Maybe some government lab could work on it and get something. But it's not something economically feasible for a commercial data recovery lab.
If it's an SSD there's no chance I know of for overwritten data.
All else that may be left are some sporadic files here and there which weren't overwritten at all.
Once the data is written over it’s toast. I know that theoretically it is possible. But this was in the days of floppy disks and 100MB Hard Drives where the read head is placed off center to read the residual data. As storage density was so low. There was a lot of room for a residual magnetic signature.
My understanding is that even fifteen years ago. The chance of recovering a single bit was around 50%. You'd need to get eight in a row for a byte. Just think of how many you'd need for one file.
Maybe some government lab could work on it and get something. But it's not something economically feasible for a commercial data recovery lab.
If it's an SSD there's no chance I know of for overwritten data.
All else that may be left are some sporadic files here and there which weren't overwritten at all.
Yeah this was my big hope. Going to have a look now, just haven't had a chance yet. I'm hoping....
No surprise - bought and ran iBoySoft data recovery, and after 36 hours of running and restoring, it restored a bunch of files that looked promising but were corrupted. Womp womp. Can't imagine how one makes such an error. Running the OS upgrade doesn't invite you to restore via Time Machine backup. They must have done an internet recovery or something, which is senseless. The system had High Sierra on it, so it's not like they updated to current in the process. Ack.