Data recovery, Urgent

Discussion in 'MacBook' started by rabinzx, Nov 26, 2011.

  1. rabinzx macrumors newbie

    Nov 26, 2011
    I was helping a friend deleting windows 7 on his bootcamp. She told me after that, merge the empty space back to Mac volume. The computer is Macbook in 2008~09, 160 toshiba hard drive, running leopard. While deleting, I notice the volume of location where win7 installed is kind of wired.

    the bootcamp volume is located within Leopard's volume, and every time the computer restart, the "bootcamp" volume will show up on the desktop (even if I turned off SHOW hard disk on desktop in Finder).
    And there is another small volume with bootcamp volume ( I remember it was 100mb)

    First I checked bootcamp, and it didn't give me nothing, so I decided format the bootcamp volume along with the small volume.
    Right after I delete the bootcamp volume, the system gives me error message. I thought it was because the small volume, so I delete the small one too. Then the two volume were combined.

    next, I tried merge the empty volume into Mac's volume in Disk Utility, but system says "this partition canot be modified" so I have to restart see if it would let me merge after restart.
    Just for the record, at this moment, the Mac system was perfectly fine.

    After restart, screen says "error, cannot find system", so I tried Leopard installation CD, log into disk utility.
    It shows ONLY one volume (the one I formated - bootcamp) under hard drive. And the size of it is 159gb out of 160gb.
    I clearly remember the distribution before reboot was:
    Hard Drive:
    1. Mac - 99GB
    2. Empty (bootcamp) - 60gb

    Guess what? My friend just recall she had some important picture stuck in iPhoto.

    Now, I am trying to recovery the volume by connecting the 2.5" notebook drive to my PC, but waiting for shipping of a 2.5/3.5 HDD adapter?

    I know there is some command under Terminal that can fix some volume issues. But I dont know exactly what they are. Additional, I never used the "erase" function while formatting.

    What should I do now? Can someone point me to the correct direction? What is the chance I recovering those pictures?
  2. Macman45 macrumors G5


    Jul 29, 2011
    Somewhere Back In The Long Ago
    It Doesn't Sound Good

    Have you tried repairing the disk using Disk Utility? If you can boot with your SL disk, you can access DU and try a repair. I hope it works, but have a bad feeling about this. Let us know how you go.
  3. rabinzx thread starter macrumors newbie

    Nov 26, 2011
    i tried, says ok. dont know why.

    Attached Files:

  4. Macman45 macrumors G5


    Jul 29, 2011
    Somewhere Back In The Long Ago
    Looks Like

    A re-install to me I'm afraid. Seems like your OSX got trashed....No consolation, but I really hate bootcamp....I know why people do it, but all my mac's are just that...Macs.

    If the photos were really important you could contact a third party data recovery service, but they are REALLY expensive. Sorry I couldn't be of more help.
  5. mixel macrumors 65816


    Jan 12, 2006
    Leeds, UK
    For future reference the easiest way to get rid of a Bootcamp partition is using Bootcamp Assistant - it'll automatically resize the osX partition to fill the space. The small partitions that are on the drive should be left well alone. it seems to make at least one tiny one for windows and (in Lion) a recovery partition. The only time you can usually see them is in the Windows installer.

    Good luck recovering files using a recovery tool. I actually think you'll probably have a lot of success with that.. I've managed to recover important stuff in pretty dire situations. At least by breaking the partition table (or whatever happened) you haven't been able to overwrite any data.

    Tell your friend to set up a Time Machine backup too. :) its too cheap not to and works well over the network.
  6. ibuyufo macrumors 6502

    Sep 22, 2007
    You erased your EFI partition. You could buy or borrow another hard drive and install osx then convert the messed up drive into an external drive and copy off all the files.
  7. rabinzx thread starter macrumors newbie

    Nov 26, 2011
    Frist, I'd like to thank you all brilliant minds, ideas and super fast reply.

    Reply to Macman45:The reason my friend has to run windows on a mac is because she has to run certain software on her laptop.

    Reply to Mixel: you are absolutely right. I checked my bootcamp assistant, there is an option to remove bootcamp. But like I said, when I check her laptop, there is no such option, that is why I move on to Disk Utility. Her bootcamp installation location was really wired.
    And I will definitely tell my friend about the Time Machine. I personally dont use that because I put all the Docs in Dropbox, and I have a 1Tb external Hard drive constantly backs up my files.

    Reply to ibuyufo: you are right about me deleting the EFI thing, but I dont think I was supposed to see EFI under Disk Utility. I usually see my own EFI when I press option during rebooting, it's named "Lion Recovery" But I never see it disk utility. In my mac, I can only see my "500Gb toshiba" (Mac) and "Bootcamp" ( Windows )
    The small Volume was named something else.

    Does anyone have more experience of working on EFI? What is the consequence of deleting that? damaging volume table?
    It seems like all the volume merges together in one volume, and it's mostly empty.
    Was my old file (the one on Mac) just hidden in the volume?
    If yes, how can I recovery it?

    All I actually need is like 20 pics from iPhoto library.

    Attached Files:

  8. rabinzx thread starter macrumors newbie

    Nov 26, 2011
    Hey guys , I am back. After 3 days of exhausting recovery.
    I was able to get some data back by using Data Rescue 3.2

    First, I used some other tools to make a image of my 160gb HDD, and put it into my 1TB external hard drive. (To do so could prevent making any mistakes on original HDD )

    Second, mount the image on my macbook pro, then deep scan the image (the light scan doesn't help much). It takes about 3hrs, after that takes another 3hrs to transfer recovered files to my external hard drive.

    I was able to recover 70,000 images, but the ones I need were not among them.
    It is under 'E:\Users\Lan\Desktop\Recovered Files-1\Scan 4\Found Files\empty\Users\mandy\Pictures\iPhoto Library\Originals"

    ignore the part says "E:\Users\Lan\Desktop\Recovered Files-1\Scan 4\Found Files\" because this is where the image path.

    so basically I was trying to recover the photo stuck in the iPhoto Library.
    Every time I try to recovery it, it was gives me an error message at about 96%
    and leave me with me a blank extension file called "iPhoto Library" with the same size as the file I was trying to recover.

    I tried copy a pdf file from mac to PC, and use repair software to repair it, the tool says " I dont have permission"

    All the file I found under the old volume cannot be recovered.

    I really dont know what I should do now.

    Attached Files:

  9. iThinkergoiMac macrumors 68030

    Jan 20, 2010
    There is no such thing as an "EFI partition". I think you mean the OP erased ALL the partitions, including the system partition.

    As there seems to be some confusion as to what EFI is, I'll briefly explain. EFI = Extensible Firmware Interface. It has nothing to do with the hard drive, which is the only thing affected in this thread. rabinzx, this is why you didn't see anything under "EFI" when you listed the partitions of the drive, because it wouldn't show up. The EFI provides similar functions that the BIOS does on Windows machines that use it (most of them).

    Not a lot. You can try multiple times, but you're unlikely to be successful. Maybe someone else here with more experience will have other advice.

    The best thing you can do is learn to do backups from here on out.
  10. rabinzx thread starter macrumors newbie

    Nov 26, 2011
    Thank you.
    I do know what EFI is, coz I have installed Mac iOS in PC through Vmware (editing needed)

    But what I am really frustrating about is that those file are now gona, they are sitting right there. They just wont open after I recover them.
    I was able to recover over 70,000 pics, some of them are deleted years ago.

    it just seems like, if I can get the tool to fix the partition, then I will be abel to log back in there.
  11. rabinzx, Dec 2, 2011
    Last edited: Dec 2, 2011

    rabinzx thread starter macrumors newbie

    Nov 26, 2011
    Alright guys,
    After days of fighting with my lost volume, I was able to get all of my data back.

    The tools I have used:
    1. Disk Drill ( latest version1.5, Full version, also called Pro version)
    2. Data Rescue 3.2 full version (latest version able at this time is 3.2.1)
    3. FileSalvage (latest version 7.0 Full version)
    4. Minitool Mac Data recovery 2.0 (free version --- limited to 1GB data recovery)

    Here is the full story:

    First, Let me start with explaining how these data recovery tool works:
    (Data Rescue and FileSalvage works almost the same)
    Data Rescue will recovery your lost/deleted data, and sort them into different categories(like picture, movies, documents). Then it will do a deeper level recovery, and try to show found data in the original path.

    So basically you will have two sets of data:
    1. randomly allocated, sort by data kinds.
    2. re-map data into original path.

    Next, The system would ask you to select the data will recover.
    At this point, the system would also ask you if you want to save session, PLEASE CLICK "SAVE".

    What it does is it basically create links between "Found data" and "the data location on the disk". So next time, you want to recover different data on the same disk, you don't have to go through the painful hours of waiting. One way to look at these sessions is to see them as a "Catalog" that has all the page number for your "Book" (disk).

    I. Comparison between Data Rescue and FileSalvage:
    Data Rescue has two sets of data; however, I only found randomly allocated data on FileSalvage.

    II. Comparison between Data Rescue and Minitool data recovery:
    Minitool is small and smart recovery tool. Since I didn't have the full version and not willing to spend another 3 hrs on something I can only recover 1GB.
    Hope someone who used it before can give some opinion.

    III. Last, I proudly to introduce you my life saver "Disk Drill"
    I does the similar things as other tools, but it has two basic difference:
    * It let you choose if you want to recover recent deleted data or deep disk scan
    ** It has its "Protection" feature. You can protect certain partition or disk in the future. For example, if you accidentally delete some data under a PROTECTED partition, or even you have had severe damage to the partition and lost the whole partition. You will be able to recover all the data as VERY FAST speed. In other word, you data is in good hands.

    IV. Disk Drill and Data Rescue found same or similar amount of data, but Disk Drill was able to recover all the data( Both two sets of data). On the other hand, Data Rescue was only able to recover partial of Randomly allocated data.

    For example:
    There are some data under the Randomly Allocated Set was partially damage. A image file was only recovered half of the picture, a Word,Excel document were shown as strange code that does not make any sense.
    Also, Data Rescue was not able to recover "the data under the original path" at All.
  12. ezramoore macrumors 6502a

    Mar 20, 2006
    Washington State
    Wow, for the price of purchasing all those applications you could have had that data professionally recovered and saved yourself one hell of a headache.
  13. Nameci macrumors 68000


    Oct 29, 2010
    The Philippines...
    Yes he could have saved a lot of headache but the amount of knowledge that he gained from it by doing so is priceless.
  14. ezramoore macrumors 6502a

    Mar 20, 2006
    Washington State
    I was snark-ily implying that he probably stole the software.

Share This Page