Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

TestDisk & PhotoRec, Data Recovery

For those new to data recovery . . .
  • Don't do any further writing to the disk (or partition) with the deleted files.
  • Downloading TestDisk or PhotoRec to a USB device or different partition.
Don't know which program to use?
  • PhotoRec is file data recovery software designed to recover lost files including video, documents and archives.
  • TestDisk is powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again
 
  • Like
Reactions: bobesch
I have a problem.

Good news: Photorec can find lost DV files (like those from old iMovie Version up to iMovieHD6). Successfully (StellarPhoenix Mac data recovery did fail in that attempt only finding like one frame of every movie)

Bad news (and here is my question: what should I do?):
1. my internal drive with the OS had something over 100GB free space, now it has ca. 200MB free space left, but I can't find any data that has been added to this drive. How do I find them and how do I free the disc space?
2. Photorec writes the recovered files in a subdirectory that it names recup_dir.1, recup_dir.2 and so on. My destination HDD, where the recovered files should go has subdirectories (folders) starting with recup_dir.15 ... to recup_dir.72. Where are recup_dir.1 etc?

I had
- MacintoshHD (my OS, 500GB, over 100GB free)
- "OhneTitel" (the HDD that files had to be recovered from)
- "OhneTitel1" (the HDD, where the recovered files should be saved)

I didn't select MacintoshHD for Photorec, so it can't be holding the recup_dir.x files, I guess.

During the recovery process, after pass1 the Mac GUI (Photorec itself runs in Terminal sudo) gave a notice that informed about not enough buffer (allthough I had 16GB RAM) and that therefore the recovery would take longer. The only option available was "close window". So I did. I assumed that it is now using the 500GB MacintoshHD as some kind of swap or RAM, hence the free space filling up, until 200MB left.
After pass1 I was again asked to select a destination drive, this time i created a folder on my OhneTitel1 drive and selected that. It began to write the recup_dir.15 onwards then during pass2.
After pass2 a run named bruteforce started, which looped and I learned (googled) that this happens with bigger drives and bruteforce should nly be used for small flash drives.

I am doing this on my Intel Mac with 10.9, but I decided I would post it in my somewhat "Home"-Subforum, the PowerPC community ;) since there is already a thread here, that I remembered.

EDIT:
an App called DaisyDisk helped me to find a hidden directory on MacintoshHD, that is not visible in Finder (maybe the swap file of photorec?).
The directory is -> MacintoshHD -> Volumes -> recup_dir14

unfortunately there is no directory "Volumes" in Finder. How do I get there, now?
 
Last edited:
Cox Orange said:
I have a problem.

Good news: Photorec can find lost DV files (like those from old iMovie Version up to iMovieHD6). Successfully (StellarPhoenix Mac data recovery did fail in that attempt only finding like one frame of every movie)

Bad news (and here is my question: what should I do?):
1. my internal drive with the OS had something over 100GB free space, now it has ca. 200MB free space left, but I can't find any data that has been added to this drive. How do I find them and how do I free the disc space?
2. Photorec writes the recovered files in a subdirectory that it names recup_dir.1, recup_dir.2 and so on. My destination HDD, where the recovered files should go has subdirectories (folders) starting with recup_dir.15 ... to recup_dir.72. Where are recup_dir.1 etc?

I had
- MacintoshHD (my OS, 500GB, over 100GB free)
- "OhneTitel" (the HDD that files had to be recovered from)
- "OhneTitel1" (the HDD, where the recovered files should be saved)

I didn't select MacintoshHD for Photorec, so it can't be holding the recup_dir.x files, I guess.

During the recovery process, after pass1 the Mac GUI (Photorec itself runs in Terminal sudo) gave a notice that informed about not enough buffer (allthough I had 16GB RAM) and that therefore the recovery would take longer. The only option available was "close window". So I did. I assumed that it is now using the 500GB MacintoshHD as some kind of swap or RAM, hence the free space filling up, until 200MB left.
After pass1 I was again asked to select a destination drive, this time i created a folder on my OhneTitel1 drive and selected that. It began to write the recup_dir.15 onwards then during pass2.
After pass2 a run named bruteforce started, which looped and I learned (googled) that this happens with bigger drives and bruteforce should nly be used for small flash drives.

I am doing this on my Intel Mac with 10.9, but I decided I would post it in my somewhat "Home"-Subforum, the PowerPC community ;) since there is already a thread here, that I remembered.

EDIT:
an App called DaisyDisk helped me to find a hidden directory on MacintoshHD, that is not visible in Finder (maybe the swap file of photorec?).
The directory is -> MacintoshHD -> Volumes -> recup_dir14

unfortunately there is no directory "Volumes" in Finder. How do I get there, now?
Click to expand...
try Volumes -> MacintoshHD ->recup
 
Yes, but how do I navigate there? Or make them visible outside of DaisyDisk?

PS:
I found out that Photorec formed a logical entity out of two drives. It used the 100GB internal free space and the 2.16TB external free space and made them one Volume. How do I know this?

internal drive holds: all folders recup_dir.1 to 14 and a portion of the recup_dir.15
external drive holds all recup_dir.16 to 71 and a portion of recup_dir.15

It is obviously wrong for Photorec or my Mac to think that there exists a volume that is a combined volume out of the internal and external drive.

I also don't know why Photorec did this. Because I only selected the external drive for destination of the recovery (the external drive is clearly different from the internal, because of the names and the capacity, so I can't have selected the wrong HDD.
 
Last edited:
It may be of limited value but these two commands allow you to see hidden system files in Finder:

defaults write com.apple.finder AppleShowAllFiles TRUE
killall Finder

Appending to TRUE returns Finder to normal behaviour.
 
  • Like
Reactions: Cox Orange
Thanks dronecatcher, how and do I type this in Terminal (or where)?

It bugs me how Photorec could form a striped volume out of MacintoshHD and the external destination drive. In terminal I only selected the external drive which was extinguishable by the shere size (500GB internal and 3TB external), so I can't have chosen the wrong one.
[doublepost=1465134312][/doublepost]PS: when I try to move the recup_dir.14 folder (found in MacintoshHD->Volumes) DaisyDisk tells me that you should not delete these files, because MacintoshHD needs them.
Why does it need them? When it is no system files?
 
I can't express how much I'd like to thank you! :)

The folder "volume" now shows up in Finder MacintoshHD -> "Volumes"
in it there is the recup_dir folders typical for photorec. They make up 81GB and I am currently moving them away from my internal Drive to an external drive.
However, knowing that I had arround 100GB of free space on MacintoshHD I assume that there must be at least 10GB more somewhere else and I have the feeling that the folder MacintoshHD->"private" has grown. Can I somehow find out, what is necessary for my system and what is "junk"?
In private there are these folders (according to Finder):
etc (3MB)
tftpboot (0KB)
tmp (0KB)
var (12,38GB)

Can I somehow tell him to just show everything that was added after 3rd of June 2016?

DaisyDisk showed large swapfiles in total of 12GB. Shouldn't a swap file be automatically deleted after some time, or lets say altered. I imagine it like: there is a swapfile that holds all actions of your last session and you did so much stuff, that you wrote like 12GB of data. Then you shut down your Mac and do a session with just writing 1 email. There now should be a new swap file that is very small like it saved, when you opened your mail client, wrote the mail, send it etc. -> Or is this wrong?

Wait, I'll come back and post more info from DaisyDisk...
 
PS: the trash still being emptied. I will have to wait till it's finished, so I can open DaisyDisk again. I'll come back then...

Edit:
Update

so, now that the files are deleted there is still 20GB of free space that I am missing from before the photorec recovery.

The biggest file that DaisyDisk finds are now:
MacintoshHD/private/var/vm
inside are
- sleepimage 8.5GB
- swapfile1 1,1GB
- swapfile0 67MB

Can I change any of them? Shouldn't they change (increasing and decreasing in size) once the Mac has been restarted several times and I have done different stuff?
 
Last edited:
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back