Anatomy of a Hard Drive

Anatomy of a Hard Drive

Why did my Hard Drive Fail?

Why did my Hard Drive Fail?

A-Z of Data Recovery

A-Z of Data Recovery

Send Us a Drive

Send Us Your Drive

Data Recovery Guides

Data Recovery Guide

Data Recovery Guide Volumn 2

Apple Mac Data Recovery

We perform data recovery from all Apple Mac computers, servers and storage devices. This includes recovery from:

  • Macbook, Macbook Pro and Macbook Air
  • iMac Apple Desktop and Mac Mini
  • Mac Pro Desktops and Servers
  • Apple iPhone 3, 4, 4S and 5
  • Apple Time Capsule
  • Apple Airport Extreme Time Capsule
  • Mac Formatted External Drives (Western Digital, Seagate etc)
  • Mac Formatted NAS and Thunderbolt drives (such as LaCie, G-Tech, Netgear, Buffalo and Iomega)
  • Full RAID 0,1, 0+1,1+0, 5, 6 and 10 Recovery Service

We work with all versions of Mac OS including OS X Server.

We have extensive experience recovering files types such as:

  • Adobe Photoshop Files
  • Adobe Illustrator Files
  • Adobe Dreamweaver Files
  • Adobe InDesign Files
  • Word, Excel, Powerpoint and Outlook Files
  • PDF Documents
  • .JPEG and RAW Image Files
  • Mac Mail and Thunderbird Files
  • Avid and SonyVegas Files

Reasons for Data Loss from Mac Formatted Partitions (HFS)

Physical Hard Drive Defects

The hard drives used in Mac computers are almost physically identical to those used in windows-based computers. (The only physical difference you will find with Mac hard drives is that they have a tiny temperature sensor attached to them). Mac hard drives are susceptible to similar physical problems that befall other drives. These include problems such as head crashes, bad sectors, stiction problems, preamplifier failure and spindle motor failure.

Symptoms of physical failure include:

  • Your Mac Hard Drive is Making a Clicking Noise
  • Your Mac Hard Drive is making a Buzzing Noise
  • Your Mac Hard Drive will not Mount
  • Flashing Question Mark on Start-up

Electronic Problems with Mac Hard Drives

Mac hard drives (like those used by other manufacturers) are susceptible to electronic failure. Typically, these include issues with the micro-controller chip, transient voltage suppressor issues and inductor issues.

Logical Problems with Mac Hard Drives

Most Mac hard drives use the HFS+ file system. This is a fast and relatively efficient file system. In the context of data recovery it has its unique challenges and foibles. These include:

Catalog File Corruption

Catalog files store records for each file and directory on the volume. Their function is similar to the role of the Master File Table on NTFS formatted drives. Catalog files were introduced into the HFS file system because they make finding and indexing files more efficient. The first catalog file can be found on the volume header. The other catalog files are stored in the catalog record segment of the volume. The catalog file consists of four different node types including the header node, leaf nodes, index and map nodes These nodes organise data on a Mac hard drive in a specific order. If the catalog nodes on a HFS formatted hard drive gets deleted or corrupted, it is possible your data will become inaccessible.

Journal File Corruption

HFS+ is a journaled file system. This means special files (called Journal files!) store information about the current working state of a hard drive. If your Mac computer has to suddenly restart, due to sudden power loss, for example, the Journal files help reinstate your file system to the state it was in before the sudden shut-down. However, under certain circumstances, the journaling system on your Mac drive goes corrupt. The can render your drive un-mountable and your data inaccessible.

Resizing Volumes

Another instance that can lead to data inaccessibility on your Mac is when resizing operations go wrong. Resizing allows users to expand a partition on their hard drive. Extreme care must be taken during the resizing process. Otherwise, a botched resizing operation can lead to partition loss. In these cases, the data recovery technician will endeavour to undo the resize operation or rebuild the partition.

Common Error Messages caused by failing Mac Hard Drives

Error # 1 Kernel Panic Error Messages

Figure 1- A typical Kernel Panic Message

A kernel panic is usually indicative of:

  • Corrupted or Incompatible kernel extensions.
  • A faulty logicboard or CPU.
  • Incorrect permissions set on disk.
  • A failed hard drive.
  • A faulty RAM module
  • Incompatible third-party drivers from printers, wireless keyboards etc.

Error # 2 - The Flashing Question Mark

Figure 2 - The Flashing Question Mark screen

A flashing question mark after you boot up your Mac can be indicative of many problems. These include:

  • The hard drive is failing or has failed.
  • The boot sector of your Mac cannot be read.
  • System files needed to boot-up successfully are corrupt or missing.
  • The connection between your hard drive and motherboard has been lost.

Error # 3 - "The disk you inserted is not readable by this computer"

Figure 3 - disk not readable error message

This message can be a sign that:

  • The volume header data is corrupt.
  • The Catalog file is corrupt.
  • The drive has bad sectors.
  • The drive has one or more bad heads.
  • The drive has firmware issues.

Good to Know about Mac Data Recovery and the HFS+ File System

Mac OS X is a UNIX-based operating system. Data recovery for Mac-based computers will require a technician who is knowledgeable with UNIX-based system.

Figure 4 - The HFS+ File System as used by Apple Mac

The file system used by the majority of Apple Mac computers and storage devices is the HFS+ file system. This file system has seven main components. These are:

1)      volume header

2)      allocation file

3)      catalog file

4)      extents overflow file

5)      attributes file

6)      startup file

7)      Journal file

For data recovery purposes, knowledge of these files and file organisation is important.

The Volume header contains data about allocation block size and location of metafiles.

The Allocation file is a bit map which tracks the allocation status of each block of the volume.

The Catalog file describes the folder and file structure on a volume. It contains all the metadata about files created on a Mac. The catalog files can tell the data recovery technician when files were modified, accessed, created and other user information.

Extents Overflow File - This contains records for forks that have more than eight extents assigned to them. Only volumes with extensive fragmentation will have a substantial extents overflow file.

The Attributes File is used to store extra attributes about files.

The Startup File is used to hold information when booting from a non-HFS+ system.

Journal File - The journal files records all blocks that are updated during each read/write cycle.

HFS+ files may have any number of data streams called forks associated with it. The two principle forks are the data fork and the resource fork. Generally, the data fork holds the actual file content, while the resource fork will be empty or contain non-critical metadata.

Figure 5 - The Read Process fof HFS+

Data Recovery of Deleted Files on a Mac

Recovery of files from HFS+ formatted drives (as used by Mac) is very different to recovery from NTFS (as used by Windows). This is because the Catalog File (the file that is similar to a table of contents for a Mac hard drive) is overwritten very soon after it is deleted from the file system.

Simple Mac Data Recovery

There are several ways in which to delete files under Mac OS X. The user can drag-and-drop a file to the Trash folder or can use CTRL-click the touchpad / mouse to display the "Move to Trash" option. These two methods are similar to moving a file to the Recycle Bin under a Windows-based PC.

A file moved to the "Thrash" folder is not actually deleted. A copy of the file will still be located on allocated space your hard drive and can be recovered by going to the Thrash (.Thrash) folder and dragging the file-to-be-recovered out of it. Even if your deleted files cannot be recovered from the Thrash folder, there is still hope of successful recovery.

Logical Mac Data Recovery

There are several strategies that can be employed when performing data recovery for Mac hard drives. One such strategy is using HFS+ Journal files to aid recovery. They can be used to find catalog records that can lead the technician to deleted or orphaned files. This is because the Journal file keeps a record of blocks that are updated during a read/write cycle.  

How Mac data can be recovered using the HFS+ Journal file.

1)      The technician will access the volume header.

2)      Find the location of the Journal file using the volume header.

3)      Analysis of the Journal file ( commencing at the oldest transaction)

4)      Identification of B-tree nodes belonging to the catalog file.

5)      Once Catalog files are found within the B-tress nodes, analysis of its records for lost files can start.

6)      If records for missing or deleted files are found, data recovery efforts can be concentrated on these files.

Data Loss Prevention the Apple Way

Of all the large computer manufacturers Apple has been most proactive when it comes to the prevention of data loss.

Apple are one of the few mass-scale computer manufacturers who have included a sudden motion sensor as standard on their laptop systems. (Toshiba offer the Hard Drive Impact Sensor, and Lenovo offer their Active Protection System but they do not come as standard). A sudden motion sensor uses an accelerometer to detect sudden acceleration of your Mac computer. If you Mac takes an accidental fall from, let's say a table, the SMS disengages the hard disk head from the disk platters helping to prevent data loss. From our experience, this system works fairly well.

Apple is only mass-scale computer manufacturer to include a physical sensor on their computer systems to monitor hard drive temperature. This is badly needed on all computer systems. Here at Drive Rescue Data Recovery, every week we come across drives which have failed due to thermal stress. When the temperature of your hard drive does exceed the SOA (safe operating area) the user gets a warning.

One cannot talk about Apple and data loss prevention in any meaningful way without mentioning Time Machine back-up. This software is well written and makes the backup process as painless as possible. The user- friendly "timeline" restore points (the ability to pick a certain point in time to restore back to) makes restoration easy and intuitive. This software has proved so popular among users that many other backup software producers are beginning to emulate the timeline restoration concept. Time Machine software can be setup with an Apple Time Capsule, Airport Extreme or with a standard external hard drive that is HFS formatted.

Even though Time Machine software has a justified following among Apple enthusiasts and power users, one should not be lulled into a false sense of security. (Overconfidence and data backup strategies were never happy bedfellows) Time Machine is a pierce of software that backs-up to a Time Capsule or to a standard external hard drive. Software, no matter how well written, can develop undiscovered bugs and not function properly. This can lead to data loss. The Time Capsule when opened up contains a standard hard drive. This presents the Apple user with two points of potential failure: software and hardware. This is why you should use a second backup application and backup to a second location. For example, you might use Super Duper in addition to Time Machine to backup to a second storage device (which you keep in a different location). Alternatively, you could use a quality online backup application such as Crashplan to work alongside Time Machine.

Data Recovery from an Apple Time Capsule - Mini Case Study

Figure 6 - An Opened Apple Time Capsule

We were dealing with the owner of a graphic design company who, two months previous, had experienced a hard drive failure on his iMac computer. No problem, he thought. He had a Time Capsule backup which everything stored on it. He acquired a new iMac and got it setup. He was extremely busy meeting deadlines on different projects. One month passed and he went to restore the Time Machine but it would not restore. On recommendation of his I.T. support company, he brought the two failed drives to us. As both drives contained the same data, it was up to us to decide which would be a better candidate for a successful recovery. We examined both drives. The drive from his iMac has complete failure of all six heads and they were stuck to the drive platters. The Seagate drive from his Time Capsule, also had failed heads (3 in total), but were parked in the landing zone area of the drive. We performed a complete head stack replacement. We fully recovered his data from his failed Time Capsule. All his data including over 1.5 TB of Adobe Photoshop, InDesign and Illustrator files were recovered and presented to the delighted customer.

Frequently Asked Questions about Mac Data Recovery

When I start up my iMac, all I get is a grey screen with an icon of a flashing question mark?

The flashing question mark upon start-up of a Mac system usually means that it cannot identify any bootable device. This can mean the volume header of your Mac has been corrupted, the firmware of the drive is corrupt, the connection between the hard drive and logicboard has been lost or the drive has suffered physical failure.

I have been told that the heads in my Mac formatted drive have failed. Do you do this kind of recovery and what does it involve?

We perform data recovery from hard drives with failed heads in our Class-100 clean room on an ongoing basis. The process for hard disk head replacement involves:

1)      Diagnosis of the Problem.

2)      Communication with you regarding recovery cost.

3)      Upon job approval, the recovery process commences.

4)      The old head disk assembly is removed in our clean-room.

5)      Replica drive heads fitted and calibrated to same parameters as old drive.

6)      Imaging for drive.

7)      Extraction of data and verification of its integrity.

8)      Delivery to You.

In a certain cases, a process known as drive head remapping can be used to perform a data recovery thus negating the need for a complete hard disk assembly replacement. At all times, we try to minimise the cost to the client while employing recovery techniques that maximise the probability of a successful outcome.

I have a G-Tech Hitachi RAID 5 device in my office. One of the disks has failed. Do you perform RAID data recovery for Apple Mac formatted drives?

Yes, we offer a full RAID 5 recovery service with excellent success rates.

The light is flashing on my external drive but I cannot access any of the data?

The flashing light on your external drive does not really purvey a lot of information except that power is going into the hard drive enclosure. You can listen to the drive when it initialises which might give you a better idea of the drive's physical health. If you hear any clicking or buzzing noises, it is possible there are physical or electronic issues with your drive.

When I connect by external Mac formatted drive to my Mac I get the message "the disk you inserted is not readable by this computer"?

This can be a sign that your hard drive is failing or has failed. However, you might want to try to see if Disk Utility (that comes with Mac OS X) can repair the disk first.

I bought a new Seagate external drive for my Mac. I formatted it in HFS+ so it would be Mac compatible. Unfortunately, I accidentally formatted the old drive instead. Can you retrieve data from it?

We recover data from accidentally Mac formatted drives. If this has happened to you, stop using the drive immediately as you risk over-writing your data.

I am trying to use Disk Utility to fix a disk that I think might be damaged. However, this utility freezes every time it starts checking the catalog file?

When Disk Utility fails you can run File System Check using Terminal. Start your Mac holding down the Apple key +S. At the command prompt, type in "fsck-Fy". If this does not work, it is possible that your Mac OS X partition is corrupted or there is a more serious problem with your disk. There are mechanical and electronic problems that can affect drives that cannot be fixed logically (i.e. using software).

Everytime I connect my LaCie USB hard drive into my Mac a process named fsck_hfs starts?

This is possibly a sign that your external drive has some bad sectors, a corrupt file system or there is an issue with the controller inside the drives housing.

I have a 2TB Western Digital drive with a Time Machine backup stored on it. The drive freezes my Mountain Lion operating system everytime that I connect the drive?

Disk Utility can repair hard drives that have a slightly damaged file system. To perform this check, open up Disk Utility. Then drag the Sparseimage file into the left-pane of Disk Utility. The process can be slow but sometimes worthwhile for reparation of light logical damage.

Is it true that if you accidentally drop your Macbook, your hard drive has a better chance of not being damaged than a Windows laptop?

Apple uses a Sudden Motion Sensor. If your computer accidentally falls, this device will send a signal to your hard drive to disengage the drive heads from the drive platters. This can reduce the probability of a head-crash damaging your Mac hard drive. Unfortunately, not all Windows-based laptops have this feature.