Recovering from HFS+ mirror

Discussions on using the professional data recovery program R-STUDIO for RAID re-construction, NAS recovery, and recovery of various disk and volume managers: Windows storage spaces, Apple volumes, and Linux Logical Volume Manager.
Ken Draper
Posts: 1
Joined: Mon Dec 28, 2015 7:18 pm

Recovering from HFS+ mirror

Post by Ken Draper » Mon Dec 28, 2015 9:46 pm

Hi, I'm recovering data from an HFS+ mirror using R-Studio 7.7.159851 on Windows. This was an external Maxtor OneTouch III Turbo (1T capacity, 2x 500GB Seagate 7200.10 disks) formatted as a RAID 1 mirror (~500G storage capacity).

Previously, I'd copied files directly from the external device over USB, using Mediafour MacDrive, but a lot of files could not be copied. These same files could not be copied from the external array using R-Studio, but I was able to recover them after pulling the discs from the enclosure (getting to that).

I disassembled the external enclosure and imaged each disc separately in R-Studio, so that I could work with the images and not risk further damage to the actual disks. After, I could see that my problem files were present on one image and not the other. I successfully recovered the specific files that I was after.

Now I need to recover the rest of the data (the entire HFS+ partition), but I'm not sure if I have a correct understanding of how Virtual Mirrors work. I've scanned each disk image separately and saved the scan info in a side file. Then I created a Virtual Mirror and dragged in the Apple_HFS_Untitled_1 HFS+ filesystem from each.

Do I need to rescan the Virtual Mirror if the separate images have already been scanned? Also is there a way to compare the images to get diff results? When I restore from the volume in the Virtual Mirror, will it automatically retrieve sectors from both images? Most of the RAID documentation seems to deal with more complex RAID sets.

The screenshot below shows the images and Virtual Mirror pair.



Posts: 220
Joined: Tue Oct 20, 2015 10:13 am
Location: Providence, RI USA

Re: Recovering from HFS+ mirror

Post by Data-Medics » Mon Jan 11, 2016 10:55 am

If you're finding data on the one drive that isn't on the other (I'm guessing it's just zeros where there should be data), then I'd say it's safe to assume that the drive had been offline for some time and is out of sync. I think your best result will be to just recover all the data from the drive which has the most current data. I generally do this by sorting by creation date to see how long ago it went offline. For mirror sets, I generally just recover the latest one independently. Trying to read them as a mirror set when they are de-synchronized will result in issues.

Post Reply