Mac OS X – Notes for Data Recovery

Background to OS X: Mac OS X running the HFS+ volume is the most widely used of all Unix type operating systems. Many of Mac OS X’s key components are based upon Berkeley Software Distribution (BSD) operating system, which is a Unix based operating system (you may have heard the term ‘UNIX BASED’, or even seen it on the Apple website, Apple is very keen to get the UNIX reliability message across). Many elements of the BSD world are still apparent. The file permissions model, symbolic links, and user home directories are all concepts inherited from BSD. Being based on BSD means that OS X is more stable and has better memory and processor management. As most Mac users are aware OS X also gives the user the option of using UFS, a true UNIX file system providing greater compatibility with UNIX applications and other UNIX systems.

Brief File System History: Whilst many of Mac OS X’s traits have been borrowed from UNIX the default file system that Mac OS X uses is an advanced version of Apple’s own file system HFS (Hierarchical File System). First employed in 1986 when System 3 (OS 3) was released, HFS was introduced as a replacement to MFS (Macintosh File System) addressing some issues that MFS had encountered as time, and the systems MFS was used on, progressed.

As the amount of data on an MFS volume increased so did the need for quicker ways of finding it, HFS was needed to increase the speed of the System 3 Finder. In the original System 3 Finder each file on the system was catalogued in a single operating system file, every time a file was required the Mac had to search the contents of this system file until it found the location of the data required, this could often prove quite time consuming. HFS+ has taken the HFS file system one step further adding a number of changes that allow HFS to keep up with the times and improve compatibility with other systems. Although it is essentially the same, HFS+ offers larger file names and file sizes and supports Unicode making it more internationally friendly, the file system also offers meta-data extensions which may allow for future improvements or additions.

Data Recovery: Many of the advancements in Mac OS X are a positive hindrance to data recovery techniques, damaged Mac volumes are meandering and complex making tracking down the original directory and file structure difficult. Highly fragmented volumes are extremely difficult to piece together.

Trashed files are overwritten with random characters so as to make their recovery impossible. Also both copies of the volume header are destroyed during initialisation and formatting, making it impossible to work out how a drive was partitioned and without looking at the hard disk at a very low level. It even proves difficult to work out which of the two file systems the disk was using.

Data recovery from corrupt / initialised Mac OS X disks is not by any means impossible, it does however involve a lot more labour than recovery from a Windows or Linux partition. Whilst on an NTFS or many of the various Linux distribution file systems there are areas of the disk (and copies) specifically designed to store data about file and directory location, in an HFS+ partition this data is stored in a hierarchical tree structure, each directory or file within this structure has an inode number.

The inodes start with the root directory and then branch off to each of the sub-directories, which in turn branch off into their subdirectories and so on, if the top levels of this structure are damaged (as is often the case with the damaged Mac disks that we see), there is no pointer to the lower levels. This makes finding all of the data very difficult indeed.

Data Clinic have created specialist recovery software in-house that searches for traces of these inodes and recreates a directory structure using them, this complex procedure involves scanning the hard disk, firstly for all the unique signatures of these inodes & then for the routes in which their trees are spread across the disk. Our software and processes are based on research and in depth experience with Apple Mac volumes. Please call to find out what Data Clinic can do for you.