Macfilter: accidental time machine format

April 9, 2009 7:41 AM

A friend plugged his Seagate usb external drive into a MacBook Pro and then somehow inadvertantly accepted a prompt to set the drive up for Time Machine backups without thinking. The drive hasn't been written to since then. Is there a way to get the original data back (there's no backup, of course)? Failing that, any recommendations for data recovery services in the UK?
posted by amestoy to computers & internet (9 comments total)

I fixed the same (well, they said the same thing to me) problem recently.

The actual problem was that spotlight started running on the drive, they unplugged the drive without unmounting it, and it trashed the FAT.

Solution? Restore the second FAT.

How? Stick it in a Linux box, you'll see all your files if I'm right. If you don't, you could try a fsck OR use something like photorec. Make a copy of the disk before trying the fsck.
posted by devnull at 7:53 AM on April 9

I've had great results with Photorec so I'll second that. I had a user delete all photos off a camera card and PhotoRec restored them. Also had a user who's document was deleted right off the desktop and PhotoRec restored not only the most recent save of it, but also all previous saves she had done to it. It's a great piece of software that has come in handy many times, and it's free.
posted by genial at 8:13 AM on April 9

Seconding genial - TestDisk by the same guys is also very useful.

Also, Disk Warrior is extremely good, if you can get your hands on a copy.
posted by djgh at 8:35 AM on April 9

I'm pretty sure DiskWarrior can't repair damaged directories on FAT32 volumes, only HFS and HFS+.

Both Stellar Phoenix and Prosoft's Data Rescue II can help you to pull files from a volume that's been damaged as you describe.
posted by mrbarrett.com at 11:37 AM on April 9

I'm confused by your description of what happened; accepting a prompt to use a drive for Time Machine should not affect any data that's currently on the drive. It just uses whatever unused space is on the drive to backup the computer it's attached to.

From Help doc "About Time Machine":

Time Machine works best if you use your backup disk only for Time Machine backups. If you keep files on your backup disk, Time Machine won’t back up those files, and the space available for Time Machine backups will be reduced.

You say "the drive hasn't been written to since then"; is it possible that your friend was only assuming that it was trashed?
posted by SomePerlGeek at 1:18 PM on April 9

SomePerlGeek, if the drive was FAT32 formatted, Time Machine can and will format it to HFS+ so it's compatible....if the user tells it to. It's not completely clear in the instructions that this is what's happening, but I've seen it happen on many systems, so I know it can and does happen. Technically, Time Machine isn't the thing doing the formatting, but the Unix hdiutil command (which Disk Utility also uses). I suspect that you can probably see logs of the formatting in system.log in Console.app if you so choose.

Yes, the description of the problem isn't clear, but what I *think* happened is that the user plugged in a FAT32 volume and Time Machine said, "Hey, do you want to use this to back up to?" And the user said, "Sure" and so Time Machine then told hdiutil to format the drive to HFS+ so it could be used for Time Machine backups.
posted by mrbarrett.com at 3:24 PM on April 9

My friend says the external drive was originally formatted for a Mac, but can't say for sure which file system. He says what happened was he plugged the drive into the MacBook, it asked if he wanted to use the drive for Time Machine, he said yes, and then in 2 seconds the drive showed as empty.

I don't use a Mac myself, but from my reading around, as SomePerlGeek says TM shouldn't overwrite any existing data, but if the file system was not HFS then it would reformat. Is that a likely explanation of what he saw? Would a FAT32 drive have been readable on the Mac, assuming he was able to see the files on it before TM kicked in?

To complicate things further, he doesn't have access to the MBP now, only a Vista laptop, (which I also have) but we can probably borrow a Mac from somewhere. As PhotoRec has Windows version that may be worth a try as well.
posted by amestoy at 2:12 AM on April 10

amestoy: I would ignore what your friend said. Stick it in a Linux box, see what he's really done.
posted by devnull at 5:25 AM on April 10

Yes, a FAT32 drive is readable by Mac OS X. Most people can't really even tell the difference and the OS presents HFS+ and FAT32 as the same thing to the user. You can see the volume type in Disk Utility or by Getting Info on the volume's icon on the Desktop.

There's a program for Windows called MacDrive that will let his Vista laptop read and write to an HFS+ formatted volume.
posted by mrbarrett.com at 2:40 PM on April 10