November 27, 2004

9:29 AM

Data recovery, OS X, on an accidentally initialized hard drive. The guy at the shop has informed my brother that files are basically unrecoverable under those circumstances - something to do with how OS X installs a new system or some such. Is this so?
posted by furiousthought to (8 comments total)

More info:

- It's a G4 running Panther and it's the internal drive that's been accidentally initialized.

- The computer is at a general repair shop for another issue - the Firewire bus wasn't being recognized, which is the problem that set off the chain of events leading to the inadvertent wiping of the drive. The shop also offers data recovery, but I have vague suspicions about their competence in that field. I just don't know, however, never having managed to pull this stunt myself.

- It's for my brother, not me, so yelling at me to back up my data will do little good. Though here, I'll do it for you: BACK UP YOUR DATA.

- He hasn't done anything on this computer since the initialization and reinstall of the new system.

- Mainly, he's trying to recover image files, a few movie files, and his e-mails.

- The only information I can seem to get elsewhere goes: Use Data Rescue X, or try drivesavers.com. I'm looking for something a little more enlightening about what his chances are for recovering any of his files and whether the guy at the repair shop is full of crap or not. Help?
posted by furiousthought at 9:30 AM on November 27, 2004

I've done full data recovery on drives that don't mount, but never on an initialized drive. That said, I do know a little bit more about data recovery than I've actually had to use. I'm a little unclear as to the situation though. Was the drive only initialized? How? Is there a different startup disk? Was the system software actually reinstalled on the disk in question?

Basically, if the drive was simply initialized and nothing else has been written to the drive, it would seem like you should be able to recover data without too much trouble, as long the "zero all data" option wasn't used in the initialization. If that option was used and/or data such as a new system has been written to the drive, you are going to have to decide how much the data is worth to you.

It seems as though it's almost always possible to recover data from a drive, but it may not be worth the cost. I've heard figures that even if you zero the drive and fill it up again seven times and then break the actual disks, forensics experts can still retrieve data from the drive. I'm sure there are companies out there that can provide this service to end users as well.

If you're worried about the skills of the shop in question, don't let them near the drive. You'll be much better off just removing the drive and taking it to a good specialist. Hope that helps some...
posted by spaghetti at 10:37 AM on November 27, 2004

I'd bet that the guy is right.. if it was formatted (or repartitioned) and then OS X put back on it, the filesystem allocation tables won't have anything saying the file even exists. (On FAT filesystems, files were deleted by marking the filename in a certain way and clearing the entry in the allocation table - not sure if this is how HFS/HFS+/Journaled HFS works but it's probably pretty similar.) A program like Data Rescue X will (it seems) just read the raw data off the disk and try to recover stuff that way. The key is to not use the computer until you get the software - the more you use it, the more new data gets laid on top of the old and the harder it is to recover anything. If he just installed OS X, then he should be pretty OK, since I'll bet it's sitting on top of his old OS X installation anyway. But, still better to leave the machine off - modern OSes write stuff to disk a lot now (think swapping) even if you leave them alone.

There is (was?) an option to zero data before formatting - I don't remember it existing on OS X, just on OSes previous, but it may still be there. If that option was checked, you're pretty hosed. A standard HFS format will just lay down filesystem structure type data on the drive and not diddle with anything else on there - if you zero the data though it'll also write zeros to every location on the disk that it can get to.

(on preview: stupid phone :-)
posted by mrg at 10:37 AM on November 27, 2004

Tech Fusion is supposed to be pretty good and they don't charge you if they can't recover your data. You might do well to give them a call at least and tell them the situation.
posted by spaghetti at 10:41 AM on November 27, 2004

Hosed with a capital H O S E D.

Accidently initialising a drive is pretty hard to do; that's so sad, and i'm sorry to hear it happened.

A data recovery MIGHT get bits and pieces off some of the sectors that haven't been overwritten, but they are also exorbitantly expensive. I looked into recovering less than one gig of data from a borked fiwi drive.. they wanted about 650$CN for the attempt and the first 500 MB.
posted by reflecked at 11:45 AM on November 27, 2004

There is (was?) an option to zero data before formatting - I don't remember it existing on OS X, just on OSes previous, but it may still be there.

Not only is it still there, but it's been joined by a military-grade option to write random data over the entire disk 8 times before initializing. If the former was checked, recovering any data would be extremely unlikely; if the latter, pretty much impossible.

However, if neither of these is the case, there's still a good chance you can recover most of the data. The trouble is the reinstalled OS -- the chances that the OS files happen to reside in exactly the same sectors as before are very very small. So you're going to lose some data, for sure.

Whatever you do, don't boot from the initialized drive. Every time you do, you'll lose a little more data.

The data you have the best chance of recovering is the email, unless he was unfortunate enough to be using Entourage, in which case it's the data you have the worst chance of recovering. You're slightly more likely to be able to recover images than movies, but it really depends on the file formats.

If there has been no physical damage to the drive, don't bother with a data recovery service. Instead, get Data Rescue X -- it's designed to recover data with no directory or file allocation info.
posted by jjg at 1:19 PM on November 27, 2004

Okay, I'm back now...

Near as I can tell, and I wasn't walking him through this when it happened, my brother accidentally clicked an "erase and install" option when trying to do a clean install ("archive and install", is it, on Panther? I myself have Jaguar), and then, due to fatigue or desperation or not paying attention or whatever, clicked through the warnings that said You Are About To Do Something Really Bad and boom. He does have a new install of OS X on that drive. The drive is not physically damaged.

I'd be real surprised if any zero-all-data options were checked off. It was an accidental event and my brother's not that computer-illiterate.

The computer has only been booted once or twice since then, unless the shop has booted the computer from the internal drive, which I suppose is possible. I told him not to touch it as soon as I heard - I'm aware of how much OS X uses the hard drive.

He used Mail.app, not Entourage or anything, so there's that at least.

So, what I'm getting is: recovery of data is unlikely (because OS X writes six bazillion little files per install, basically) and if it's possible, there's nothing a drive recovery service can do that Data Rescue X or the like can't, given that there's been no physical damage to the drive. Does that cover it or is there something else I should know?
posted by furiousthought at 6:14 PM on November 27, 2004

Heh. What happened:

The repair shop was able to recover 25 gigs of data. Was it the data my brother needed? That remains to be seen.

The repair shop was unable to fix the Firewire problem! They swapped out all possible parts and could not figure it out. As far as my brother is concerned, God has decided that somebody had better pay a computer shop $250, and there he was. : P
posted by furiousthought at 8:29 PM on November 30, 2004