Welcome to the MacNN Forums.

l008com · Feb 26, 2011, 05:33 PM

I have a 500 GB laptop SATA hard drive. Apple replaced it saying it was dead, and now I'm trying to recover data off of it. For speed, I installed it internally in my MBP, and booted the MBP off a separate volume with utilities installed. I've run every utility I know of and from what I can tell, this hard drive is in PERFECT health. Except for one thing, the data on it is completely scrambled. Disk Warrior does a last resort full drive scan, and comes up empty handed. Tech Tool's data recovery features are lame. But it's surface scan found not a single bad block. SMART Utility shows the drive in perfect health. Data Rescue scans the whole drive with a deep scan and can't find a single actual file.

I've never had a drive before that COULD spin up, but whose data was completely unrecoverable. This is very strange. Is there any other utility software that might be able to help?

(also don't bother praising Time Machine. This isn't my drive. And I can assure you all of my data is fully backed-up)

AKcrab · Feb 26, 2011, 05:53 PM

Is there even a remote possibility the drive was erased? Did you try having Data Rescue search for deleted files?

l008com · Feb 26, 2011, 05:55 PM

I doubt it was erased, you'd have to boot another disk to do that. And these days, most people don't even know their computers come with DVDs. I did try the deleted file search, but that failed quickly, and suggested I do the deep search.

reader50 · Feb 26, 2011, 06:20 PM

Use a block editor to check a few blocks at random. A problem in the control board may be eating the data. ie - formatting data is detected, all blocks look good. But all data comes back as solid zero's.

In such a case, you'd need to replace the board with an exact identical one, from the same drive model and revision. Or farm it out to a drive recovery company, and let them do it. For a ton of money.

If you can see raw data in the drive blocks, then the partition and directory data must be hosed pretty bad.

l008com · Feb 26, 2011, 06:30 PM

Know of a block editor app?

seanc · Feb 26, 2011, 07:12 PM

Head failure?

Do you have any partition information?
If no, testdisk may be your friend - see if it can find any partition information when you do a scan. If it finds something, consider writing it to disk.

If partition data but no files, try photorec for a scan of the HDD to see if it can find any data.

Final port of call - Seagate Data Recovery, be warned, it's not cheap.

l008com · Feb 26, 2011, 07:18 PM

Disk Utility says it is a GUID partitioned map, and it does see one unmountable HFS+ volume. Disk utility can't see the volume's name but other utilities can see it's name as Macintosh HD. I'll try that photorec software after data rescue finishes (trying again just for the hell of it). But I suspect they do basically the same thing and will have the same results. But we shall see.

reader50 · Feb 26, 2011, 07:19 PM

Originally Posted by l008com

Know of a block editor app?

iBored might do the trick. (Intel)
PPC here

seanc · Feb 26, 2011, 07:25 PM

So you've no reallocated or pending sectors shown in your SMART data?

You could try a normal scan with MHDD (I know you've tried TechTool) for the hell of it, just in case. MHDD will usually flag up a broken disk if it finds it can't read a block. If it does find a bad block, do the scan again with remap enabled.

l008com · Feb 26, 2011, 07:26 PM

Nope all blocks check out fine. Its the strangest thing. Its almost like the whole disk was encrypted.

seanc · Feb 26, 2011, 07:32 PM

Ask the customer if they were using TrueCrypt?

Does it somehow have a hard drive password set? Had an Acer Aspire 1 HDD that had perfect SMART data, but no/unreadable partition. Turned out it had a drive password set. Once I removed it, all was well.
You'd really need an Ubuntu CD and hdparm to check.

l008com · Feb 26, 2011, 07:35 PM

This was the only drive in a macbook pro. I know it was running os x, and it's highly unlikely they even knew what trucrypt was. But that being the case, the OS should at least be unencrypted, even if their home folder was, otherwise they machine wouldn't be useable at all.

seanc · Feb 26, 2011, 07:40 PM

Full disk encryption is possible with TrueCrypt on Windows. Absolutely everything encrypted.

On further research, I don't think TrueCrypt supports full drive encryption for OS X, but PGP does! Full disk encryption for desktops, laptops, and USB devices | Whole Disk Encryption

Lots of people have heard of PGP - you might as well ask. If they don't know anything about it, ask who set the laptop up, in case they have an IT dept/other friend.

l008com · Feb 26, 2011, 07:41 PM

I set up the laptop

seanc · Feb 26, 2011, 07:42 PM

Damn, well, that's me out of ideas for now...

l008com · Feb 26, 2011, 07:50 PM

iBored does show raw data. Data Rescue got nothing again. Scanning right now with a program called Boomerang. Then i'll try photorec.

reader50 · Feb 26, 2011, 08:09 PM

When you originally partitioned the drive (if you did it) did you use an unusual offset? ie - the working partition was not the first "real" partition on the drive. This can happen if you created more than one partition. Of if you used an uncommon partitioning utility.

Data Rescue needs the start index for the partition, otherwise all the directory pointers it finds are useless. DR starts with the most common value used by Disk Utility on a default 1-partition drive. If you used something different, you'll need to calibrate DR with the proper values.

l008com · Feb 26, 2011, 08:11 PM

I don't remember setting this specific machine up. But I'm sure I did what I always do. Use disk utility to make one HFS+ partition on a GUID setup. As basic as it gets. I wouldn't have done anything custom. Customer might have sliced a bootcamp partition out of the drive but that's all I'd expect.

l008com · Feb 27, 2011, 03:03 AM

Spoiler Alert!
The IT department had encrypted the whole drive. I wish the customer had told me that before I spent 3 days trying to recover data from it.

turtle777 · Feb 27, 2011, 03:22 AM

Did they ask you to recover, or was this a challenge you posed to yourself ?
(I'm assuming the latter)

PGP ?

-t

l008com · Feb 27, 2011, 03:25 AM

The computer stopped booting. Apple said the drive was dead and I was asked to recover personal files.

turtle777 · Feb 27, 2011, 03:54 AM

Originally Posted by l008com

The computer stopped booting. Apple said the drive was dead and I was asked to recover personal files.

Does that mean you get reimbursed for the time you spent on this wild goose chase ?

-t

l008com · Feb 27, 2011, 03:55 AM

We'll see.

seanc · Feb 27, 2011, 10:09 AM

Originally Posted by l008com

Spoiler Alert!
The IT department had encrypted the whole drive. I wish the customer had told me that before I spent 3 days trying to recover data from it.

Kerching!

Did they use PGP or something else?
I hope someone knows the password or has the private key to access the data.

ghporter · Feb 27, 2011, 10:17 AM

No key provided: charge for 3 days of wasted time. Key provided: charge for the wasted time, the copying of specified data and a surcharge for not letting you know the machine had been dinked with by someone other than you before you wasted your time. Don't make it a big surcharge, but even adding $25 to the bill for "failure to provide essential information about the equipment" may keep this from happening again. With this customer.

Tee · Feb 27, 2011, 11:46 AM

Was the original issue (inability to boot the system) caused by the PGP WDE/MacOS X Software Update conflict?
https://pgp.custhelp.com/app/answers/detail/a_id/2288

l008com · Feb 27, 2011, 03:22 PM

The original issue was that the computer wouldn't boot past the Apple logo.

Tee · Feb 28, 2011, 10:22 AM

Originally Posted by l008com

The original issue was that the computer wouldn't boot past the Apple logo.

Any idea what might have caused the drive (which was encrypted with PGP WDE) to fail to boot?

There was a big issue with PGP WDE a few months ago which made drives unbootable if Software Update was used to update the OS.
It is apparently fixable though.

l008com · Feb 28, 2011, 03:44 PM

Any little software glitch could cause it to hang at the apple logo. There no way to even make an educated guess, so I'm not even thinking about it.

indigoimac · Feb 28, 2011, 04:21 PM

Originally Posted by l008com

Any little software glitch could cause it to hang at the apple logo. There no way to even make an educated guess, so I'm not even thinking about it.

Sure there is -- boot in verbose mode.

l008com · Feb 28, 2011, 06:29 PM

I didn't have the computer, just the drive. I assume there must be something in the computer's firmware that can decrypt the drive. I'm sure my computer wouldn't boot off a drive it can't even see.