Recovery from Apple Fusion

[slingshot]

Have had this case come in, DM has failed heads possibly with media damage but the SSD is functional.
Fusion setup of 128GB / 3 TB (ST3000DM001).

Not done one of these fusion recoveries before so not entirely sure how to go about stitching them back together once imaged etc.

Does anybody have any experience of these please ?

 

[Amarbir[CDR-Labs]]

Hello,
I See a Lot of Interesting Stuff Here -> https://www.youtube.com/channel/UCjeQEm ... -Han-11LgQ .BTW My suggestion is that you work on the 3TB first and only attempt this if te 3TB is Cloned ,These Models Are a Nightmare

 

[datahaze]

I had a similar case recently. R-Studio and PC-3000 RAID can both work with fusion drives, though in my case the FS/Partition table was damaged so R-studio didn't recognize it as a fusion drive. Luckily with Macs, file carving tends to work pretty well due to less fragmentation than NTFS. The SSD will only have the most frequently accessed files on it, the bulk of them will be on the HDD assuming they store more data than the SSD can hold.

Edit: If you can image both drives and don't have DR tools to re-build the Fusion drive, you can always attach both images to a Mac and make an image from the Disk Utility.

 

[slingshot]

":2b4aeb0q]Hello,
I See a Lot of Interesting Stuff Here -> https://www.youtube.com/channel/UCjeQEm ... -Han-11LgQ .BTW My suggestion is that you work on the 3TB first and only attempt this if te 3TB is Cloned ,These Models Are a Nightmare

Thanks Amarbir, tried that but it doesn't seem to be very helpful in my case (not sure why yet)

 

[slingshot]

I had a similar case recently. R-Studio and PC-3000 RAID can both work with fusion drives, though in my case the FS/Partition table was damaged so R-studio didn't recognize it as a fusion drive. Luckily with Macs, file carving tends to work pretty well due to less fragmentation than NTFS. The SSD will only have the most frequently accessed files on it, the bulk of them will be on the HDD assuming they store more data than the SSD can hold.

Edit: If you can image both drives and don't have DR tools to re-build the Fusion drive, you can always attach both images to a Mac and make an image from the Disk Utility.

I've only got the standard PC-3000 so thats not much use in this case of fusion rebuilding, however, I did try some things with R-Studio and it didn't reveal anything other than the 2 separate drives etc.

There is some strange goings on that Ive noticed though. The SSD is APFS yet the spinner is HFS+, I can only assume the customer has upgraded an OSX installation to High Sierra / Mojave and that has only converted the SSD side of things to APFS. I wonder if this is whats causing me some headache with it ? Can you marry up 2 different file systems ?

Im back in the office on Monday and will post some screen shots of the Mac utility with images attached, I did try to coerce the Mac to do some fusion mating but to no joy :lol:

I only need to get the iPhoto stack from the setup but its not on the SSD side of it as its way too small.

 

[Amarbir[CDR-Labs]]

Well,
Thats what i said work on That POS 3TB first ,If you can make that work and clone it then we bother of al these ,The creater of UFS is great i can talk to him to help you incase you are interested but get that 3tb of its feet .75% it will have platter damage :mrgreen:

 

[slingshot]

So far I am losing this battle

Imaged the spinner on the 3K, head #2 is horrible but will read using the utility option, haven't read the entire platter for head #2 as it will take forever.

Imaged onto 4TB bare metal and set max LBA.

The partition on the spinner is messed up but partition analysis does give me a full file structure.



Recovering the user data from this doesn't give any errors. All file names, sizes etc. are fine, yet none of the files will open in their respective programs.

Try and use a Mac to see if it will give me any results from connecting both the SSD and the HDD.... Nothing, although I can boot from the SSD, log in etc. only basic data contained on the SSD. (I no longer have the original iMac so was using a MacBook Pro for this exercise, maybe part of the problem ?)

So, move onto this video and recovery explorer pro[bbvideo=560,315]https://www.youtube.com/watch?v=HIfx8xPH8D0[/bbvideo]

Imaged the SSD with RE pro (the SSD is healthy) and connected both drives to it



Followed instruction on the video but theres some options I am not presented with and also theres a difference in file systems :?

On the SSD I only have 2 partitions and not 3. Right clicking on the data partition (APFS) doesn't give me the option to open as a apple core storage volume so I can't make a virtual partition.



And the hex trick doesn't work either as I only have zeros at that address.



I am at a loss with this one and would appreciate any info pointing me in the direction of solving this beast.

Thanks guys.

 

[datahaze]

My guess is that the LBA's the HFS FS is saying files exist at only make sense when both drives are in the picture, hence why all the files are coming out garbage. You can always do carving.

 

[slingshot]

My guess is that the LBA's the HFS FS is saying files exist at only make sense when both drives are in the picture, hence why all the files are coming out garbage. You can always do carving.

You could be right, I re-read your original post and I will try to create an image (using utility) from both drives within OSX tomorrow.
I'm thinking I'll have to use high Sierra to do it as 1 volume is APFS.

What version of R-Studio do you use ? And are you using the Mac version of that to recognise 'fusion' drives ?

Edit:- what is carving, I don't know anything about such a term but am willing to try it

 

[datahaze]

My guess is that the LBA's the HFS FS is saying files exist at only make sense when both drives are in the picture, hence why all the files are coming out garbage. You can always do carving.

You could be right, I re-read your original post and I will try to create an image (using utility) from both drives within OSX tomorrow.
I'm thinking I'll have to use high Sierra to do it as 1 volume is APFS.

What version of R-Studio do you use ? And are you using the Mac version of that to recognise 'fusion' drives ?

If you look at a particular file's record, you should be able to see the LBA range, if it's negative or beyond the range of that particular drive, it's most certainly what I'm describing here. Luckily HFS+ doesn't fragment much (not sure about APFS), so carving works well for it. I believe all versions of R-Studio should recognize fusion drives but I'm not 100% positive on that. You can always try the trial version on a Mac to see if it recognizes any differently.