Recovery from Apple Fusion

[slingshot]

These LBA's are positive and within range of the drive (5 billion left after these)

I've got the network version of R-Studio on the 3K rig and I've also got the Mac version on the MacBook Pro.
Both of them just see both drives as independent drives, I haven't tried to create a virtual partition or anything.


Although R studio can't see the APFS partition as APFS ?

How do I carve files from these ?

 

[datahaze]

If you select the disks and do "scan" and "search for known file types", it will show a separate item that looks like a partition called "recognized files". That's the carved files. Photorec is also a good tool for this, which is free.

 

[slingshot]

If you select the disks and do "scan" and "search for known file types", it will show a separate item that looks like a partition called "recognized files". That's the carved files. Photorec is also a good tool for this, which is free.

Is this in R-Studio ?

 

[datahaze]

Yes

 

[slingshot]

ok cool, its only giving me a raw recovery option however testing a few jpegs and they open without issues. I'll try the photorec program and see how that gets on. Would you expect to get the files out as RAW data in a case like this ?

 

[datahaze]

If the fusion drive can't be re-assembled then yes, I'd expect file carving to get back at least some of the data. JPGs will recover pretty well, other file formats work less well for file carving. On HFS I'd say ballpark you'd be getting back 70-80% of the JPGs but this is very dependent on fragmentation.

 

[slingshot]

Its better than nothing LoL, at least this is an option when all else fails.

Not sure how well it would work when they want their Lightroom stuff or iPhoto stuff.... RAW is ugly

I will try the HFS+ spinner in R-Studio on the Mac tomorrow, I'm sure that version can see APFS. That may give me a file structure rather than RAW.

Thanks for your help getting this far though Using the 3K for imaging was good but DE produced shite files.

 

[Jared]

Looks to me that the fusion was broken somehow. Most often I see this when they had gone to the Apple store first and the idiot tech there ended up formatting it or trying to re-install the OS on the SSD only (since the HDD isn't responding, only the SSD will be affected).

In Recovery Explorer can you browse and open files on just the SSD? My guess is they did something to the SSD.

 

[slingshot]

Looks to me that the fusion was broken somehow. Most often I see this when they had gone to the Apple store first and the idiot tech there ended up formatting it or trying to re-install the OS on the SSD only (since the HDD isn't responding, only the SSD will be affected).

In Recovery Explorer can you browse and open files on just the SSD? My guess is they did something to the SSD.

Really wouldn't surprise me, they are dim, although they like to send work my way so can't complain too much

In Recovery Explorer the file structure is weird though, most of the data is inside the untitled folder.



Ive opened a lot of pics and pdf's with no problems off the SSD

I've since installed the latest R-Studio on the 3k rig and after the file carving it can see the APFS partitions now.



If I open the recognised 4 partition (untitled) I get a proper file structure as would expect to see in a Mac OS directory



I wish I could fathom out how to stitch these drives back together. I was doing some reading on R-Studio's pages about 'core storage' volumes and they make a lot of noise on how they are supported but there seems to be no info on how to use their product to go about re-creating the fusion drive. I'm going to try again tomorrow but with both drives on a Mac and see if R-studio can actually do anything with them. I like the UFS guys video of creating a virtual partition and extracting all the files but I just can't get that going on at all

 

[Amarbir[CDR-Labs]]

Well,
I Find UFS Explorer a Very Tough Software To Operate