Deleted file recovery - NTFS/HFS+

So, this is my problem. I have a harddrive that was once NTFS, and it had years worth of pictures on it. Then, someone took it, wiped it, formatted it HFS+, and has been using it as a Time Machine backup. I own Data Rescue 3, but it only seems to recover old Time Machine files and anything that was stored in HFS+. Is there any way to recover any of the older NTFS files? I understand how harddrives work, and that most of the files have probably been written over, but is there anything that will do this?

iMac, Mac OS X (10.7.2)

Posted on Dec 6, 2011 1:35 PM

Reply
14 replies

Dec 6, 2011 1:40 PM in response to jwcorell

If they've been written over, and likely have, then there's nothing which will recover them. Not anything you can buy anyway. There is a method involving specialized hardware and software to try and rebuild the previous waveforms that have been written over, but you can probably guess it would cost as much as your house to recover the data.

Dec 6, 2011 4:53 PM in response to jwcorell

There is Data Rescue 3 and FileSalvage for the Mac.


They both work by scouring the hard drive for BOF (Beginning Of File) markers that don't have a matching pointer to that file in the drive's live file table. Meaning, it's been deleted. They then read the file header information at the BOF marker to see how many bytes the file should be so it knows when it reaches the EOF (End Of File) marker that it has read the correct amount of information for the file being recovered.


Now what I don't know is if either program will pay any attention to, or recognize data written originally as NTFS. Neither program will work on anything but an HFS+ drive, so they may not see anything written under NTFS. They both have demo software you can download. It's worth a shot.


If that doesn't work, the only other option you can do yourself is to put the drive back in a Windows computer and do a quick erase of the drive back to NTFS. That will only overwrite the HFS+ file table with a new NTFS table, so the data on the drive itself will not be formatted. Then you could try a file recovery software from Windows. After that, the only option is a place like DriveSavers. And that ain't cheap.

Dec 20, 2011 6:09 AM in response to allensood

Ah! Hmm, I'm not sure there is one. Haven't looked though. Do you know of one? All those I've seen are platform specific. Mac software will only recover Mac drives; Windows software will only recover Microsoft formats (FAT16, FAT32, NTFS).


Edit: R-Studio is rated highly and can read all MS, Linux, UFS1/USF2 and Apple drive formats. There's Stellar Phoenix, but it cannot read NTFS. According to a chart I was looking at on another site, FileSalvage can also read MS drives. Their review states it supports all common Mac OS X file system types, including HFS, HFSX and HFS+ as well as FAT12/16/32, NTFS/NTFS5, ext2fs and other file system types, though the company's own documentation doesn't mention it.

Dec 20, 2011 8:00 PM in response to Kurt Lang

I see from the same referance which you provide that Stellar Phoenix has one more version of Mac Recovery which works on Windows based PC i-e Mac on Windows that said if your Mac hard drive is crashed or your Mac is not booting properly you can attach your Mac hard drive on windows based systems and run Stellar Phoenix Mac on Windows software to recover your lost data.


I hope this may be helpful...

Dec 21, 2011 5:59 AM in response to allensood

you can attach your Mac hard drive on windows based systems and run Stellar Phoenix Mac on Windows software to recover your lost data.

That would be a pretty nice feature. Not saying I don't believe you, but I couldn't find that reference in the Windows version. Could you please link to the correct page?


Rather than moving the drive, I'd use DiskWarrior. It not only repairs drive, but has a Scavenge function to look for lost files.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Deleted file recovery - NTFS/HFS+

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.