Is there any way to recover a disk's catalog directory after a Quick Erase?

Once the directory is wiped it cannot be recovered. One should never be able to erase a disk accidentally since there are barriers. It may be possible to restore files, however:

General File Recovery

If you stop using the drive it's possible to recover deleted files that have not been overwritten by using recovery software such as MAC Data Recovery, Data Rescue II, File Salvage or TechTool Pro. Each of the preceding come on bootable CDs to enable usage without risk of writing more data to the hard drive. Two free alternatives are Disk Drill and TestDisk. Look for them and demos at MacUpdate or CNET Downloads. Recovery software usually provide trial versions that enable you to determine if the software would help before actually paying for it. Beyond this or if the drive has completely failed, then you would need to send the drive to a recovery service which is very expensive.

The longer the hard drive remains in use and data are written to it, the greater the risk your deleted files will be overwritten.

Also visit The XLab FAQs and read the FAQ on Data Recovery.

This is not accurate.

The catalog on an erased disk may be recoverable - you need to use the correct software to look for it & repair it. SSD's will make this more difficult because of how the controller operates on the drive reallocating & overwriting entire chunks without any external way to override that but spinning disks should still have the potential for recovery. If you have more dollars than sense (e.g. 3 letter agencies) you could apparently use advanced techniques to undo layers of magnetic changes - magnetic force microscopy is meant to be able to do this, but I have only seen it discussed as theory, never demonstrated.

Tools like TestDisk may be able to rebuild the original partition structure, from there you could try tools like Disk Warrior to reconstruct the catalog, which could potentially recover the file & folder names. I'm generalising here because I haven't done this on HFS+ (at least as far as I can remember 🙂), I have done comparable things on Linux ext3 volumes. HFS+ has similar features (like a built in backups of the volumes structures).

You seem to be concocting a solution that seems weird to me - saving a backup disk catalog when erasing a disk entirely defeats the point of erasing (unless the backup should be saved to another physical disk).

You agreed to erase the disk - the error here is yours (sorry for being blunt, but you shouldn't really expect Apple to account for uncommon user mistakes). Frankly people shouldn't be editing disks when there are non backed up volumes connected but sometimes it's a hard lesson to learn.

If you have a backup running file recovery on a deleted volume is irrelevant - you would always be better off replacing from a copy, 'file carving' or data recovery is likely to bring back old files which were not erased & not in the last catalog, potentially polluting the result.

If you don't know how to recover & have erased data that you really need recovered take it to a professional company, it is the best option by far. Using & attempting to repair can lose more data as Kappy noted.

There are many other drawbacks with HFS+ that should probably be addressed before this e.g. data is not verified to be the identical as when it was originally stored to disk.

If you really don't like the filesystem limitations use an alternative like ZFS on a server, that has many extra features that better at protecting what is saved. Other systems also manage file duplication for redundancy & data verification etc.

Mac OS Extended is all we have that is fully supported on OS X for booting & all common tasks, so ask Apple to address you concerns http://apple.com/feedback/ but I'm not sure it makes sense for other users.

Hi Pyx,

Disk Drill is probably the best solution for recovering data after a quick erase and format. Try the evaluation version first. Save the scan results should they be to your satisfaction. You can then recover your data after purchasing the full version without having to rescan your drive. Remember not to write any data to the affected drive plus have an external drive ready to accept your recovered data.

All the best

Hi,

Have you found any solution to your problem?

I've discovered that Extents Overflow File is also deleted during Erase, which means fragmented files can not be recovered as well. In my case that's a complete disaster - a large part of valuable data is lost.

If you need help with kind of issue this I suggest you post more info. This post is getting old & doesn't seem to have a solution.

There are apps that will specifically try to recover deleted disk geometry (like the free TestDisk). You can also try to recover files or the catalog within that geometry. Other apps may also work to recover data too. Ideally you have a disk to recover onto as some tasks can alter the original disk.

The catalog (& the extents) is actually backed up on the disk, you just have to read the spec to see that. Reading the spec is not required to simply undo an 'erased disk' error.

Hi Drew,

thanks for response.

The erased disk is 1TB, contains one HFS+ volume with 800GB of image data (thousands of photos, each ~20MB).

I've tried Data Rescue 4 and EaseUS Data Recovery tools. Both failed to restore folder structure, while successfully restored 80% of files including EXIF data. Remaining files are corrupted (include fragments of other photos). I think it's due to fragmentation map was erased along with Catalog file.

I've checked HFS reference and found that:

- Catalog file also contains fragmentation map (up to 8 fragments - most likely in my case)

- Catalog file doesn't have a fixed postion on disk. That means a new (empty) Catalog file might not override the original one. This also means that proper software can find and restore it. Please correct me if I'm wrong.

- There's a so called Alternate Volume Header, which is a backup for original Volume Header and it's location is fixed within a volume. I guess it is used when original header gets corrupted, but in case of Erase it is overriden by a new header.

I took the disk to a local recovery company. According to their expert, HFS+ Catalog is not recoverable. Does this mean they are unprofessional?

Thanks for TestDisk suggestion, I'll check it when I get the disk.

Images on disk is not a family archieve, it's almost a life and death question, so I'm ready to dive into any technical details.

I don't know if it the catalog is not recoverable - they may be taking into account any changes that you have performed on the disk or possibly the disk type etc. I believe SSD's make it more difficult to recover data.

Ask if they are working on a copy or the original (or using write blockers). A professional company should be cloning the disk to avoid any changes or using tools to stop that happening. Block level copies should take the structure even though the partition table is gone.

It's the 'Alternate Master Directory Block' that I think contains a copy of the catalog & extents

https://en.wikipedia.org/wiki/Hierarchical_File_System The catalog should be at the end of the disk & the start if I recall correctly. I can't see that detailed in the page you linked but it looks like an archive of the HFS details. There should be more authoritative info on Apple.com, probably under the developer site. I don't know how much has changed over the years so try to find something from the same era as the disk, that one seems to be from 2007?

You may need to wade through the recovered data. It could be that the fragments are simply incomplete duplicates from various caches, previews and other versions. iPhoto/ Photos & Finder seem to generate a ton of duplicate versions. Rebuilding a library for apps may be impractical due to how the data is stored, normally a DB (or several DB's) plus the files. I don't know how you can handle that in a practical way with +800GB of data. Hunt for image de-duplication apps I guess?

I think you could also try to quiz the makers of various disk tools in the hopes one can give you a good place to start or indicate if it is feasible, it also depends on if you already made changes to the disk during recovery.

> Ask if they are working on a copy or the original

Yeah, I've made this mistake - tried to recover without making a clone first. But I haven't made any changes to it (though OS could do it for me - Spotlight indices, etc).

"Alternate Master Directory Block" seems to be an original name for the same concept in old HFS. Do you know if it is overriden during reformat?

> I don't know how much has changed over the years so try to find something from the same era as the disk, that one seems to be from 2007?

No, this is external 2.5 Seagate Backup Plus model.

> iPhoto/ Photos & Finder seem to generate a ton of duplicate versions

Yeah, that was my hope too. I've checked all the dups (which is possible due to recovered EXIFs) and found that most of them are relatively small thumbnails (also part of EXIF).

I've found a tool which seems able to recover Volume header. The only hope it wasn't overriden by a new header after erase...

mindz_eye wrote:

"Alternate Master Directory Block" seems to be an original name for the same concept in old HFS. Do you know if it is overriden during reformat?

When you create a new partition table in Disk Utility (or any other tool) it will write a new disk catalog including all the other supporting structure. I suspect that will damage an existing catalog by overwriting the same region.

mindz_eye wrote:

> I don't know how much has changed over the years so try to find something from the same era as the disk, that one seems to be from 2007?

No, this is external 2.5 Seagate Backup Plus model.

The reference you linked to is not from Apple it is an archive from 2007. I suspect the HFS extended structure may have changed since then. It really depends on when the disk was formatted - ideally you need to read documentation for a similar generation.

Good luck with hfsprescue.