Nicolo' Conte

Q: Hard Drive corrupted - Partitions gone, what to do? Additional warning about filename containing solidus ("slash" "/")

Hello,
I have a MBP 13" mid 2009, hardware appears to be working normally. Original Hard drive was swapped with an SSD approximatively 1 year ago.


On Sunday, 31 July 2016, I tried to save a file on my desktop and a Finder error popped up, error code 50.
After various searches I've found out that the error display was connected with either a corrupt filesystem, but a quick check with disk utility returned no errors, or a file with OS-uncompatible characters in its Filename.
After scratching my head for a few minutes I immediately realized there was a ".webloc" file on my desktop, a file which I didn't save or create myself, and it had a whole web address in its Filename such as "https-//...". Solidus characters, forward slashes in my case, should be automatically changed to OS-compatible characters when naming a file but it was not the case with that particular file.

I tried deleting and it would give me "error code 50", renaming would instead say it couldn't use that Filename and that I should've tried to use a shorter name or less ".". Needless to say it would give me that output no matter what I tried to change the Filename into. The whole hard drive itself, along with Users folder had "read only" permissions settings and that could not be changed although Desktop folder was set as "read & write" along with "me" as the owner.

Terminal couldn't help in any possible way as I couldn't include a Filename with "/", it would just output "No such file or directory".

 

An hour later I had come up with a possible solution, as I had a Windows/Bootcamp partition and such OS doesn't have problems with Filenames containing "/" it was possible to access the OSX through a program able to read and write HFS+.
I booted into Windows and downloaded a freeware to then discover it only had reading capabilities, I tried to download another software to be able to write onto HFS+ and boom... Computer froze, left it there for about half an hour and had to force shut-down after that.
At boot it won't show any bootable partitions after that, recovery mode wouldn't boot and so wouldn't the online recovery mode which is quite frightening.

 

I had an external hard drive enabled as Time Machine back up disk, I was able to boot the OSX Utilities through it and access Disk Utility. It would only show the main SSD as a disk without giving me an option to verify it, Partitions are not shown and the disk informations show it as "Unpartitioned".
Last back up has been done 15 April 2015, unfortunately I had other troubles by that time and due to formatting Time Machine was turned off. Needless to say I didn't notice it and I do know I might have lost every bit of data in my SSD completely.


After all of this:

1) Do I have even the slightest chance to recover part of the data inside the SSD?

2) How was it possible that a file with critical OS-breaking Filename get created automatically onto my desktop?

3) Be careful, this might as well be malware or a security breach which people might exploit in the future.

MacBook Pro, OS X El Capitan (10.11.3), null

Posted on Aug 1, 2016 7:49 AM

Close

Q: Hard Drive corrupted - Partitions gone, what to do? Additional warning about filename containing solidus ("slash" "/")

  • All replies
  • Helpful answers

  • by John Galt,

    John Galt John Galt Aug 1, 2016 8:28 AM in response to Nicolo' Conte
    Level 8 (49,066 points)
    Mac OS X
    Aug 1, 2016 8:28 AM in response to Nicolo' Conte

    HFS+ does not prohibit the / (slash) character. The : (colon) character is prohibited though.

     

    Do I have even the slightest chance to recover part of the data inside the SSD?

     

    I doubt it. From what you describe, the solid state drive has failed and must be replaced. The prohibited file name was most likely a consequence of that failure, which probably occurred due to a corrupted filesystem or partition map. Given the presence of that apparent corruption, determining how the Finder managed to create a prohibited file name is probably not worth the time to investigate.

     

    If Disk Utility cannot mount that volume so that its contents can be extracted, nothing else is likely to succeed. Even low cost SSDs offer a three year guarantee, so at least its replacement cost should not be a concern.

     

    If Disk Utility can mount the volume, you could use fsck to repair filesystem inconsistencies, but other than offering additional control over its actions it does not convey any advantage over just using Disk Utility's "repair" feature.

  • by Nicolo' Conte,

    Nicolo' Conte Nicolo' Conte Aug 1, 2016 9:43 AM in response to John Galt
    Level 1 (4 points)
    Notebooks
    Aug 1, 2016 9:43 AM in response to John Galt

    Are you sure "/" is accepted by OSX?


    I've found this:

     

    "Examine the name of the files or folders you cannot delete. They should not contain a solidus ("slash", "/") character or any other special ASCII character such as a trademark, quotation mark, or copyright symbol. If the file does, remove the special character or slash from its name, then delete it.

     

    Example: If you cannot delete a file named "Things/stuff", rename the file to just "t", then delete it."

     

    As written from Apple's own support at: https://support.apple.com/en-us/HT201583

  • by John Galt,

    John Galt John Galt Aug 1, 2016 9:59 AM in response to Nicolo' Conte
    Level 8 (49,066 points)
    Mac OS X
    Aug 1, 2016 9:59 AM in response to Nicolo' Conte

    For naming files using the Finder, yes. The reason for that comment was so that you can avoid pursuing an unproductive solution.