How do I recover data from a HFS / HFS+ file system
How Does The HFS / HFS+ File System Work?
The Hierarchical File System (HFS) in its present version HFS Plus (HFS+) is the principal file system of OS X, the operating system developed by Apple for its computers. HFS+ was introduced in 1998.
Some key features introduced in HFS+ are the journal, B-trees, and block addresses of 32 bits. If the journal is enabled, the system keeps record of changes to files on the disk. These records are used to restore the integrity of the file system in case of unplanned events, such as shutdown or power failure.
HFS+ manages its files through a set of structures. The main ones are the Allocation File, the Catalog File, the Extends Overflow File and the Attributes File.
The Allocation File keeps track of free and used blocks. The Catalog File records all files and directories in the volume. The Extends Overflow File registers all allocation blocks assigned to each file as extends. And, the Attributes File lists all file attributes. The last three files have a B-tree structure. In addition, this file system provides the Start Up File used for systems that have no HFS / HFS+ support.
A B-tree is a data structure used for placing and locating files. It is optimal for systems that use large blocks of data. B-trees are rearranged after a deletion, making HFS data recovery more difficult.
OS X Lion 10.7 introduced logical volume encryption through the File Vault 2. The encryption can be done to the HFS or other file systems. This provides an additional challenge to HFS data recovery, as credentials are necessary for successful decryption.
Other file systems include modules for mounting HFS / HFS+ devices. Linux has an HFS+ mounting module, and Windows read-only drivers.
How Do I Recover My Data?
Like with most file systems, when a deletion occurs, HFS+ does not clean the data, but only a reference to it. Therefore, the contents are available until overwritten.
As a result, files can be recover using a HFS recovery application such as Disk Drill. This software comes with a Mac and a Windows version. It is a commercial application, with a free download in its basic form.
How Do I Recover My Data with Disk Drill?
Disk Drill provides several HFS data recovery mechanisms. They are:
- Quick scan
- Deep scan
Quick scan provides an HFS recovery alternative useful for recently deleted files. It is fast, as it uses the data available from the journal, but it may not recover all files.
Deep scan offers a better option for old deletions or in case of corrupted file systems. It is a binary search and therefore it takes longer. Disk fragmentation acts against it, as it spreads files over the device. In order to help, Disk Drill provides the possibility of saving the session and continuing later on without losing the work already done. Besides, if metadata is not available, files may appear without their original names.
In addition, Disk Drill can help when the Catalog File is corrupted. This software detects this anomaly and will show the button Rebuild instead of the usual Recover next to the drive. Depending on the situation, the application gives the choice of mounting onto the existing drive or to a virtual disk image.
How Do I Prevent Data Loss?
Disk Drill comes with two tools for HFS data loss prevention:
- Recovery Vault
- Guaranteed recovery
Recovery Vault helps prevent data loss. It is an additional layer that keeps track of deletions. This HFS file recovery option must be turned on.
Guaranteed recovery is a unique feature of Disk Drill. This function makes sure that a file is recoverable by keeping an actual copy of any file sent to a monitored folder such as the Trash.
How Do I Back Up Data With Disk Drill?
Disk Drill has the option of backing up data into an image file. This image can later be used to retrieve lost data. Files can be retrieved either with Disk Drill or any other available software.