Need to recover data from WD my passport 1 TB used on mac

[Majestic]

Hi,

Need to recover data from WD my passport 1 TB used on a mac. When I plug it in to my Windows 7 64 bit station, if I look in disk management it shows as a split with The first parition saying 200 mb EFI SYSTEM Partition then the second partition is 931.16 GB (Healthy partition). I can't mount it or get any properties besides the option to delete volume. Obviously I will clone it before anything but even after that, Where do I go here? I'm thinking on the cloned drive possibly using getdataback but this was used on a MAC so I'm not sure what File System to look for and what actual recovery software to use in this case? It is an external drive though from WD so I assume it'd used EXT or something like that? Any wisdom would be appreciated!

My client suddenly is not getting a drive letter or anything showing up when he plugs in this drive anymore on his MAC. That's all I know.

Majestic

 

[Markverhyden]

R-Studio's R-Tools will read HFS+, which is the most recent Apple file system. But, as has been mentioned many times, you must make an image of the drive first.

With R-Tools you can download a trial version of the software and scan the drive. It will let you recovery file sizes up to 64 KB. If you like it you can buy it, apply the license and recovery everything.

You could also use DR3 which runs on the Mac side to do a data recovery.

You could also grab something like Disk Warrior or Onyx to try to rebuild the file system.

Actually the list of options could go on and on. If you provided more details about who, what, when, where, how and why you might get some more directed suggestions.

 

[Majestic]

R-Studio's R-Tools will read HFS+, which is the most recent Apple file system. But, as has been mentioned many times, you must make an image of the drive first.

With R-Tools you can download a trial version of the software and scan the drive. It will let you recovery file sizes up to 64 KB. If you like it you can buy it, apply the license and recovery everything.

You could also use DR3 which runs on the Mac side to do a data recovery.

You could also grab something like Disk Warrior or Onyx to try to rebuild the file system.

Actually the list of options could go on and on. If you provided more details about who, what, when, where, how and why you might get some more directed suggestions.

Hi Mark,

Thanks for the suggestion. I will try R-studio rtools and see what the results are. I don't have a mac so Windows is the only option I have. The actual story is just that my client suddenly is not getting a drive letter or anything showing up when he plugs in this drive anymore on his MAC. That's all I know.

Majestic

 

[Markverhyden]

Ok, real customer so there may be real data that may have real value. Since it sounds you are kind of new to this I would strongly recommend you check with the customer to see what kind of value they place on they data.

If they are serious about it you should seriously think about getting some help.

If it's "hey, can you just see what you can grab for $50" kind of thing then feel free to try. It's not like there are Federal, State or Local licenses.

First is to make an image of the drive. You will need sufficient space on a drive and software to make the image. Clonezilla is an open source bootable ISO, I have used it for years for imaging. But it is not that user friendly and requires a knowledge of Linux to understand.

EaseUS ToDo has free 15 day trial versions that run on a M$ box. Download and install that and use that to image the drive. There are plenty of other paid and OSS apps to try.

Then use R-Tools to do a scan. There are many others but that is my favorite.

 

[Larry Sabo]

WD My Passports (except for the Elements model) incorporate hardware encryption, whether the user specified a password or not. If the customer used the WD Smartware backup program (Memeo) and specified a password for it, that further complicates recovery if that password in on an unrecoverable sector. You will not be able to read files without decrypting the data with the same chip as was used in the USB interface. The procedure would be to create a sector-by-sector clone, then connect that clone through a USB bridge that uses the same encryption chip. That would let you see and copy the data in its unencrypted form. If the data is of any value, it's time to farm it out.

Edit: I forgot to mention that to clone it, you would have to modify the PCB to bypass the USB bridge, enabling access to the drive through the SATA interface of the PCB. That modification is not for the faint of heart, as you need to unsolder two *very* tiny SMT caps and connect a SATA connector to the appropriate points on the PCB. Or, you could get a compatible SATA PCB and transfer U12 from the original and then use the SATA PCB to image the drive. Yeah, farm it out, for sure.

 

[Gary Rockliff]

Macdrive for Windows will help you read mac drives in windows http://www.mediafour.com/products/macdrive

If it is not being allocated a drive letter and you can't read it with Macdrive then there is obviously a problem. As Larry stated if the data is of value to them send of and get a quote for data recovery, don't touch the drive at all.

 

[DenverCM]

Check out HFSExplorer. Sorry I don't have a link but it's on Source Forge. It's free and allows Windows PCs to read Mac formatted drives. Works great...I recovered files for client when multiple Macs couldn't read the drive and various mac HDD repair tools didn't work.

 

[trevm999]

If the data is important to the client, talk to Luke at Recovery Force (I see you are in Canada) WD encrypted drives are not fun. Luke can take care of that though.

If the client is not interested in that...I would clone the drive using gddrescue (maybe try once out of enclosure and once still in enclosure?), replace the drive in the enclosure with the new one and run disk warrior. Can't say I've tried it, so maybe that won't work. Also, you don't know if it might be a problem with the enclosure, in which case you would have to get the exact same external HDD and swap the enclosure.

IMHO, it is easier just to get Luke to figure it out.

 

[Markverhyden]

The description in the OP leads me to believe that the drive is formatted HFS+. Formatting a 1T drive using the OS X Disk Utilities always leaves a 209.7 mb EFI partition which is "hidden" and the remainder is what it is.

The sizes reported by the OP basically match what one would see on a Windoze 7 machine with a 1T, Mac OS X formatted drive in Computer Management>Disk Management. 200 MB EFI and 931 and change GB of unrecognized space. So my guess is the USB interface board might be working properly and the file structure got corrupted.

 

[trevm999]

So my guess is the USB interface board might be working properly and the file structure got corrupted.

In which case disk warrior and disk utility would probably be up to the task. However, if it has WD encryption it look like that would complicate being able to make a back up. And the drive could have bad sectors.

It the customer was not interested in sending it away for professional recovery, I would probably just use disk warrior and disk utility to try to fix the file corruption. Even if there are bad sectors it might fix the file system long enough to get the data off. And I would test the drive to see if it was failing, either by removing it from its enclosure or using ddrescue to read all sectors and then write 0s to all sectors before giving it back to him to use.

 

[trevm999]

My client suddenly is not getting a drive letter or anything showing up when he plugs in this drive anymore on his MAC. That's all I know.

Or he could have accidentally turned off the preference settings for external drives to show up on the desktop or in finder.