🔝 Top Tools to Recover Data from HFS+ Drives. How to Recover a MacOS Extended Drive 🍏

Hello everybody! In today’s video, we will discuss HFS+ file system, explore its structure and the changes that distinguish it from the previous version, HFS. We will also analyze data recovery from an HFS+ drive, in terms of peculiarities and possible issues. Finally, we will compare performance and efficiency of different products in recovering data from HFS+ volumes. HFS+ (Mac OS Extended) HFS+ or Mac OS Extended was first presented back in January 1998, but it was developed as a test file system for OS Copland, which was never released. In the late 2002, Apple rolled out update 10.2.

2 which added journaling to improve data 01:23 - reliability. It was easily accessible in server versions of Mac OS X, but only through the command prompt interface from desktop clients. Beginning with Mac OS X v10.3, journaling was included by default, and the volume containing the journal is known as HFSJ. HFS+ journaled has finally become the main file system that Apple uses on its Mac products. A journaled operating system keeps a log file (journal) of changes which helps to recover the hard disk quicker after failures, and accelerates the work of Time Machine.

01:59 - This file system type is perfect for Mac internal disks and backup disks, but very inconvenient for external disks that would be connected to computers running other operating systems. HFS+ can be seamlessly integrated with GNU Linux, but it is still incompatible with Windows. To help Windows recognize this file system, additional software is required. Apple developed HFS+ to replace HFS, the main file system for Macintosh computers, so it can be seen as the enhanced version of HFS designed to improve the capabilities of Mac OS. Advantages and peculiarities of HFS+ The main distinction of HFS+ is using the 32-bit architecture instead of the 16-bit in HFS.

02:42 - The older addressing system was a serious limitation by itself as it didn’t support work with volumes containing more than 65 536 blocks. For example, on a 1 GB disk, the allocation block size under HFS is 16 KB, so even a 1-byte file would take up the entire 16 KB of disk space. Just as its predecessor, HFS+ uses the so-called B-tree to store a major part of metadata. HFS Plus volumes are divided into sectors (called logical blocks in HFS), usually 512 bytes in size. One or more sectors make up an allocation block; the number of allocation blocks depends on the total size of the volume.

03:26 - The 32-bit addressing allows to use over 4 294 967 296 clusters compared to the 65 536 available for 16 bit. In comparison, the two file systems differ by: - file name length: in HFS - 31, in HFS+ - 255; - file name encoding: HFS: Mac Roman, HFS+: Unicode; - record size: HFS: 512 bytes, HFS+: 4 Kbytes; - and the maximal file size has increased: HFS: 2^31, HFS+: 2^63. HFS Plus architecture HFS Plus volumes are divided into sectors (called logical blocks in HFS), usually 512 bytes in size. These sectors are then grouped together into allocation blocks which can contain one or more sectors; the number of allocation blocks depends on the total size of the volume. HFS Plus uses a larger value to address allocation blocks than HFS, 32 bits rather than 16 bits.

04:39 - To manage the process of data allocation on the disk, HFS Plus stores special service information known as metadata. The following elements are most important for the proper operation of the file system and are of special interest when searching for missing data: - The HFS boot blocks located in sectors 0 and 1; - The Volume Header which is located in the second sector. It stores a lot of data about the volume, for example the size of allocation blocks, a timestamp that indicates when the volume was created or the location of other volume structures such as the Catalog File or Extent Overflow File. (Catalog File, Extent Overflow File etc). The Volume Header is always located in the same place; - The Allocation File. It contains data on occupied and vacant allocation blocks.

05:28 - Each allocation block is represented by one bit. A zero value means the block is free and a one value means the block is in use. Sometimes, this structure is referred to as bitmap. The allocation file can change size and does not have to be stored contiguously within a volume; - The Catalog file. It stores a major part of data on allocation of files and folders on the disk. The Catalog File is a B-tree that contains records for all the files and directories stored in the volume. - The Extents Overflow File is another B-tree element that records the allocation blocks that are allocated to each file as extents. Each file record in the Catalog File is capable of recording eight extents for each fork of a file. Once those are used, additional extents are recorded in the Extents Overflow File. Bad blocks are also recorded as extents in the Extents Overflow File. - The Attributes File.

06:28 - Such elements are used, for example, to control access. The Attributes File can store three different types of records: - Inline Data Attribute records that store small attributes; - Fork Data Attribute records that contain references to a maximum of eight extents that can hold larger attributes; - Extension Attributes that are used to extend a Fork Data Attribute record when its eight extent records are already used. - The Startup File is meant to be used by other, non-Mac OS systems that lack HFS or HFS Plus support; - The second-to-last sector contains the Alternate Volume Header; - The last sector in the volume is reserved for further use. Recovery algorithm Recovering data from HFS+ is more difficult than from other file systems. One of the aspects causing difficulties is that HFS Plus uses B-trees to store most volume metadata on allocation of files, and after a file is removed, the B-tree is updated immediately, so the information on where the removed file was located is lost at once.

07:31 - Our program lets you see the storage device and the HFS+ structure in Windows without using any extra software or drivers. While running a full analysis scan, its algorithm allows to exclude these elements when searching for lost data, and recover the information we need. If you choose a fast scan, the program reads the Volume Header and gains access to the Catalog file. It finds the journal file, reads it to the memory and analyzes all entries concerning removed files. If the blocks related to such files are not overwritten yet, it will read them and recover the data.

08:10 - This method lets you recover the file completely. And even if overwriting has taken place, the file data can still be found in virtual memory, that is, in the paging file. The algorithm behind full analysis allows the program to exclude certain elements while searching for deleted data, rebuild the disk structure and display the lost data. Using standardized tests as an example, we will explore how it works, study different scenarios of data loss, and compare the Hetman product with other popular data recovery tools. Testing and comparing the quality of data recovery For our benchmarking assessment, we have selected several popular data recovery tools.

08:48 - They are Hetman Partition Recovery, R-Studio, EaseUS Data Recovery Wizard, DiskDrill, UFS Explorer and Recuva. As we examined the tools more closely, we had to exclude Recuva from the list; it doesn’t support HFS+ file system. In the end, we will compare efficiency of the five specialized utilities. All right, here we go. There’s a computer with mac OS Catalina installed on it, and a hard disk divided into several partitions, that is going to be the test disk. Let’s copy some data there – for example, photos, videos, documents.

09:29 - Now let’s remove some of the files and shutdown the computer. We will perform the tests on another computer running Windows. Let’s connect the HFS+ disk and start the testing with Hetman Partition Recovery. As you can see, the program recognized the disk with HFS+ file system properly. Open it; in such removal scenario, a fast scan will suffice. Let’s check the results. Here are all the detected files and folders. The ones that have been removed are marked with a red cross. All the files are displayed in the preview window and available for recovery. The disk structure is retained and all files and folders can be located easily. The program has completed this test successfully and met the challenge just as it should. Let’s try another candidate, RStudio.

10:32 - It also displays the disk, its name and file system properly. Open it. Here are our files and folders. For some reason, it doesn’t display the folder 1Movie - most likely because the program couldn’t find it; also, some folders are shown twice and marked as deleted, though they are not. All removed files can be viewed and are available for recovery. Here’s the verdict: the program completed the test but failed to find one folder, and some other folders are duplicated. Generally, the final result is a little worse in comparison with Hetman Partition Recovery. The next one on the list is EaseUS. Start the program.

11:17 - It also displays the disk, its name and file system properly. However, there is no option for quick scan: as soon as you try to open a file, it triggers full analysis, so we’ve just found the first downside of this product. When the analysis is finally over, we can see there are 259 files detected. The program displays all files and folders, all files can be viewed, but it is difficult to understand which elements were removed, and which are still on the disk. Also, some files are duplicated and you can’t view them.

11:49 - Here’s the verdict: this product can find all the files, both deleted and those still on the disk, but it would be more convenient to have a sort of marking to distinguish between the two types. Some files got duplicated, but the program has completed this test successfully. Another one to go is DiskDrill. If you have more than one drive on your computer, you’ll have to do some searching first. All right, here’s the drive we are going to use. Surprisingly, the program only displays its size, but doesn’t say it HFS. Start the scan.

12:30 - Quick scan is unable to find any removed data and it only displays what is still on the disk. Only a deeper scan can help us see what this product can do. Look, it has found some files. The disk structure is lost as well as file names, and there are some duplicates as well. They are arranged by type into various folders, and it’s hard to tell which of them were removed. Also, it’s not clear if the program would be able to recover all data. Videos and documents are unavailable for preview, so I can’t say they can be recovered. Judging by the file size, we can hope the files will be restored. Summing up, this program has completed the test as well, but so far its results are the worst. Also, some files are unavailable for preview, and the deeper scan takes quite a long time. UFS Explorer is the next product to be tested. Start the program.

13:37 - It can recognize the disk and its file system, but somehow it doesn’t display the disk name. Open the disk – and see no information on the deleted files at all, and there is no quick scan option either. All right, let’s run a regular scan. The program has found the deleted data. The disk structure and file names are retained. The removed files are shown in a different color, and can be previewed. All folders can be located easily. The only disadvantage is that you can’t view documents. Photos and videos have no preview issues.

14:13 - Talking of document recovery, there is much to be desired. The verdict is here: this product has coped with the task, but there are some difficulties in dealing with documents. In the end, the top tools are Hetman Partition Recovery and EaseUS as they both didn’t have any issues when analyzing the test disk. The only downside in EaseUS is that it lacks the quick scan option. Other utilities have minor drawbacks. RStudio failed to detect one folder, while DiskDrill and UFS Explorer couldn’t preview certain files.

15:10 - In the following tests, we will erase file system elements, one by one: Volume header, Alternate Volume Header, Header Node and Index node of the second level. Erase the Volume Header. In HFS+, the Volume Header is located in the second sector (from the beginning) and in the second-to-last sector (from the end of the volume), so that’s why we are going to erase the main header in the second volume at the beginning of the disk, then run the analysis to see how the tools selected for the benchmark perform. Hetman Partition Recovery All right, the Volume Header is removed, then start Hetman Partition Recovery, which can display the disk, its name and file system at once. Open the disk. Result: disks 1, folders 29, files 136. The same result that we’ve already seen in the previous test: the disk structure, file names and locations are restored, all files can be previewed and are available for recovery. The program has completed the task successfully. RStudio Start the program.

16:27 - It finds the disk and displays its name and file system correctly. Open the disk to see the same result as before: the program is unable to find one folder with a video file and some folders are duplicated. EaseUS Let’s see what EaseUS can do. The program can recognize the disk, but without its name and file system type. Let’s scan it. The same result again - 243 files, and some files got duplicated. DiskDrill Start scanning the disk with DiskDrill.

17:24 - In the end, the same picture as before: files are scattered over folders, no previews for documents and videos. I guess this test might be the last one where we still use this particular product. Results are unimpressive at all and there seems to be no use testing it anymore - we already know what to expect, and this tool ranks the last in our benchmark. UFS UFS can recognize the disk, its file system and size, but fails to detect its name. Let’s scan it. The program shows the same result as in the previous test.

18:08 - Documents are still unavailable for preview, but other things are OK. For the next test, we will delete the second part of the header. Let’s run Hetman Partition Recovery. The program displays the disk but without showing its name or file system. All we know is the capacity. Open the disk… as you can see, quick scan is not available now. Select full analysis, set the file system to HFS+, and wait until it is over. The same result though under a different condition: disks 1, folders 29, files 136.

19:06 - The program managed to detect the disk, recognize its name and file system. The disk structure and file names are retained. Everything is available for preview. The task is completed successfully. RStudio RStudio can recognize the disk, but can’t display its name and file system type. Quick scan is not available too. Scan the disk and set HFS. The program was unable to find certain folders. EaseUS It can see the disk, but fails with its name and file type, just as in the previous tests.

20:04 - The program shows the same result as before, and some files are duplicated. However, all data is available for recovery. UFS Explorer Its shows the disk as unknown, without any name or file system type. This time, result is no different: the data is found, but documents cannot be previewed. In the next test, we will remove B-tree nodes, Index node, header node leaf, node. Hetman Partition Recovery The program can recognize the disk, but can’t display its name and file system type. We scan it only to see the same result we’ve seen many times today: 1 disk, 29 folders, 136 files. The program managed to detect the disk, recognize its name and file system. As you can see, all files are available. RStudio Start the program. It can recognize the drive and that is already good enough. Scan it - the only suitable option is HFS, (because HFS+ is missing), so check it.

22:03 - The program managed to detect the disk, recognize its name and file system. Open the disk: similarly to the previous tests, the program was unable to find certain folders. The rest of the data has been located, the disk structure and file names are retained. Everything is available for preview. Now, EaseUS. Run the program. The disk is detected, but it’s missing both its name and file system. The duplicated file issue is still present. Everything is available for preview and recovery. Finally, UFS Explorer. Its shows the disk as unknown volume. Configure the scan and start it. The program can detect the file system and retain the disk structure, all files and folders have been located, the only downside being that documents are not available for preview again. In the final test, we will remove Index Node of the second level from the disk, in addition to all that we’ve erased before. In other words, we will remove all B-trees. Run Hetman Partition Recovery. Here is the disk, no name or file system, let’s scan the disk with full analysis, HFS+.

23:55 - The result is a bit different: 1 disk, 29 folders, 134 files. Here is our test disk with HFS+. All right: all files are available, check the folders - everything is OK, the disk structure and disk names are retained, everything is available for preview. All you have to do is to save the recovered files. The program has completed all the tests with excellent results. Now let’s try RStudio. Start the program and run the scan. The program managed to detect the disk, recognize its name and file system.

24:53 - Everything is the same as it was in the previous test. The program was unable to find certain folders, but the overall result is quite good. Now the final test for EaseUS. Start the program, no changes here, let’s scan the disk. All photos, videos and documents are present, available for preview and recovery. The result is as good as before. The last tool in the final test is UFS Explorer.

25:41 - It says we have an unknown disk - all right, scan it and don’t forget to check the file system type option. Here is the result: the disk structure and file locations are retained, photos and videos are available for preview, but documents aren’t. Let’s have a look at the folders: 1 video can’t be previewed, but the other directories are fine. Summing up, we can say that this tool is a bit worse than RStudio, which failed to find some folders, but was able to preview all files without exception. Conclusion Now let’s draw the bottom line.

26:25 - We have four products that completed all tests successfully, and one more product that didn’t make it to the final because it failed to display almost half of the recovered files in the preview window. From among the top four tools, the choice is yours, but there is something I’d like to add: the algorithm used in our product allows to retain the folder structure and file names which makes it easier to search for certain data and saves your time; also, it managed to find all the data that the disk used to contain. In addition, our program lets you create a disk image and then recover data from there, which is the industry standard for dealing with faulty drives. Another favorite, EaseUS, has very good results too, but doesn’t offer this option. That is all for now! Hopefully, this video was useful.

27:10 - Remember to click the Like button and subscribe to our channel. Push the bell button to receive notifications and never miss new videos. Leave comments to ask questions. Thank you for watching. Good luck. .