Mac OS-X question/help...

[archosman]

We let go an employee last Friday. He deleted several files from his computer and emptied the trash. I called the local Mac store and they want $85 an hour to try and recover whatever client files they deleted. We ran TechTool Pro 4 on it using Data recovery and came up with nada. While it's not life-threating is there anything out there software-wise I could get that would allow me to recover whatever he deleted without having to shell out $s at the Mac store?

 

[pigmode]

You may be SOL, but Data Rescue might be worth a try.

Are you saying you had TTP installed and set to cache you trashed files and it did not work, or you installed and tried to use it after the fact?

 

[archosman]

Quote:

Originally Posted by pigmode You may be SOL, but Data Rescue might be worth a try. Are you saying you had TTP installed and set to cache you trashed files and it did not work, or you installed and tried to use it after the fact?

I booted off the TTP cd and didn't have any luck. I'm a bit confused. under OS9 I could use Norton and would be able to retrieve what I had recently deleted. not sure how things work under X.

 

[pigmode]

Quote:

Originally Posted by archosman I booted off the TTP cd and didn't have any luck. I'm a bit confused. under OS9 I could use Norton and would be able to retrieve what I had recently deleted. not sure how things work under X.

It has to do with the Unix shell and how it handles sectors and deleted files. I'm still not clear on how you are using TTP. If TTP is not preinstalled and preset to cache your trashed files, it cannot retrieve deleted items. I believe TTP calls it Protection and its a feature that works in the background.

Anyway, if you did have Protection enabled, check out the TTP forum at MacFixit. There is a TT tech who hangs out and helps solve problems. I would hazard a guess that it would be detrimental to your cause to use this machine in the meantime. You do not want to risk overwriting any files that may still be recoverable.

 

[archosman]

The powes that be are going to take it to the Mac store here and let them handle it. What is a yenc reader? when we browsed thru it we found a few programs that were not work-related.






Quote:

Originally Posted by pigmode It has to do with the Unix shell and how it handles sectors and deleted files. I'm still not clear on how you are using TTP. If TTP is not preinstalled and preset to cache your trashed files, it cannot retrieve deleted items. I believe TTP calls it Protection and its a feature that works in the background. Anyway, if you did have Protection enabled, check out the TTP forum at MacFixit. There is a TT tech who hangs out and helps solve problems. I would hazard a guess that it would be detrimental to your cause to use this machine in the meantime. You do not want to risk overwriting any files that may still be recoverable.

 

[pigmode]

I believe yenc has to do with usenet files.

good luck

 

[Stephonovich]

Quote:

Originally Posted by pigmode I believe yenc has to do with usenet files.

Indeed. yEnc encoding is commonly seen on Usenet. In fact, anymore, that's probably the only place it's used. Did you perhaps find a Parchive tool as well?

 

[archosman]

Quote:

Originally Posted by Stephonovich Indeed. yEnc encoding is commonly seen on Usenet. In fact, anymore, that's probably the only place it's used. Did you perhaps find a Parchive tool as well?

Hope for the "employee's" sake they didn't download anything questionable. Right now it's at the Mac store and it'll take about 3 days to find out something.

 

[3lusiv3]

Mac OS X is very secure. Unless there was software already installed and running in the background that helps with recovery, then as far as I know it isn't possible to recover deleted Mac OS X files.

 

[bLue_oNioN]

Quote:

Originally Posted by archosman We let go an employee last Friday. He deleted several files from his computer and emptied the trash. I called the local Mac store and they want $85 an hour to try and recover whatever client files they deleted. We ran TechTool Pro 4 on it using Data recovery and came up with nada. While it's not life-threating is there anything out there software-wise I could get that would allow me to recover whatever he deleted without having to shell out $s at the Mac store?

Just for future reference, there's a product called VirtualLab that isn't free, but allows to you do a scan and retrieve a list of files that can be recovered prior to purchase.

The link can be found here -- from the website, it states:
Recover deleted files using VirtualLab. Files can be recovered that are lost from virus, thrown in the trash, or even from a disgruntled employee.

In the meanwhile, I do hope the Mac store is successful, be sure to keep us updated on the results! =)

 

[pigmode]

archosman,
Let us know how the Mac Store's service works out. They probably use VirtualLab.

 

[archosman]

I hope it works. Needless to say I'm very curious what we'll find...

 

[pigmode]

Quote:

Originally Posted by 3lusiv3 Mac OS X is very secure. Unless there was software already installed and running in the background that helps with recovery, then as far as I know it isn't possible to recover deleted Mac OS X files.

Does it have to do with security, or is this just the way Unix handles deleted files and the blocks they formerly occupied (I mistakenly used "sectors" earlier)?

 

[3lusiv3]

Quote:

Originally Posted by pigmode Does it have to do with security, or is this just the way Unix handles deleted files and the blocks they formerly occupied (I mistakenly used "sectors" earlier)?

I still relate it to security because if I delete I file a "usually" want it to be securely deleted. I'm still a bit confused as to how Mac OS X deletes trashed files, because there is also a Secure Empty Trash option that can take a long time because it writes over the deleted file/s. As far as I know deleting files without choosing that option also writes over the file, but I assume it's not writing over the whole file, but maybe a section of the file and the directory entry for that file. Oh, and yes I would say it is to do with how UNIX handles deleted files.

A few months ago I did a lot of research into recovering deleted files from Mac OS X and tried or read about pretty much all available software for data recovery. I found that none of them actually worked reliably. I spoke to a couple of data recovery experts who told me that they had never succeeded in recovering files from Mac OS X. We even sent a hard drive from Australia to the USA, to a specialist data recovery company, to try and recover some data and they couldn't recover anything. I remember reading, a while ago, that the FBI stated that Mac OS X was very secure that they send Mac OS X computers to the Canadian Mounted police when they need forensic work done. I don't know how true this is.

In the end I was a bit confused as to what types of files are recoverable and what wasn't but it is undeniable that Mac OS X is a secure OS, and if you want to keep your data secure would be a great OS to use.

I'm interested to find out how this thread turns out and whether archosman can get some files back.

 

[archosman]

Damn you Macintosh!!!


/hugs 17 inch powerbook