”My Mac started behaving strangely so I attempted to reboot it but failed. Thanks for returning the files I thought were lost forever.”
Tracy Benton, Exeter
From Exeter we received a 1TB Western Digital hard disk drive at our laboratory in Oxford. The drive was examined by our hardware data recovery specialists revealing no apparent problems. Our hardware engineers were able to secure a sector-by-sector image of the drive encountering no unreadable bad sectors during the process.
An examination of the secured disk image by our data recovery specialists revealed a single HFS Plus data volume. The data structures were analysed which revealed that the Volume Header position did not match the position information in the partition map. Further analysis revealed that the catalog header record was also displaced, either of which will stop the file system from being able to be successfully mounted. These problems appear to have been the result of a virus infection caused by the installation of some malware. .
Our data recovery specialists were able to create a virtual HFS Plus volume, with the data structures correctly aligned, allowing a full analysis of the files contained on the volume. This analysis found the volume contained approximately 480GB of data comprising operating system and application files, photos, iTunes files and office documents. During the extraction of data the application responsible for causing the corruption to the file system was detected and quarantined.