search

RJVB / afsctool

This is a version of "brkirch"'s afsctool utility that allows end-users to leverage HFS+ compression.
https://brkirch.wordpress.com/afsctool
GNU General Public License v3.0
187 stars 18 forks source link

Recovering missing/deleted files #54

Closed johtso closed 2 years ago

johtso commented 2 years ago

It's a bit of a long shot, but would you have any advice on recovering files that were compressed using this tool but are no longer visible in the file system?

I'm guessing any commercial file recovery software will not understand the compression?

RJVB commented 2 years ago

Do you have any idea how the files got to be missing?

Compression doesn't alter the directory structure, which is how files are registered (and normal deletion just removes the file entry from the directory so its disk blocks can be reused).

I will need to assume that file recovery software for Mac has to be capable of dealing with compression because for years now Apple have been providing compressed system files and applications. It's probably tricky because the compression data is stored (in part) in extended attributes which might get lost if you remove a file's directory entry *). You'd have to contact the makers of the software to get a definite answer.

*) if that's the case, the content of small files that compress entirely something stored as an extended attribute will be lost. I assume that the content of larger files will show up as binary data which you could try to decode using the appropriate decompression algorithm (as implemented in afsctool for zip compression).

johtso commented 2 years ago

@RJVB thanks for the thoughtful response!

The data is a few tens of thousands of json files each about 1MB in size.

I'm not sure how the files disappeared, I just have an empty directory where I expected the files to be. It was probably just a case of user error and I deleted them.

Being an external SSD drive with plenty of free space, if my understanding is correct, anything that has been written to the drive should still be there somewhere.

I don't see any file recovery software making mention of afsc or HFS+ compression. (encryption is something that some explicitly advertise as supporting).

None of the tools I've tried so far have turned anything up.

RJVB commented 2 years ago

I don't see any file recovery software making mention of afsc or HFS+ compression. (encryption is something that some explicitly advertise as supporting).

Encryption would have to be supported explicitly, because an encrypted disk doesn't have a regular directory tree (or rather, it's encrypted too). HFS compression uses the old resource fork and extended attributes. The former should be supported by default by Mac-specific recovery tools even if it isn't really used anymore these days. The latter, I have no idea.

Either way, compression is about content and AFAIK file recovery doesn't normally rely on file content because a priori it's meaningless. But as I said, you'd have to ask the makers of the software. Or ask on a forum with/for advanced Mac users if recovery software exists that's known to handle compressed files.

I hope you don't have secure empty of the trashcan enabled, even if it seems unlikely that you would have moved thousands of files to the bin. It also seems unlikely that all those files were lost because they were open when your Mac crashed.

johtso commented 2 years ago

Thanks for the insight! I think it was probably more a case of rm -rfing the wrong thing, so no trashcan involved. Teaches me not to frantically try and free up disk space late at night!