HFS + file system: testing data recovery software

The file system acts as the main element of disk space management for storage of data. On Apple devices, this is HFS +, also known as Mac OS Extended. It is the next enhancement to the previous version of HFS.



image



HFS + File System (Mac OS Extented)



The cumulative series of system updates has resulted in improved file structure reliability. HFS + uses a nodal tree-based file-base format along with the mandatory record of changes that have occurred. In a dedicated place on the drive, the system has a special part of the service information, which contains data about all the elements located on the disk. As well as important information required to fully boot and operate HFS +.



image



The new version of the system design complicates data recovery operations, since information about objects is instantly updated when any changes are made (deletion, failure, breakdown, etc.). And not every software on the market today is capable of returning the files that are in demand. Therefore, below we will consider several programs that can return files from HFS + drives and carry out a comparative analysis.





List of involved applications



The list of applications that will participate in the test will include all known brands of software. The main requirement for the applications was that the participants in the comparison must support the recovery process from HFS + disks. These include such products as Hetman, R-Studio, Easeus, DiskDrill, UFS Explorer.



In MacOS, we recorded various objects most frequently used by users on a medium, namely photographs, videos, office texts. Then we erased some of them. We connected the disk to another computer, which already had all the tested programs, and tested their capabilities. We presented the results obtained below.



image



Note. Recuva does not recognize this file system, so we did not use it in our tests.



Simple delete option



All of the listed applications have successfully coped with this type of test with varying degrees of success. In more detail, the final results are as follows. Hetman Partition Recovery



application - in the main window the HFS + drive is defined correctly and its name is specified correctly. After a simple analysis (there are 2 types of scanning to choose from and we chose the fastest), the deleted objects were found, the internal order was completely preserved, the file names have their original values, the contents are displayed. The searched files have been restored.



image



RStudio utility- HFS + media was successfully detected, the disk name and the type of system used are indicated. After performing a quick analysis, RStudio found the erased files, but one folder (1Movie) was missing, some of the elements were presented in several copies, and some files were listed as deleted, although we did not perform any actions with them. The files have been restored except for one directory.



image



Easeus Data Recovery Wizard - disk found, correct HFS + system type and media name. The utility contains only a full drive check option. Upon completion, all deleted items are found and restored. However, the program does not highlight the recovered files with any mark. Some of the elements have copies. You have to spend time and check the entire data set to find the files you need.



image



DiskDrill utility - presents the correct amount of media in the highlighted program field, but marks its type as HFS with an unknown name. The choice of the fast option for examining the disk did not give any results. Only existing files are shown in the window. After extensive scanning, the contents of the media are distributed among different directories, according to their extension. The recovered files are not highlighted, their total number is unknown, the internal content of the files is not shown.



image



UFSExplorer program- no media name is specified, but the system is marked correctly. There is no simple scan option. A complete analysis restored deleted files, displayed the correct organizational structure and labeling of objects, provided a preview of all content of your choice, except for text files (the ability to successfully recover documents is questionable).



image



Brief preliminary evaluations of all samples after the first test - the listed samples were able to return the deleted objects, the products from Hetman and Easeus showed the best result in comparison with the remaining ones, which have individual shortcomings.



Volume header damaged, deleted or missing



We deliberately made the task more difficult. First, we erased the volume header, and then ran a test check of the utilities.



Hetman app - media information displayed correctly. The quick scan option found all deleted files, correctly displayed the organizational order of items on the disk, prepared objects for recovery, and when selected, it shows the contents of the files.



image



RStudio utility - also all drive specifications are correct. However, as in the first test, RStudio did not return the 1Movie folder and presented multiple copies of separate directories. Although all the other files were restored.



image



Easeus program- correctly submitted information about the disk in full. The scan result completely repeats the results from the passed test. All files have been returned, however there is no split and some of the files are presented along with their copies.



image



DiskDrill - As before, limited media information. And after scanning, there is a wide spread of files in different folders, the presentation format is broken, it is impossible to get acquainted with the contents of many documents. Weak results force us to abandon further testing of this utility.



image



UFSExplorer - incomplete disk data set, media name missing. Also, as before, I restored all the files, returned the correct disk structure, but there were problems with displaying texts.



image



Additionally erased a copy of the header in the HFS + metadata



The programs dealt with the new call as follows.



Hetman app - bearer information truncated, no type defined, no name. We use the full scan option. Despite the lack of metadata, the final build of the media is correct, the files are restored and displayed on access.



image



RStudio software - partially displays information about the disc, there is no name, the type is not defined. After analysis, the information is presented in full. However, not all files were recovered, as before. There is no separate directory with 1Movie videos and additionally there is no directory with the doc file.



image



Easeus utility- also incomplete information about the disk, the name and type of the system are unknown. But after scanning, the program was able to recover deleted files, however, as in previous tests, additional copies of some content appeared.



image



UFSExplorer - disk unknown, no information available. After disk analysis, the program found deleted items, although it is not able to present the contents of text documents.



image



Loss of metadata

In the final test of recovery applications, we will simulate critical damage to the media file system, namely, first remove the top-level tree nodes, and then, in addition, erase the second-level Index Nodes. In both the first and second tests, each of the programs showed a similar result.



Hetman - Disc shown but no information available. After a full scan, the drive was identified, the internal structural presentation of the contents was restored, all files returned, displayed on click and ready to be saved.



image



RStudio - disk unknown, but after scanning all information is presented. The application successfully restored deleted items except, the situation repeated itself, the contents of the 1Movie and doc directories. The rest of the files are viewed on access, the internal form of the drive is returned to its original state.



image



Easeus- the drive was found, but there is no data about it. The software analysis also completely restored the lost elements, they can be viewed if necessary, but there are still additional extra copies of individual objects.



image



UFSExplorer - the type of media is not defined, its parameters are unknown. After scanning, the structural composition of the content takes on its original form, the files are restored, they can be saved, but all the same, the contents of some texts are not displayed.



Output



Four out of five programs passed the capability test successfully. Each, to a greater or lesser extent, was able to recover the deleted files. There were some moments when displaying some elements for review, but, in general, the main four applications passed the test, with the exception of DiskDrill.



See the source for the full article with all additional video tutorials .



All Articles