HFS + file system: testing data recovery software

The file system acts as the main element of disk space management for storage of data. On Apple devices, this is HFS +, also known as Mac OS Extended. It is the next enhancement to the previous version of HFS.

image

HFS + File System (Mac OS Extented)

The cumulative series of system updates has resulted in improved file structure reliability. HFS + uses a nodal tree-based file-base format along with the mandatory record of changes that have occurred. In a dedicated place on the drive, the system has a special part of the service information, which contains data about all the elements located on the disk. As well as important information required to fully boot and operate HFS +.

image

The new version of the system design complicates data recovery operations, since information about objects is instantly updated when any changes are made (deletion, failure, breakdown, etc.). And not every software on the market today is capable of returning the files that are in demand. Therefore, below we will consider several programs that can return files from HFS + drives and carry out a comparative analysis.

List of involved applications

The list of applications that will participate in the test will include all known brands of software. The main requirement for the applications was that the participants in the comparison must support the recovery process from HFS + disks. These include such products as Hetman, R-Studio, Easeus, DiskDrill, UFS Explorer.

In MacOS, we recorded various objects most frequently used by users on a medium, namely photographs, videos, office texts. Then we erased some of them. We connected the disk to another computer, which already had all the tested programs, and tested their capabilities. We presented the results obtained below.

image

Note. Recuva does not recognize this file system, so we did not use it in our tests.

Simple delete option

All of the listed applications have successfully coped with this type of test with varying degrees of success. In more detail, the final results are as follows.

application Hetman Partition Recovery – in the main window, the HFS + drive is defined correctly and its name is correctly specified. After a simple analysis (there are 2 types of scanning to choose from and we chose the fastest), the deleted objects were found, the internal order was completely preserved, the file names have their original values, the contents are displayed. The searched files have been restored.

image

RStudio utility – HFS + media was successfully detected, the disk name and the type of system used are indicated. After performing a quick analysis, RStudio found the erased files, but one folder (1Movie) was missing, some of the elements were presented in several copies, and some files were listed as deleted, although we did not perform any actions with them. The files are restored except for one directory.

image

Easeus Data Recovery Wizard – the disk is found, the type of the HFS + system and the name of the medium are correctly defined. The utility contains only a full drive check option. Upon completion, all deleted items are found and restored. However, the program does not highlight the recovered files with any mark. Some of the elements have copies. You have to spend time and check the entire data set to find the files you need.

image

DiskDrill Utility – represents the correct amount of media in the highlighted program field, but marks its type as HFS with an unknown name. The choice of the fast option for examining the disk did not give any results. Only existing files are shown in the window. After extensive scanning, the contents of the media are distributed among different directories, according to their extension. The recovered files are not highlighted, their total number is unknown, the internal content of the files is not shown.

image

UFSExplorer program – no media name is specified, but the system is marked correctly. There is no simple scan option. A complete analysis restored deleted files, displayed the correct organizational structure and labeling of objects, provided a preview of all content of your choice, except for text files (the ability to successfully recover documents is questionable).

image

Brief preliminary evaluations of all samples after the first test – the listed samples were able to return the deleted objects, the products from Hetman and Easeus showed the best result in comparison with the remaining ones, which have individual shortcomings.

Volume header damaged, deleted or missing

We deliberately made the task more difficult. First, we erased the volume header, and then ran a test check of the utilities.

Hetman app – the media information is displayed correctly. The quick scan option found all deleted files, correctly displayed the organizational order of items on the disk, prepared objects for recovery, and when selected, it shows the contents of the files.

image

RStudio utility – also all characteristics of the drive are correct. However, as in the first test, RStudio did not return the 1Movie folder and presented multiple copies of separate directories. Although all the other files were restored.

image

Easeus program – correctly submitted information about the disk in full. The scan result completely repeats the results from the passed test. All files have been returned, but there is no split and some of the files are presented along with their copies.

image

DiskDrill – as before, limited media information. And after scanning, there is a wide spread of files in different folders, the presentation format is broken, it is impossible to get acquainted with the contents of many documents. Weak results force us to abandon further testing of this utility.

image

UFSExplorer – incomplete set of data about the disk, the name of the medium is missing. Also, as before, I restored all the files, returned the correct disk structure, but there were problems with displaying texts.

image

Additionally erased a copy of the header in the HFS + metadata

The programs dealt with the new call as follows.

Hetman app – bearer information truncated, no type defined, no name. We use the full scan option. Despite the lack of metadata, the final build of the media is correct, the files are restored and displayed on access.

image

RStudio program – partially displays information about the disc, there is no name, the type is not defined. After analysis, the information is presented in full. However, not all files were recovered, as before. There is no separate directory with 1Movie videos and additionally there is no directory with the doc file.

image

Easeus utility – also incomplete information about the disk, the name and type of the system are unknown. But after scanning, the program was able to recover deleted files, however, as in previous tests, additional copies of some content appeared.

image

UFSExplorer – the disk is unknown, there is no information. After disk analysis, the program found deleted items, although it is not able to present the contents of text documents.

image

Loss of some metadata

In the final test check of recovery applications, we will simulate critical damage to the media file system, namely, first we delete the top-level tree nodes, and then, in addition, we will also erase the second-level Index Nodes. In both the first and second tests, each of the programs showed similar results.

Hetman program – The disc is shown, but there is no information about it. After a full scan, the drive was identified, the internal structural presentation of the contents was restored, all files returned, displayed on click and ready to be saved.

image

RStudio – disk is unknown, but after scanning all information is presented. The application successfully restored deleted items except, the situation repeated itself, the contents of the 1Movie and doc directories. The rest of the files are viewed on access, the internal form of the drive is returned to its original state.

image

Easeus – the drive was found, but there is no data about it. The software analysis also completely restored the lost elements, they can be viewed if necessary, but there are still additional extra copies of individual objects.

image

UFSExplorer – the type of media is not defined, its parameters are unknown. After scanning, the structural composition of the content takes on its original form, the files are restored, they can be saved, but all the same, the contents of some texts are not displayed.

Output

Four out of five programs passed the capability test successfully. Each, to a greater or lesser extent, was able to recover the deleted files. There were some moments when displaying some elements for review, but, in general, the main four applications passed the test, with the exception of DiskDrill.

For the full version of the article with all additional video tutorials, see source

Similar Posts

Leave a Reply

Your email address will not be published. Required fields are marked *