Undelete from HFS+ partition

petterg · Guru Joined: 25 Mar 2004 Posts: 500 Location: Oslo, Norway

So, someone deleted a project folder on a mac running OSX.
In order to try to rescue data from this folder I placed the harddriv into my gentoo box. I'm able to mount the drive readonly (haven't tried to mount it rw) and read files.

Assuming it's a HFS+ partition, how can I undelete the files on it?

I'm not very experienced in linux, so I'm not sure how to figure out the correct partition type, but I'm guessing it's a Apple HFS+ partition.

Thank you,
-pg

Fitzsimmons · Posted: Mon Jun 07, 2004 4:16 pm Post subject:

Admittedly, I can't offer any help on recovering this partition, but I'm unsure of what you hope to accomplish by mounting the partition in your gentoo box. If the files are deleted, the files are deleted, and you don't have a ton of options when it comes to getting them back. There might be programs to undelete (but I haven't been able to find any by searching google), and you may be able to pay a data recovery company with tools comparable to law enforcement data recovery tools. Either option will probably end up costing you some money.

petterg · Guru Joined: 25 Mar 2004 Posts: 500 Location: Oslo, Norway

Thank you for responding to my post.

If the disk is in the mac, and I boot it, it will write to the partition. That will lower my chances to undelete.
In the gentoo box I can mount it readonly.

I've had success on undeleting ext3, reiserfs and fat partitions before. But I haven't found any tools to handle HFS partitions.

Still hoping that someone have some ideas of what to do.