Data Recovery after Laptop Theft

[ghostslinger]

If this was solved in a previous thread, I'm sorry for wasting peoples' time but I did use the search button and google

A little backstory: basically, my girlfriend had her macbook stolen and she just got it back, but the bugger that took it deleted all her docs, pics, and iTunes music library.
I, being her 24/7 tech support jumped at the opportunity to try and help her. Unfortunately, I have absolutely zero ideas on how to recover things with a Linux recovery cd (I have INSERT at the moment). Is there anyone that might have any ideas on how to go about some basic recovery techniques? Or perhaps describe how the Time Machine might work? I'm a windows turned linux guy and I know little about Macs (especially with leopard now).

Any help is most appreciated and thanks for reading this.

*edit*
the laptop is one of the newer intel processor models (she got it at the same time the original iphone came out, so I'm not sure what it is specifically in regards to model)

[tamoneya]

you should try to use testdisk. You can use the ubuntu liveCD/installer and get it from the repositories. Run these commands in terminal:

sudo apt-get update
sudo apt-get install testdisk
sudo testdisk

Then have it scan the disk for any partitions or files. After it finds them tell it to recover them to an external drive. You do not want to try to recover them to the internal drive because you could by accident end up writing over some of the files you want to recover.

[ghostslinger]

so I could put a Hardy Heron Live image on a flash and just get testdisk from the repos and then see if there's anything salvagable? and then back it up to an external drive? Is it possible I could use a few dvds? because I don't have a drive to spare right now x.X

I know I'm reiterating the instructions you gave me, but I really want her to get back everything she can and I'd hate to be the one to mess things up more.

Also, is there anything I should tell her in regards to keeping the laptop off until I can get testdisk running? I've found a lot of people saying not to use a laptop that's waiting for recovery because files you are trying to rescue might get written over while the computer is in use.

[cyberdork33]

Or perhaps describe how the Time Machine might work? I'm a windows turned linux guy and I know little about Macs (especially with leopard now).

If she used Time Machine, she would have an external Hard drive or something with the backup on it, otherwise Time Machine is irrelevant.

so I could put a Hardy Heron Live image on a flash and just get testdisk from the repos and then see if there's anything salvagable?

no because the Macs won't boot from an external hard drive (not linux anyway).

Also, is there anything I should tell her in regards to keeping the laptop off until I can get testdisk running? I've found a lot of people saying not to use a laptop that's waiting for recovery because files you are trying to rescue might get written over while the computer is in use.

Um yea, definitely DO NOT use the machine. The data is there, the drive is just "marked" as empty. This means the OS will have no problem writing new data there.

I don't know of any, but you might look for recovery apps that run IN OS X... I know, I know, heresy. Unfortunately I think that most of the Open Source tools won't help on an HFS+ filesystem...

[ghostslinger]

The recovery tools in OS X would be nice. But I don't really want to pay. Could I use an external drive I've got my old windows stuff backed up on and possibly create a partition that uses an HFS+ filesystem?

[cyberdork33]

The recovery tools in OS X would be nice. But I don't really want to pay. Could I use an external drive I've got my old windows stuff backed up on and possibly create a partition that uses an HFS+ filesystem?

I don't understand what you are asking. HFS+ is the filesystem that OS X uses, and what was likely "erased" from the drive. This means that the data is on the disc in the HFS+ format still. Most of the recovery tools out there can recover files from a FAT and not much else. (Some support linux filesystems). Unfortunately, without specific on Apple's HFS+ filesystem, recovery tools are a bit difficult to create.

I understand that you do not want to pay, I wouldn't either.

The best thing you could do for her is get an external hard drive and setup time machine so that you will have a backup in the future.

[ghostslinger]

My apologies on being unclear. I really know nothing about filesystems and I only recently just got into Linux via Ubuntu so I'm really still learning quite a bit about computers in general (I wanted to be a network security admin originally, then I found out how unglamorous the job could be XD).
I have an external drive on me. I don't know if I'm completely wrong here, but is it possible I could somehow create a partition on the external and configure it to be an hfs+ filesystem instead of a fat32 (which is what the windows backup is I believe).

Do forgive a clueless noob if I'm asking a question that is glaringly wrong.

[cyberdork33]

I have an external drive on me. I don't know if I'm completely wrong here, but is it possible I could somehow create a partition on the external and configure it to be an hfs+ filesystem instead of a fat32 (which is what the windows backup is I believe).

Yes, I thought you were asking something more related to recovering the data... I think that gparted can create hfs+ partitions, and there is a livecd called "parted magic" that can also create hfs+.

[aysiu]

This screenshot tutorial I made should help you:
http://www.psychocats.net/ubuntucat/...deleted-files/

It's designed for recovering files from Windows instead of Mac, so there are a couple important tweaks to the instructions:

1. You don't boot from CD through BIOS settings. You just hold down the C key while booting up the Macbook.

2. When selecting the filesystem of the drive to be recovered, select HFS+ instead of NTFS

[cyberdork33]

photorec looks like what you are looking for...