Data recovery from Mac under Windows

Joined
May 18, 2020
Messages
12
Reaction score
1
Points
3
Hello,

I don't know if I can post this question here but I would love if someone can help me out of this unrelated subject.

Well, I have an HDD drive that I have been using with my Macbook (OS journaled), after that I removed that drive and plug it in a windows, then formatted it (NTFS) and installed windows 10 on it. After a period of use I wanted to recover some files such images and docs using a data recovery software from that drive. Do I can recover files that were copied when I was using the drive on macbook under windows or I need to to put it on mac again to recover that data?

Any help will be appreciated, thank you :)
 

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
If you reformatted the drive to NTFS I don't think there is any hope to recover any files of any kind that were saved when the drive had macOS installed.
 
Joined
Aug 28, 2017
Messages
535
Reaction score
30
Points
28
Location
Wales, UK
Your Mac's Specs
iMac 27" 32GB i7 3TB & 1TB NVME OSX 13,5,1 late 2013
If you reformatted the drive to NTFS I don't think there is any hope to recover any files of any kind that were saved when the drive had macOS installed.

I agree with you krs

normally once you format the drive again it does rewrite over the old files,

especially if you have saved data over it,

so in this case id say you shouldn't have formatted it in the beginning but hind site is a wonderful thing at times,

so in this case id say your files are now lost and can't be recovered,
 
Joined
Aug 28, 2017
Messages
535
Reaction score
30
Points
28
Location
Wales, UK
Your Mac's Specs
iMac 27" 32GB i7 3TB & 1TB NVME OSX 13,5,1 late 2013
Joined
Feb 4, 2020
Messages
19
Reaction score
0
Points
1
Location
US, LA
Your Mac's Specs
MacBook Air 2017
It's almost impossible but still worth having a try. Firstly, all the data recovery tools are separated into Windows and Mac version - The Mac data recovery software only supports macOS default file systems like APFS, HFS, HFS+, HFSX. And the Windows version only supports NTFS, exFAT, FAT32, etc. Secondly, you've reformatted the HDD with NTFS and rewrite new data. The original data might be overwritten already. So the recovery success rate is very low.

However, when you save new data on the HDD, those data will be stored randomly. It's possible some of the previous data hasn't been written over. My suggestion is to try data recovery on your Mac computer. From my own experience, iBoysoft Data Recovery for Mac is awesome. The deep scan function has saved my files for times. But it is $$$. You can follow this guide: [Solved] How to recover lost data from formatted APFS encrypted drive?

Good luck!
 
Joined
Sep 30, 2007
Messages
9,962
Reaction score
1,235
Points
113
Location
The Republic of Neptune
Your Mac's Specs
2019 iMac 27"; 2020 M1 MacBook Air; macOS up-to-date... always.
Agreed with yuanyasmine. Formatting a drive doesn't automatically render data unrecoverable, but it does add challenges to recovery. Even overwriting data once doesn't make it "impossible" if one had the tools and talent to do the recovery. That's why 3 and 7-pass security wipes are options when formatting a drive... to really REALLY make it hard to recover anything.

If the data is important enough, it may be worth looking into recovery software. I have no opinion on the one yuanyasmine mentioned. I've used Disk Drill to recover deleted files in the past and it works quite well, but I don't know about recovery from partitions that have been re-formatted also.
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
That's why 3 and 7-pass security wipes are options when formatting a drive... to really REALLY make it hard to recover anything.

When I was working for the US Govt and we had drives with sensitive data on them that needed to be removed or replaced, the procedure was to do a security wipe 10 times. The drives were then sent to a special govt facility where they were destroyed.

Nowadays, there are special forensic tools that can recover data from almost anything.
 

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
It's almost impossible but still worth having a try. Firstly, all the data recovery tools are separated into Windows and Mac version - The Mac data recovery software only supports macOS default file systems like APFS, HFS, HFS+, HFSX. And the Windows version only supports NTFS, exFAT, FAT32, etc. Secondly, you've reformatted the HDD with NTFS and rewrite new data. The original data might be overwritten already. So the recovery success rate is very low.

I don't see how any commercial data recovery could even work.
The data was written when the drive was formatted as HFS+, but now the drive is formatted as NTFS - so which data recovery software does one use - I assume the Windows version.
So does that mean one could possibly only recover usable data that the windows recovery software can read?
 

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
Nowadays, there are special forensic tools that can recover data from almost anything.

Yes - if you have the deep, deep pockets.
US Government - no problem, US MacUser - not so much.

However, raised a question in my mind.
The data recovery process from a magnetic medium has been developed and fine-tuned over the years so that even overwritten data can possibly be recovered, but what is the situation with an SSD?
Once data is deleted and those memory cells on the SSD have been cleared - how is it possible to retrieve the previous states. I would think data recovery on an SSD is much more complicated and less successful than on a traditional spinner hard drive.
 
Joined
Feb 4, 2020
Messages
19
Reaction score
0
Points
1
Location
US, LA
Your Mac's Specs
MacBook Air 2017
I don't see how any commercial data recovery could even work.
The data was written when the drive was formatted as HFS+, but now the drive is formatted as NTFS - so which data recovery software does one use - I assume the Windows version.
So does that mean one could possibly only recover usable data that the windows recovery software can read?

All the data recovery software will find lost data according to both the file path and file system. If you use the Windows data recovery software, it will recognize the NTFS drive and scan for lost data based on this file system. But sucrey wants to find data on the previous HFS+ drives, so I don't think the scanning results will be satisfying.

Although Mac data recovery doesn't support NTFS, I've connected my NTFS external hard drive and tried iBoysoft Data Recovery, the software can detect the drive but show this disk file system as unknown. So you can still choose the NTFS drive with the Mac version.
 
Joined
Aug 28, 2017
Messages
535
Reaction score
30
Points
28
Location
Wales, UK
Your Mac's Specs
iMac 27" 32GB i7 3TB & 1TB NVME OSX 13,5,1 late 2013
the problem we are all forgetting here guys is that if the drive has been written with new files especially in NTFS then they could potentially be gone,

yes krs is correct the problem here is that it was a HFS+ drive and its now an NTFS drive we don't know what the OP has put on the drive since then

he could have over written the data 50 times with new data again we don't know this for a fact, he did go to say that he installed windows on the drive and as you all know it is always reading and writing to the drive so again the data may be gone,

to be honest id call it a lost cause and just consider the data gone forever,

my 2 pence worth there,
 
Joined
Sep 30, 2007
Messages
9,962
Reaction score
1,235
Points
113
Location
The Republic of Neptune
Your Mac's Specs
2019 iMac 27"; 2020 M1 MacBook Air; macOS up-to-date... always.
the problem we are all forgetting here guys is that if the drive has been written with new files especially in NTFS then they could potentially be gone,

yes krs is correct the problem here is that it was a HFS+ drive and its now an NTFS drive we don't know what the OP has put on the drive since then

he could have over written the data 50 times with new data again we don't know this for a fact, he did go to say that he installed windows on the drive and as you all know it is always reading and writing to the drive so again the data may be gone,

to be honest id call it a lost cause and just consider the data gone forever,

my 2 pence worth there,

Yeah, I overlooked that he mentioned he had installed Windows 10 on it and used it for a bit. If he had simply reformatted the drive, recovery "technically" should still be possible although practical or affordable is a whole different matter. It'd be a good question to kick to the developer of one of these commercial apps. CleverFiles for example (the developer of Disk Drill), offers a mail-in data recovery service for extreme situations. Actually, I will send them an email asking them for their 2 cents. In any event, I'm with you on this... even if the data is "technically" recoverable, it would require an expert and loads of cash.

EDIT: I sent an email to CleverFiles to confirm, but meanwhile, if I am interpreting their description of the Deep Scan feature of Disk Drill, then yes, it should be possible to recover certain file types even after formatting.

What File Formats Can Disk Drill Recover?
 
Last edited:

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
I believe it was Randy that found a very good but inexpensive data recovery service. I can't find his original post about this but perhaps he will see this thread and comment. I will make sure to stick (paste) that post somewhere so we will be able to find it again.
 
Joined
May 21, 2012
Messages
10,702
Reaction score
1,158
Points
113
Location
Rhode Island
Your Mac's Specs
M1 Mac Studio, 11" iPad Pro 3rdGen, iPhone 13 ProMax, Watch S7, 2018 15" MBP, AirPods Pro
I believe it was Randy that found a very good but inexpensive data recovery service. I can't find his original post about this but perhaps he will see this thread and comment. I will make sure to stick (paste) that post somewhere so we will be able to find it again.
I believe this is it, https://www.300dollardatarecovery.org
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
Yeah, that's it. Thanks Bob. Now to find a place to paste it permanently.



Edit: Posted in the "Members Discount Forum" as a Sticky post and closed thread.
 
Last edited:

krs


Joined
Sep 16, 2008
Messages
3,555
Reaction score
610
Points
113
Location
Canada
Why not create a new category - "Recommended Macintosh Resources" or something like that.
There could also be aan equivalent for iPhones/iPads etc.

There are a lot of excellent resources/suggestions throughout this forum, but they are often hard to find.
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
Thanks for the suggestion. For now though, it's in the "Members Discount" forum.

We will certainly take your suggestion under consideration.
 
Joined
Sep 30, 2007
Messages
9,962
Reaction score
1,235
Points
113
Location
The Republic of Neptune
Your Mac's Specs
2019 iMac 27"; 2020 M1 MacBook Air; macOS up-to-date... always.
Ok, here's the response I got from CleverFiles when inquiring as to whether or not their software (Disk Drill) could recover files after a drive has been formatted to another file system:

Every recovery case is unique, depends on thousands of parameters. The only way to verify your files are recoverable is downloading Disk Drill, running the scan, locating the files in question and previewing them to verify the content. What you will see in Disk Drill Basic will be exactly what can be recovered: Download Free Disk Drill Data Recovery for Windows

More technical details to explain this can be found here: Can You Guarantee That I Can Recover A Specific File with Disk Drill?

5 Simple Steps to Recover Deleted Files on Mac: YouTube

If there was Data overwriting there is a slight chance that some of the files might be damaged, I will suggest to run the scan and make sure you can find and preview the files.

If no preview is available this indicates the file would not be guaranteed for recovery. While it may be possible to recover the files successfully, upgrading would be at your own risk with this understanding.

So basically, not an outright "yes", but clearly not an outright "no" either. I do think the likelihood in the case here is EXTREMELY slim given the usage scenario, but since their software can be used for free to see "if" anything is potentially recoverable, I'd say give it a shot. You have nothing to lose.

Just for laughs, I think I'll run a trial of it on a thumb drive to verify recovery can be done after a simple re-format to another file system.
 
Joined
Sep 30, 2007
Messages
9,962
Reaction score
1,235
Points
113
Location
The Republic of Neptune
Your Mac's Specs
2019 iMac 27"; 2020 M1 MacBook Air; macOS up-to-date... always.
I just did a test run of Disk Drill. I took a USB thumb drive that I've used for a variety of needs over the years, but was at that moment formatted in ExFAT and empty. I formatted it in HFS+; copied over a movie in MKV format, a folder of desktop wallpaper in jpg format, and folder of m4a music tracks. I then rebooted into Windows; re-formatted the USB drive as NTFS; then rebooted back into macOS. I ran Disk Drill on this thumb drive, still formatted as NTFS and "empty". The results? HOLY MOTHER OF PEARL! Not only did it find ALL of my test files, but I was able to validate even in the free version that the JPGs were good (it uses Quick Look). The music tracks? All there, WITH the cover art visible in quick look. Same for my video, which also had embedded cover art.

But that's not all! It found a plethora of other files, including some RTF documents that were readable using Quick Look and referenced High Sierra. I've used this thumb drive previously as a High Sierra bootable installer, so that's where those came from. But WOW! Given that, and that this drive was last formatted in ExFAT before my little trial, the drive was reformatted AT LEAST 3 times since used as that installer. What's more? I only scanned the partition, not the whole drive. The partition is formatted for the whole drive, but DD says it might be able to find more recoverable files by doing a deep scan on the entire drive. Check out screen grabs below. First are caps of the Finder contents before I formatted it. Then Disk Drill's results after scanning the reformatted and "empty" drive (again, it's an NTFS-formatted drive at this point, but I'm running DD in macOS); and a couple Quick Look caps of what it found.


screenshot_11.jpg screenshot_12.jpg screenshot_14.jpg screenshot_15.jpg screenshot_16.jpg
 

Shop Amazon


Shop for your Apple, Mac, iPhone and other computer products on Amazon.
We are a participant in the Amazon Services LLC Associates Program, an affiliate program designed to provide a means for us to earn fees by linking to Amazon and affiliated sites.
Top