cgsecurity.org

Unfortunately I am not familiar with the Linux software raid software mdadm.

I guess mdadm can assemble disks and partitions. The following description is assuming assembling disks into a RAID array. Assembling partitions into a raid array should work in an analogous way.

When using TestDisk in a ...

Please post your log file.
Quick search is searching for partitions, not for files and folders.
Please explain what you mean when you say "a lot of files and folders turn up".
Did you use TestDisk or PhotoRec?
Try to be specific so that a third person can understand what you did exactly.

Running ...

Are there other settings I should change, or should I just get a larger USB stick?


Get a larger storage device. Be careful: Garbage flash storage often ends in USB sticks.
If your recovery target device is empty and as big as your recovery source you should not have a space problem.

PhotoRec ...

Try other recovery software. If everything else fails, uses PhotoRec.
Before doing so, check SMART parameters using smartmontools or Crystaldiskinfo.
Depending on the results use a professional recovery lab or continue on your own.
When continuing on your own, clone the disk using ddrescue as ...

I don't own a Mac, I have no experience with those apples.

TestDisk only supports APM (apple partition map). When TestDisk asks you to select the type of partition table, the apple choice is marked as "legacy".
It seems that TestDisk does not support the newer APFS.

device hardware isn't damaged, there only a freeze with a closed force during a transfer...

I would recommend you asking for the help of a professional recovery lab because your observation does not ring a bell.


but how scan the whole device with the hex editor?

Not every hex editor allows ...

Partitions are not allowed to overlapp.
If you recover the first partition you have to leave the partition starting at sector 2054 untouched in deleted status.

Checking the directories of a file system with the p-key ("list files") does not guarantee that the underlying file system is healthy ...

I don't have another empty drive.

No free space, no recovery.


For the scan inside file system table, to extract password value (if in status readable) near strings const such as "pass", "psw", "password", how can I do?

Any hex editor will do. But reading from a suspicous storage device ...

in my case a part of metadata exist, another part is lost and are viewed strange characters.

In this case TestDisk will recover only the files whose metadata lies in the readable part of the total metadata. If you want to recover a half broken folder I can't tell you what that gives once ...

PhotoRec is the last line of defense. It is to be used when metadata is lost or dammaged. Therefore metadata like file name, folder paths are not available. PhotoRec is useless in your scenario. If metadata exists you can use TestDisk to browse the partition and select files and folders to be ...