First time using TestDisk, and I am trying to recover data from an iMac hard drive that went kaputs (we assume malware). I went through the motions up until it asked me to select the partition table type.
The first time it asked me to select a partition type, there was no hint at the bottom of the terminal suggesting a specific type, so I chose intel (thought it was correct after a tiny amount of research). However, it did not find anything, so I did a deeper search which then crashed my computer.
Now, when it asks me to select a partition, it states that it has detected "none" as the partition type.
Did I mess up and prevent myself from gathering the data off of the hard drive? At the very least, the storage inside of it did not change, so it appears that the data is still stored inside.
Any help is greatly appreciated!
Accidentally chose wrong partition type, then scanned
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
silvermace
- Posts: 2
- Joined: 14 Apr 2020, 10:31
-
cgrenier
- Site Admin
- Posts: 5432
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Accidentally chose wrong partition type, then scanned
Using testdisk should not crash your computer. Was your computer over-heating ?
It's recommanded to use EFI GPT when scanning a Mac osx disk.
If TestDisk failed to find the lost partition, try PhotoRec instead.
It's recommanded to use EFI GPT when scanning a Mac osx disk.
If TestDisk failed to find the lost partition, try PhotoRec instead.
-
silvermace
- Posts: 2
- Joined: 14 Apr 2020, 10:31
Re: Accidentally chose wrong partition type, then scanned
No, my computer was not overheating.
A little more info: the computer I am trying to recover data from is an iMac (2009-ish) that was blocked up due to a type of malware/virus, and it currently still has the hard drive still inside it. I am using Target Disk Mode to try and connect to my own personal computer, a MacBook Pro (2013-ish, also Boot Camped with Windows 10), and they're being connected with a thundercable.
When asked to select a hard drive, I am given four options for the one, singular hard drive: the two dev/disk and dev/rdisk variants of a 1000/ 931 GB option, and a 999/ 930 GB option. the 1000 GB usually has something like (RO) next to it, although I'm not sure what that means.
I selected the dev/disk 999/930 GB option and attempted to scan for files on it, but I had chosen the incorrect partition type (Intel), when it probably, as you've said, should have been EFI GPT. Before I scanned it, TestDisk gave no indication or hint of which partition it had detected. But when I selected the Intel one and scanned for files, my computer had "crashed", or did a hard restart "because of a problem". Now when I go to select the partition for that same 999/930 GB option, it gives me the hint that it detects it as a "non-partitioned hard drive". My question is, did scanning the drive with the incorrect partition type mess with the formatting, or did the interruption that occurred while scanning do something to it?
I also attempted to recover data using Photorec, only after I had already experienced the events above. It states the partition type is "P Unknown". and it also runs into the same issue, where it sends my computer into a hard reset "because there was a problem" when scanning for files, although this time it actually ended up looking through the hard drive for a couple minutes. During that time, it had gone through over half the sectors (or blocks? Bytes? Units? whatever the numbers stand for), and located 0 files (I was looking for jpgs and pngs only).
Also, I'm not sure how important this info is, but before I did any of this, trying to put the iMac into recovery mode took about 20 minutes or so (slow, I know). But now, after these events, it takes around 2 hours to go into recovery.
EDIT: it appears that when I resume progress with Photorec in the same place before it crashed my computer, it immediately crashes my computer. It might appear that the act of locating a single file crashes my computer. I am about 85% sure that is the case. Is there any way to work around this? Or is there something else that is causing this to happen?
Also, when I go select a drive, all of the options have (RO) at the end of them.
EDIT 2: Actually, putting the iMac into recovery mode seems to have.. "reset" the partition type? It no longer detects it as a non-partition. So now my issue is more along the lines of photorec crashing when it reaches a certain point in the hard drive, and TestDisk not finding a partition to analyze at all. Using TestDisk, and after selecting Analyze, it just says "Trying alternative GPT", then after awhile it says "error read at [different intervals, usually around 30000-40000 apart]. Eventually, this too crashes my computer. somewhere near at least the 2,000,000 mark, out of 198,000,000.
doing Photorec again, it managed to get past a full pass, "Pass 0". However, at the beginning of "Pass 1", it ended up crashing once more.
A little more info: the computer I am trying to recover data from is an iMac (2009-ish) that was blocked up due to a type of malware/virus, and it currently still has the hard drive still inside it. I am using Target Disk Mode to try and connect to my own personal computer, a MacBook Pro (2013-ish, also Boot Camped with Windows 10), and they're being connected with a thundercable.
When asked to select a hard drive, I am given four options for the one, singular hard drive: the two dev/disk and dev/rdisk variants of a 1000/ 931 GB option, and a 999/ 930 GB option. the 1000 GB usually has something like (RO) next to it, although I'm not sure what that means.
I selected the dev/disk 999/930 GB option and attempted to scan for files on it, but I had chosen the incorrect partition type (Intel), when it probably, as you've said, should have been EFI GPT. Before I scanned it, TestDisk gave no indication or hint of which partition it had detected. But when I selected the Intel one and scanned for files, my computer had "crashed", or did a hard restart "because of a problem". Now when I go to select the partition for that same 999/930 GB option, it gives me the hint that it detects it as a "non-partitioned hard drive". My question is, did scanning the drive with the incorrect partition type mess with the formatting, or did the interruption that occurred while scanning do something to it?
I also attempted to recover data using Photorec, only after I had already experienced the events above. It states the partition type is "P Unknown". and it also runs into the same issue, where it sends my computer into a hard reset "because there was a problem" when scanning for files, although this time it actually ended up looking through the hard drive for a couple minutes. During that time, it had gone through over half the sectors (or blocks? Bytes? Units? whatever the numbers stand for), and located 0 files (I was looking for jpgs and pngs only).
Also, I'm not sure how important this info is, but before I did any of this, trying to put the iMac into recovery mode took about 20 minutes or so (slow, I know). But now, after these events, it takes around 2 hours to go into recovery.
EDIT: it appears that when I resume progress with Photorec in the same place before it crashed my computer, it immediately crashes my computer. It might appear that the act of locating a single file crashes my computer. I am about 85% sure that is the case. Is there any way to work around this? Or is there something else that is causing this to happen?
Also, when I go select a drive, all of the options have (RO) at the end of them.
EDIT 2: Actually, putting the iMac into recovery mode seems to have.. "reset" the partition type? It no longer detects it as a non-partition. So now my issue is more along the lines of photorec crashing when it reaches a certain point in the hard drive, and TestDisk not finding a partition to analyze at all. Using TestDisk, and after selecting Analyze, it just says "Trying alternative GPT", then after awhile it says "error read at [different intervals, usually around 30000-40000 apart]. Eventually, this too crashes my computer. somewhere near at least the 2,000,000 mark, out of 198,000,000.
doing Photorec again, it managed to get past a full pass, "Pass 0". However, at the beginning of "Pass 1", it ended up crashing once more.