Trying to recover an HFS+ partition that was accidentally formatted

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
yuanqi
Posts: 3
Joined: 21 Jun 2021, 02:52

Trying to recover an HFS+ partition that was accidentally formatted

#1 Post by yuanqi »

Old partition occupies the whole disk. There are a few VMware images, which accounts for the smaller partitions found on full scan. The files I am trying to recover are rather large video files. I have had some success with some of the files via Prosoft Data Rescue, but the rest are only partially recovered (I'm assuming the software is not able to deal with fragmentation. https://www.dropbox.com/s/8c2eta396xedk ... g.zip?dl=0

yuanqi
Posts: 3
Joined: 21 Jun 2021, 02:52

Re: Trying to recover an HFS+ partition that was accidentally formatted

#2 Post by yuanqi »

I'm posting the beginning of the log in case people are having trouble with the link.

Code: Select all

Mon Mar 22 19:05:42 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 18.7.0 (Darwin Kernel Version 18.7.0: Tue Jan 12 22:04:47 PST 2021; root:xnu-4903.278.56~1/RELEASE_X86_64) x86_64
Compiler: GCC 4.0
Compilation date: 2021-02-28T12:00:35
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 1050 GB / 978 GiB - 2051200368 sectors (RO), sector size=512
Disk /dev/disk2 - 4000 GB / 3726 GiB - 976754645 sectors, sector size=4096
Disk /dev/rdisk0 - 1050 GB / 978 GiB - 2051200368 sectors (RO), sector size=512
Disk /dev/rdisk1 - 1050 GB / 977 GiB - 256348836 sectors (RO), sector size=4096
Disk /dev/rdisk2 - 4000 GB / 3726 GiB - 976754645 sectors, sector size=4096

Partition table type (auto): EFI GPT
Disk /dev/disk2 - 4000 GB / 3726 GiB
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976754644 (expected 976754644)
hdr_lba_start=6
hdr_lba_end=976754639
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P Mac HFS                        1  976754644  976754644
 1 P Mac HFS                        1  976754644  976754644

HFS_HFSP_boot_sector
 1 P Mac HFS                        1  976754644  976754644
Volume header
Bad

Backup volume header
Bad

Sectors are identical.

Analyse Disk /dev/disk2 - 4000 GB / 3726 GiB - 976754645 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976754644 (expected 976754644)
hdr_lba_start=6
hdr_lba_end=976754639
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P Mac HFS                        1  976754644  976754644
Current partition structure:
No HFS or HFS+ structure
 1 P Mac HFS                        1  976754644  976754644
 1 P Mac HFS                        1  976754644  976754644

search_part()
Disk /dev/disk2 - 4000 GB / 3726 GiB - 976754645 sectors
FAT32 at 6/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 6/0/1
     EFI System                     6      76805      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB

HFS+ magic value at 91713/0/1
part_size 976519142
     Mac HFS                    91713  976610854  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

Results
   P EFI System                     6      76805      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB
   P Mac HFS                    91713  976610854  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

interface_write()
 1 P EFI System                     6      76805      76800 [EFI System Partition] [EFI]
 2 P Mac HFS                    91713  976610854  976519142

search_part()
Disk /dev/disk2 - 4000 GB / 3726 GiB - 976754645 sectors
FAT32 at 6/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 6/0/1
     EFI System                     6      76805      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB
FAT32 at 12/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
FAT differs, FAT sectors=64-75/75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 12/0/1
     EFI System                    12      76811      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB

HFS+ magic value at 91713/0/1
part_size 976519142
     Mac HFS                    91713  976610854  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

HFS+ magic value at 91723/0/1
part_size 976519142
     Mac HFS                    91723  976610864  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

HFS+ magic value at 91733/0/1
part_size 976519142
     Mac HFS                    91733  976610874  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

HFS+ magic value at 91743/0/1
part_size 976519142
     Mac HFS                    91743  976610884  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

HFS+ magic value at 91753/0/1
part_size 976519142
     Mac HFS                    91753  976610894  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Trying to recover an HFS+ partition that was accidentally formatted

#3 Post by recuperation »

Search for posts on the same topic before posting a
new question.

yuanqi
Posts: 3
Joined: 21 Jun 2021, 02:52

Re: Trying to recover an HFS+ partition that was accidentally formatted

#4 Post by yuanqi »

Can I confirm that testdisk is not able to recover HFS+ partition if the backup volume header is also bad, and I would need to try photorec instead?

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Trying to recover an HFS+ partition that was accidentally formatted

#5 Post by recuperation »

Your initial posting is incomprehensible. There is no logical connection between your posting title and the content.

As stated on the top page of https://www.cgsecurity.org/

Testdisk can find different types of lost partitions listed in this sentence:
If you have lost partition or strange problem with your hard disk partitions, run TestDisk to recover your data. TestDisk detects numerous filesystem including NTFS, FAT12, FAT16, FAT32, exFAT, ext2, ext3, ext4, btrfs, BeFS, CramFS, HFS, JFS, Linux Raid, Linux Swap, LVM, LVM2, NSS, ReiserFS, UFS, XFS.
Unfortunately Testdisk can only do a few things inside a small selection of partition types listed above.
TestDisk can also undelete files from FAT, NTFS, exFAT and ext2 filesystem.
Testdisk can do some very basic repairs.

You formated your HFS(+) partition. Formating does not mean loosing the partition. It affects the content of the partition.

Therefore you don't have a lost HFS+ partition. The partition is there but you overwrote some content.
Yes, only Photorec would help you now with your formated HFS+ partition.

Locked