cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

Trying to recover an HFS+ partition that was accidentally formatted

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=11379

Page 1 of 1

Trying to recover an HFS+ partition that was accidentally formatted

Posted: 21 Jun 2021, 03:05
by yuanqi
Old partition occupies the whole disk. There are a few VMware images, which accounts for the smaller partitions found on full scan. The files I am trying to recover are rather large video files. I have had some success with some of the files via Prosoft Data Rescue, but the rest are only partially recovered (I'm assuming the software is not able to deal with fragmentation. https://www.dropbox.com/s/8c2eta396xedk ... g.zip?dl=0

Re: Trying to recover an HFS+ partition that was accidentally formatted

Posted: 24 Jun 2021, 15:51
by yuanqi
I'm posting the beginning of the log in case people are having trouble with the link.

Code: Select all

Mon Mar 22 19:05:42 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 18.7.0 (Darwin Kernel Version 18.7.0: Tue Jan 12 22:04:47 PST 2021; root:xnu-4903.278.56~1/RELEASE_X86_64) x86_64
Compiler: GCC 4.0
Compilation date: 2021-02-28T12:00:35
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 1050 GB / 978 GiB - 2051200368 sectors (RO), sector size=512
Disk /dev/disk2 - 4000 GB / 3726 GiB - 976754645 sectors, sector size=4096
Disk /dev/rdisk0 - 1050 GB / 978 GiB - 2051200368 sectors (RO), sector size=512
Disk /dev/rdisk1 - 1050 GB / 977 GiB - 256348836 sectors (RO), sector size=4096
Disk /dev/rdisk2 - 4000 GB / 3726 GiB - 976754645 sectors, sector size=4096

Partition table type (auto): EFI GPT
Disk /dev/disk2 - 4000 GB / 3726 GiB
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976754644 (expected 976754644)
hdr_lba_start=6
hdr_lba_end=976754639
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P Mac HFS                        1  976754644  976754644
 1 P Mac HFS                        1  976754644  976754644

HFS_HFSP_boot_sector
 1 P Mac HFS                        1  976754644  976754644
Volume header
Bad

Backup volume header
Bad

Sectors are identical.

Analyse Disk /dev/disk2 - 4000 GB / 3726 GiB - 976754645 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976754644 (expected 976754644)
hdr_lba_start=6
hdr_lba_end=976754639
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P Mac HFS                        1  976754644  976754644
Current partition structure:
No HFS or HFS+ structure
 1 P Mac HFS                        1  976754644  976754644
 1 P Mac HFS                        1  976754644  976754644

search_part()
Disk /dev/disk2 - 4000 GB / 3726 GiB - 976754645 sectors
FAT32 at 6/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 6/0/1
     EFI System                     6      76805      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB

HFS+ magic value at 91713/0/1
part_size 976519142
     Mac HFS                    91713  976610854  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

Results
   P EFI System                     6      76805      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB
   P Mac HFS                    91713  976610854  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

interface_write()
 1 P EFI System                     6      76805      76800 [EFI System Partition] [EFI]
 2 P Mac HFS                    91713  976610854  976519142

search_part()
Disk /dev/disk2 - 4000 GB / 3726 GiB - 976754645 sectors
FAT32 at 6/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 6/0/1
     EFI System                     6      76805      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB
FAT32 at 12/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
FAT differs, FAT sectors=64-75/75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 12/0/1
     EFI System                    12      76811      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB

HFS+ magic value at 91713/0/1
part_size 976519142
     Mac HFS                    91713  976610854  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

HFS+ magic value at 91723/0/1
part_size 976519142
     Mac HFS                    91723  976610864  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

HFS+ magic value at 91733/0/1
part_size 976519142
     Mac HFS                    91733  976610874  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

HFS+ magic value at 91743/0/1
part_size 976519142
     Mac HFS                    91743  976610884  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

HFS+ magic value at 91753/0/1
part_size 976519142
     Mac HFS                    91753  976610894  976519142
     HFS+ blocksize=8192, 3999 GB / 3725 GiB

Re: Trying to recover an HFS+ partition that was accidentally formatted

Posted: 24 Jun 2021, 17:38
by recuperation
Search for posts on the same topic before posting a
new question.

Re: Trying to recover an HFS+ partition that was accidentally formatted

Posted: 27 Jun 2021, 19:54
by yuanqi
Can I confirm that testdisk is not able to recover HFS+ partition if the backup volume header is also bad, and I would need to try photorec instead?

Re: Trying to recover an HFS+ partition that was accidentally formatted

Posted: 27 Jun 2021, 22:44
by recuperation
Your initial posting is incomprehensible. There is no logical connection between your posting title and the content.

As stated on the top page of https://www.cgsecurity.org/

Testdisk can find different types of lost partitions listed in this sentence:
If you have lost partition or strange problem with your hard disk partitions, run TestDisk to recover your data. TestDisk detects numerous filesystem including NTFS, FAT12, FAT16, FAT32, exFAT, ext2, ext3, ext4, btrfs, BeFS, CramFS, HFS, JFS, Linux Raid, Linux Swap, LVM, LVM2, NSS, ReiserFS, UFS, XFS.
Unfortunately Testdisk can only do a few things inside a small selection of partition types listed above.
TestDisk can also undelete files from FAT, NTFS, exFAT and ext2 filesystem.
Testdisk can do some very basic repairs.

You formated your HFS(+) partition. Formating does not mean loosing the partition. It affects the content of the partition.

Therefore you don't have a lost HFS+ partition. The partition is there but you overwrote some content.
Yes, only Photorec would help you now with your formated HFS+ partition.
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited