Trying to recover an HFS+ partition that was accidentally formatted
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Trying to recover an HFS+ partition that was accidentally formatted
Old partition occupies the whole disk. There are a few VMware images, which accounts for the smaller partitions found on full scan. The files I am trying to recover are rather large video files. I have had some success with some of the files via Prosoft Data Rescue, but the rest are only partially recovered (I'm assuming the software is not able to deal with fragmentation. https://www.dropbox.com/s/8c2eta396xedk ... g.zip?dl=0
Re: Trying to recover an HFS+ partition that was accidentally formatted
I'm posting the beginning of the log in case people are having trouble with the link.
Code: Select all
Mon Mar 22 19:05:42 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, February 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 18.7.0 (Darwin Kernel Version 18.7.0: Tue Jan 12 22:04:47 PST 2021; root:xnu-4903.278.56~1/RELEASE_X86_64) x86_64
Compiler: GCC 4.0
Compilation date: 2021-02-28T12:00:35
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 1050 GB / 978 GiB - 2051200368 sectors (RO), sector size=512
Disk /dev/disk2 - 4000 GB / 3726 GiB - 976754645 sectors, sector size=4096
Disk /dev/rdisk0 - 1050 GB / 978 GiB - 2051200368 sectors (RO), sector size=512
Disk /dev/rdisk1 - 1050 GB / 977 GiB - 256348836 sectors (RO), sector size=4096
Disk /dev/rdisk2 - 4000 GB / 3726 GiB - 976754645 sectors, sector size=4096
Partition table type (auto): EFI GPT
Disk /dev/disk2 - 4000 GB / 3726 GiB
Partition table type: EFI GPT
Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976754644 (expected 976754644)
hdr_lba_start=6
hdr_lba_end=976754639
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P Mac HFS 1 976754644 976754644
1 P Mac HFS 1 976754644 976754644
HFS_HFSP_boot_sector
1 P Mac HFS 1 976754644 976754644
Volume header
Bad
Backup volume header
Bad
Sectors are identical.
Analyse Disk /dev/disk2 - 4000 GB / 3726 GiB - 976754645 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976754644 (expected 976754644)
hdr_lba_start=6
hdr_lba_end=976754639
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P Mac HFS 1 976754644 976754644
Current partition structure:
No HFS or HFS+ structure
1 P Mac HFS 1 976754644 976754644
1 P Mac HFS 1 976754644 976754644
search_part()
Disk /dev/disk2 - 4000 GB / 3726 GiB - 976754645 sectors
FAT32 at 6/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
FAT32 at 6/0/1
EFI System 6 76805 76800 [EFI System Partition] [EFI]
FAT32, blocksize=4096, 314 MB / 300 MiB
HFS+ magic value at 91713/0/1
part_size 976519142
Mac HFS 91713 976610854 976519142
HFS+ blocksize=8192, 3999 GB / 3725 GiB
Results
P EFI System 6 76805 76800 [EFI System Partition] [EFI]
FAT32, blocksize=4096, 314 MB / 300 MiB
P Mac HFS 91713 976610854 976519142
HFS+ blocksize=8192, 3999 GB / 3725 GiB
interface_write()
1 P EFI System 6 76805 76800 [EFI System Partition] [EFI]
2 P Mac HFS 91713 976610854 976519142
search_part()
Disk /dev/disk2 - 4000 GB / 3726 GiB - 976754645 sectors
FAT32 at 6/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
FAT32 at 6/0/1
EFI System 6 76805 76800 [EFI System Partition] [EFI]
FAT32, blocksize=4096, 314 MB / 300 MiB
FAT32 at 12/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
FAT differs, FAT sectors=64-75/75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
set_FAT_info: name from BS used
FAT32 at 12/0/1
EFI System 12 76811 76800 [EFI System Partition] [EFI]
FAT32, blocksize=4096, 314 MB / 300 MiB
HFS+ magic value at 91713/0/1
part_size 976519142
Mac HFS 91713 976610854 976519142
HFS+ blocksize=8192, 3999 GB / 3725 GiB
HFS+ magic value at 91723/0/1
part_size 976519142
Mac HFS 91723 976610864 976519142
HFS+ blocksize=8192, 3999 GB / 3725 GiB
HFS+ magic value at 91733/0/1
part_size 976519142
Mac HFS 91733 976610874 976519142
HFS+ blocksize=8192, 3999 GB / 3725 GiB
HFS+ magic value at 91743/0/1
part_size 976519142
Mac HFS 91743 976610884 976519142
HFS+ blocksize=8192, 3999 GB / 3725 GiB
HFS+ magic value at 91753/0/1
part_size 976519142
Mac HFS 91753 976610894 976519142
HFS+ blocksize=8192, 3999 GB / 3725 GiB
-
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Trying to recover an HFS+ partition that was accidentally formatted
Search for posts on the same topic before posting a
new question.
Re: Trying to recover an HFS+ partition that was accidentally formatted
Can I confirm that testdisk is not able to recover HFS+ partition if the backup volume header is also bad, and I would need to try photorec instead?
-
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Trying to recover an HFS+ partition that was accidentally formatted
Your initial posting is incomprehensible. There is no logical connection between your posting title and the content.
As stated on the top page of https://www.cgsecurity.org/
Testdisk can find different types of lost partitions listed in this sentence:
You formated your HFS(+) partition. Formating does not mean loosing the partition. It affects the content of the partition.
Therefore you don't have a lost HFS+ partition. The partition is there but you overwrote some content.
Yes, only Photorec would help you now with your formated HFS+ partition.
As stated on the top page of https://www.cgsecurity.org/
Testdisk can find different types of lost partitions listed in this sentence:
Unfortunately Testdisk can only do a few things inside a small selection of partition types listed above.If you have lost partition or strange problem with your hard disk partitions, run TestDisk to recover your data. TestDisk detects numerous filesystem including NTFS, FAT12, FAT16, FAT32, exFAT, ext2, ext3, ext4, btrfs, BeFS, CramFS, HFS, JFS, Linux Raid, Linux Swap, LVM, LVM2, NSS, ReiserFS, UFS, XFS.
Testdisk can do some very basic repairs.TestDisk can also undelete files from FAT, NTFS, exFAT and ext2 filesystem.
You formated your HFS(+) partition. Formating does not mean loosing the partition. It affects the content of the partition.
Therefore you don't have a lost HFS+ partition. The partition is there but you overwrote some content.
Yes, only Photorec would help you now with your formated HFS+ partition.