Weird problem and questions
Posted: 24 Nov 2013, 17:52
Hi,
So I have this 1Tb usb harddrive which GPT table was overwritten. I had on my todo list to backup that damn table but it was low priority.
Any way, I remember the layout of the drive:
EFI
HFS+
Apple CoreStorage Encrypted Drive
HFS+
exFAT
When I first ran testdisk, it didn't find the first partition, but found the HFS+ partition. Creating the GPT entry with the value givent by Testdisk didn't work.
However, I remembered that I created the partition table through Apple's DiskUtility which always starts with a 200mb EFI partition on sector 40. So I went ahead and created the entry in the GPT and reran testdisk.
This time, it found like a 100 HFS+ with different start sector but always with the same size. I'm not sure why but well.
Taking the hint, I created a HFS+ entry right after the EFI partition with the size given by testdisk and bam! I was able to recove the first HFS+ partition.
Now, I keep going with testdisk and now, it shows something weird as follows :
Mac HFS 409640 939695887 939286248
Unknown 1037724327 3088301167372966 3088300129648640 [^Xn 9^O~V]
My first question is :
Any idea why I get such entry ?
Now last question :
I'm only running at 62% after hours, is there a way to start search from a specific cylinder ? I'm pretty sure that if I manage to find that last exFat partition, I can recover the rest.
By the way, I tried running on Mac OSX, Linux Ubuntu and Windows 8.
I got the same Unknown stuff on all. Windows version is painfully slow, Linux is the fastest.
Thanks.
C.
So I have this 1Tb usb harddrive which GPT table was overwritten. I had on my todo list to backup that damn table but it was low priority.
Any way, I remember the layout of the drive:
EFI
HFS+
Apple CoreStorage Encrypted Drive
HFS+
exFAT
When I first ran testdisk, it didn't find the first partition, but found the HFS+ partition. Creating the GPT entry with the value givent by Testdisk didn't work.
However, I remembered that I created the partition table through Apple's DiskUtility which always starts with a 200mb EFI partition on sector 40. So I went ahead and created the entry in the GPT and reran testdisk.
This time, it found like a 100 HFS+ with different start sector but always with the same size. I'm not sure why but well.
Taking the hint, I created a HFS+ entry right after the EFI partition with the size given by testdisk and bam! I was able to recove the first HFS+ partition.
Now, I keep going with testdisk and now, it shows something weird as follows :
Mac HFS 409640 939695887 939286248
Unknown 1037724327 3088301167372966 3088300129648640 [^Xn 9^O~V]
My first question is :
Any idea why I get such entry ?
Now last question :
I'm only running at 62% after hours, is there a way to start search from a specific cylinder ? I'm pretty sure that if I manage to find that last exFat partition, I can recover the rest.
By the way, I tried running on Mac OSX, Linux Ubuntu and Windows 8.
I got the same Unknown stuff on all. Windows version is painfully slow, Linux is the fastest.
Thanks.
C.