Page 1 of 2

OS X TestDisk Partition structure error

Posted: 11 Apr 2012, 12:39
by zaggy
My external hard drive was damaged when using Apple’s Disk Utility to replace a FAT32 partition on the drive. Disk Utility crashed in the middle of the process.
All the data is still on the drive and I am sure it’s the partition map that has been damaged.

There were originally 4 partitions on the drive: 3 HFS+ and 1 FAT. I only want to retrieve the HFS partitions.
The drive/partitions were originally created with OSX 10.3 Disk Utility on a PowerPC Mac. I was using OSX 10.4 on an Intel Mac to repair the partition when it crashed.
The drive size Is 115Gb with 110Gb data.

I have cloned to an alternate drive and also tried with an image.dmg of the drive to repair instead of the original.
I am currently using TestDisk on the original PowerPC (OS X 10.4.11) instead of on the Intel Mac.

In TestDisk the Analyse report keeps showing duplicate entries (4 and 10) in the list as follows:

Current partition structure:
Bad MAC partition, invalid block0 signature
1 P partition_map 1 63 63
2 P Driver43 64 119 56
3 P Driver43 120 175 56
4 P DOS_FAT_32 176 231 56
4 P DOS_FAT_32 176 231 56
5 P Driver_ATA 232 287 56
6 P FWDriver 288 799 512
7 P Driver_IOKit 800 1311 512
8 P Patches 1312 1823 512
9 P Free 1824 8388783 8386960
10 P HFS 8388784 241254711 232865928
10 P HFS 8388784 241254711 232865928
11 P Free 241254712 241254719 8


I have also used TestDisk to Analyse the original drive and it shows the list correctly (without the duplicate lines).
I don’t want to use the original drive.

Please can you help – what is going wrong with the clone and image.dmg?

I can post the full log if useful.

Re: OS X TestDisk Partition structure error

Posted: 12 Apr 2012, 07:15
by remy
What tool did you use to clone / image ?

Are you sure it was "mac table" with 10.3 and not already GPT ?

Re: OS X TestDisk Partition structure error

Posted: 12 Apr 2012, 11:29
by zaggy
Hi
I used Data Rescue II to create clone.
I tried both Disk Utility and Data Rescue II to create the image files.

I used TestDisk's recommended/auto selected Apple Map partition option.

What is GPT?

Re: OS X TestDisk Partition structure error

Posted: 12 Apr 2012, 14:52
by remy
GPT = GUID Partition Table. New format to bypass 2TB limitation of MBR, already in use since some years by OSX products. If testdisk recognized a mac table, it's probably the good choice. But what if this was written by 10.4 in your first attemp ? So I would test also GPT, to be sure.

I didn't find enough info on DataREscue II to tell if it's a real bit to bit cloning tool, but it seems so. I then can't explain why there are differences in your detection process, until you have many bad sectors on the original and DatarescueII wasn't able to clone perfectly your harddisk.

Re: OS X TestDisk Partition structure error

Posted: 13 Apr 2012, 12:26
by zaggy
Thanks for your advice. I am now trying the GPT option. So far getting more errors but seems to be finding partitions. It is also listing unexpected partitions "Solaris/home" and states that these cannot be deleted. I shall continue with a deeper search and see what happens.

Re: OS X TestDisk Partition structure error

Posted: 19 Apr 2012, 11:00
by zaggy
I have tried the GPT option and managed to successfully recover the middle partition (1 of the 3 HFS+ partitions) within TestDisk without having to use pdisk.

Unfortunately the 1st and 3rd partitions were not completely recovered. These partitions are now visible within Disk Utility, listed as disk3s1 and disk3s2. The partitions are the correct sizes (33Gb each).
Disk Utility cannot mount them. I ran first aid disk repair on them but received Invalid B-tree error messages.

Any advice on how to solve this?

Would posting the log provide any insight?

Re: OS X TestDisk Partition structure error

Posted: 20 Apr 2012, 13:46
by remy
It seems that job that you can do with testdisk is done : you recover your partition. Now, it's filesystem corruption issue.
You may try to check with fsck, but I don't know how to do that with mac Os.

Re: OS X TestDisk Partition structure error

Posted: 26 Apr 2012, 15:19
by zaggy
FSCK did not work*. I used fsck_hfs -fy and also tried fsck -fy but got error:
BAD SUPER BLOCK: MAGIC NUMBER WRONG
and could not find alternatives.

I started again with a freshly cloned disk image of the faulty drive (using Data Rescue II, they confirmed that it does bit to bit cloning), this time I ran Testdisk from the Intel Mac instead.
Again I used the GPT option instead of the default APM. Amazingly I recovered the 1st and 2nd partitions! Still though I cannot seem to resolve the 3rd partition.

Before doing a full GPT analysis, I did a quick analysis using the default APM as it shows the partition map info:
Disk /dev/rdisk2 - 123 GB / 115 GiB - CHS 241254720 1 1, sector size=512
Partition table type (auto): Mac
Disk /dev/rdisk2 - 123 GB / 115 GiB
Partition table type: Mac
Analyse Disk /dev/rdisk2 - 123 GB / 115 GiB - CHS 241254720 1 1
Bad MAC partition, invalid block0 signature
1 P partition_map 1 63 63
2 P Driver43 64 119 56
3 P Driver43 120 175 56
4 P DOS_FAT_32 176 231 56
5 P Driver_ATA 232 287 56
6 P FWDriver 288 799 512
7 P Driver_IOKit 800 1311 512
8 P Patches 1312 1823 512
9 P Free 1824 8388783 8386960
10 P HFS 8388784 241254711 232865928
11 P Free 241254712 241254719 8


Below is an sample from the GPT analysis results:
Partition table type (auto): Mac
Disk /dev/rdisk2 - 123 GB / 115 GiB
Partition table type: EFI GPT

Analyse Disk /dev/rdisk2 - 123 GB / 115 GiB - CHS 241254720 1 1
Current partition structure:
Bad GPT partition, invalid signature.

search_part()
Disk /dev/rdisk2 - 123 GB / 115 GiB - CHS 241254720 1 1

HFS+ magic value at 63/0/1
part_size 65529072
Mac HFS 63 65529134 65529072
HFS+, 33 GB / 31 GiB

HFS+ magic value at 65529135/0/1
part_size 65513064
Mac HFS 65529135 131042198 65513064
HFS+, 33 GB / 31 GiB

HFS+ magic value at 131042201/0/1
part_size 65513064
Mac HFS 131042201 196555264 65513064
HFS+, 33 GB / 31 GiB

HFS+ magic value at 207467369/0/1
part_size 10160
Mac HFS 207467369 207477528 10160
HFS+, 5201 KB / 5080 KiB


1 P Mac HFS 63 65529134 65529072
2 P Mac HFS 65529135 131042198 65513064
3 P Mac HFS 131042201 196555264 65513064
write!
No extended partition
You will have to reboot for the change to take effect.
Partition table type (auto): EFI GPT

TestDisk exited normally


The result was partitions 1 & 2 recovered succesfully.
Disk Utility showed B-tree node size errors and repaired recovered partitions 1 & 2.
Partition 3 appears in Disk Utility as disk/slice name but its Invalid B-tree node size error failed to be repaired (Error: The underlying task reported failure on exit)
Partition 3 failed again with fsck with same bad super block error.

I notice that the starting sector for partition 3 is not contiguous with partition 2, there is a gap of 3 sectors (which I assume is 512 bytes x 3 = 1536 bytes). Also the actual length/size of partition 3 is closer to 65352416 (31.16G) -- not 65513064 (31.24G)

In a deeper search I also found the following which looks like it could match partition 3 but again it is not contiguous with partition 2:
HFS+ magic value at 131042205/0/1
part_size 65352416
Mac HFS 131042205 196394620 65352416
HFS+, 33 GB / 31 GiB


Should I change the length of partition 3 to 65352416 or should I change the starting block/sector to 131042199? Or change both start and length? How can I find the correct 'magic number' ?
How do I edit these numbers in TestDisk?

Or, is it possible to extract and repair a single partition on its own?

* I thought I should mention that I did not use fsck in 'single user mode' as the drive being repaired was not a bootable or startup drive - is that OK?

Re: OS X TestDisk Partition structure error

Posted: 26 Apr 2012, 22:12
by remy
I really can't help you with HFS+ structure repair. There are software able to do that, but it's quite offtopic.

Re: OS X TestDisk Partition structure error

Posted: 27 Apr 2012, 11:32
by zaggy
How is this off topic? I am still trying to repair the partition. Should I post in filesystem repair forum?
Which software is avaialable to repair further?