Recovery NTFS partition after HFS+ format

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Sergio
Posts: 1
Joined: 20 Mar 2014, 09:38

Recovery NTFS partition after HFS+ format

#1 Post by Sergio »

USB HDD 500Gb.
I need to recovery NTFS partition after HFS+ format on iMac.
Step-by-Step and Data_Recovery_Examples give no results.
Pls help who know us. :(
Its log testdisk
Wed Mar 19 23:43:30 2014
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 13.1.0 (Darwin Kernel Version 13.1.0: Thu Jan 16 19:40:37 PST 2014; root:xnu-2422.9
Compiler: GCC 4.0
Compilation date: Jul 30 201314:08:37
ext2fs lib: 1.41.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
Hard disk list
Disk /dev/disk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/disk2 - 500 GB / 465 GiB - 976769024 sectors, sector size=512
Disk /dev/disk3 - 157 MB / 150 MiB - 307200 sectors (RO), sector size=512
Disk /dev/rdisk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/rdisk2 - 500 GB / 465 GiB - 976769024 sectors, sector size=512
Disk /dev/rdisk3 - 157 MB / 150 MiB - 307200 sectors (RO), sector size=512

Partition table type (auto): EFI GPT
Disk /dev/disk2 - 500 GB / 465 GiB
Partition table type: EFI GPT

Analyse Disk /dev/disk2 - 500 GB / 465 GiB - 976769024 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976769023 (expected 976769023)
hdr_lba_start=34
hdr_lba_end=976768990
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 40 409639 409600 [EFI System Partition]
2 P Mac HFS 409640 976506839 976097200 [perenoska]

search_part()
Disk /dev/disk2 - 500 GB / 465 GiB - 976769024 sectors
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT32 at 40/0/1
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 409640/0/1
part_size 976097200
Mac HFS 409640 976506839 976097200
HFS+ blocksize=4096, 499 GB / 465 GiB

Results
P EFI System 40 409639 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
P Mac HFS 409640 976506839 976097200
HFS+ blocksize=4096, 499 GB / 465 GiB

interface_write()
1 P EFI System 40 409639 409600 [EFI]
2 P Mac HFS 409640 976506839 976097200
simulate write!

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976769023 (expected 976769023)
hdr_lba_start=34
hdr_lba_end=976768990
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P EFI System 40 409639 409600 [EFI System Partition]
2 P Mac HFS 409640 976506839 976097200 [perenoska]
HFS+ blocksize=4096, 499 GB / 465 GiB
gpt_change_part_type
Change partition type:
2 P MBR 409640 976506839 976097200 [perenoska]
HFS+ blocksize=4096, 499 GB / 465 GiB
Change partition type:
2 P NTFS 409640 976506839 976097200 [perenoska]
HFS+ blocksize=4096, 499 GB / 465 GiB

ntfs_boot_sector
2 P MBR 409640 976506839 976097200 [perenoska]
HFS+ blocksize=4096, 499 GB / 465 GiB
filesystem size 1
sectors_per_cluster 0
mft_lcn 0
mftmirr_lcn 0
clusters_per_mft_record 0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 488179664, seq=1, main=0 res=1
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 3
ntfs_find_mft: mftmirr_lcn 61022207
ntfs_find_mft: mft_record_size 1024

Failed to rebuild NTFS boot sector.

ntfs_boot_sector
2 P MBR 409640 976506839 976097200 [perenoska]
HFS+ blocksize=4096, 499 GB / 465 GiB
filesystem size 1
sectors_per_cluster 0
mft_lcn 0
mftmirr_lcn 0
clusters_per_mft_record 0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovery NTFS partition after HFS+ format

#2 Post by cgrenier »

Run TestDisk, Analyse, Quick Search and Deeper Search.
Your NTFS partition should be found using the NTFS backup boot sector.
Set this partition as *(bootable), the others as D(eleted). On next screen, choose Write, confirm, Quit

Locked