Bad GPT on 1TB MacBook drive

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
dbender
Posts: 2
Joined: 22 Jan 2015, 16:56

Bad GPT on 1TB MacBook drive

#1 Post by dbender »

My wife's MacBook Pro has a 500GB SSD boot/system disk and 1TB Samsung data disk. As far as I know, the 1TB disk was formatted as a single Mac OS Extended (Journaled) partition using Disk Utility. But something has gone wrong and she now gets an error message on startup that requires her to eject the 1TB disk. Disk Utility will not let me do anything with this disk. I get errors when I try to partition or erase it. (Losing the data is not a huge concern, as her documents are on Google Drive and her music files are available on iTunes Cloud.)

When I ran Analyze and Quick Search on this drive, I got GPT signature missing errors, and then it found 4 partitions. (The drive was at one time the only drive in the MacBook, so it may still have hidden partitions I didn't know about.) Unfortunately, I didn't save the log file from this Quick Search. I started a Deeper Scan about 36 hours ago, and it has only finished about 14% of the drive (270 million of 1.95 billion sectors). At this rate, it will take another week to finish.

So questions for now:

1. This drive uses Advanced Format Technology with, I think, a sector size of 4096. TestDisk reported a sector size of 512, but it reported the correct disk size. Should I use Geometry to set the sector size to 4096, or is this just a difference between physical and logical sector size that TestDisk is recognizing and using correctly?

2. Because of the sector size, or for any other reason, should I stop this deeper scan now and change anything before restarting it? Or perhaps stop and just do a Quick Scan and post the log file now? Or should I let it run for a week and post the log file then?

3. Can my wife use the computer for other tasks while TestDisk is running? If so, any limitations on types of programs or activities?

Thanks in advance. I just don't want to wait another week just to find out I should have done something differently.

Duane

dbender
Posts: 2
Joined: 22 Jan 2015, 16:56

Re: Bad GPT on 1TB MacBook drive

#2 Post by dbender »

Okay, the Deeper Search finished after a little over a week, but the log file, at 834KB, is too big to post here. So here is the Quick Search log file:

Code: Select all


Tue Jan 27 21:39:58 2015
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, December 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 14.0.0 (Darwin Kernel Version 14.0.0: Fri Sep 19 00:26:44 PDT 2014; root:xnu-2782.1
Compiler: GCC 4.0
Compilation date: 2015-01-10T19:40:38
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
Hard disk list
Disk /dev/disk0 - 512 GB / 476 GiB - 1000215216 sectors (RO), sector size=512
Disk /dev/disk1 - 1000 GB / 931 GiB - 1953525168 sectors, sector size=512
Disk /dev/disk2 - 4294 MB / 4096 MiB - 8388608 sectors (RO), sector size=512
Disk /dev/disk3 - 16 MB / 15 MiB - 31312 sectors (RO), sector size=512
Disk /dev/disk4 - 16 MB / 15 MiB - 31296 sectors (RO), sector size=512
Disk /dev/rdisk0 - 512 GB / 476 GiB - 1000215216 sectors (RO), sector size=512
Disk /dev/rdisk1 - 1000 GB / 931 GiB - 1953525168 sectors, sector size=512
Disk /dev/rdisk2 - 4294 MB / 4096 MiB - 8388608 sectors (RO), sector size=512
Disk /dev/rdisk3 - 16 MB / 15 MiB - 31312 sectors (RO), sector size=512
Disk /dev/rdisk4 - 16 MB / 15 MiB - 31296 sectors (RO), sector size=512

Partition table type default to EFI GPT
Disk /dev/rdisk1 - 1000 GB / 931 GiB
Partition table type: EFI GPT

Analyse Disk /dev/rdisk1 - 1000 GB / 931 GiB - 1953525168 sectors
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Disk /dev/rdisk1 - 1000 GB / 931 GiB - 1953525168 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
FAT differs, FAT sectors=864-880/3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
     EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 409640/0/1

HFS+ magic value at 409640/0/1
part_size 1475053312
     Mac HFS                   409640 1475462951 1475053312
     HFS+ blocksize=4096 + Backup, 755 GB / 703 GiB

HFS+ magic value at 1475725096/0/1

HFS+ magic value at 1475725096/0/1
part_size 476530496
     Mac HFS               1475725096 1952255591  476530496
     HFS+ blocksize=4096 + Backup, 243 GB / 227 GiB

HFS+ magic value at 1952255592/0/1

HFS+ magic value at 1952255592/0/1
part_size 1269536
     Mac HFS               1952255592 1953525127    1269536
     HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

Results
   P EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
   P Mac HFS                   409640 1475462951 1475053312
     HFS+ blocksize=4096 + Backup, 755 GB / 703 GiB
   P Mac HFS               1475725096 1952255591  476530496
     HFS+ blocksize=4096 + Backup, 243 GB / 227 GiB
   P Mac HFS               1952255592 1953525127    1269536
     HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB


dir_partition inode=0
   P EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
FAT: cluster=2(0x2), pos=6374
Directory /
       3 drwxr-xr-x     0      0         0  1-Jan-2001 00:32 EFI
    4102 drwxr-xr-x     0      0         0 23-Oct-2012 19:13 .Trashes
   66370 -rwxr-xr-x     0      0     13654  1-Jan-2001 00:55 BOOTLOG

dir_partition inode=3
   P EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
FAT: cluster=3(0x3), pos=6375
Directory /EFI
       3 drwxr-xr-x     0      0         0 23-Oct-2012 19:13 .
       0 drwxr-xr-x     0      0         0 23-Oct-2012 19:13 ..
       4 drwxr-xr-x     0      0         0  1-Jan-2001 00:32 APPLE
FAT: cluster=2(0x2), pos=6374
Directory /
       3 drwxr-xr-x     0      0         0  1-Jan-2001 00:32 EFI
    4102 drwxr-xr-x     0      0         0 23-Oct-2012 19:13 .Trashes
   66370 -rwxr-xr-x     0      0     13654  1-Jan-2001 00:55 BOOTLOG

interface_write()
 1 P EFI System                    40     409639     409600 [EFI]
 2 P Mac HFS                   409640 1475462951 1475053312
 3 P Mac HFS               1475725096 1952255591  476530496
 4 P Mac HFS               1952255592 1953525127    1269536
simulate write!

Analyse Disk /dev/rdisk1 - 1000 GB / 931 GiB - 1953525168 sectors
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Disk /dev/rdisk1 - 1000 GB / 931 GiB - 1953525168 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
FAT differs, FAT sectors=864-880/3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
     EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 409640/0/1

HFS+ magic value at 409640/0/1
part_size 1475053312
     Mac HFS                   409640 1475462951 1475053312
     HFS+ blocksize=4096 + Backup, 755 GB / 703 GiB

HFS+ magic value at 1475725096/0/1

HFS+ magic value at 1475725096/0/1
part_size 476530496
     Mac HFS               1475725096 1952255591  476530496
     HFS+ blocksize=4096 + Backup, 243 GB / 227 GiB

HFS+ magic value at 1952255592/0/1

HFS+ magic value at 1952255592/0/1
part_size 1269536
     Mac HFS               1952255592 1953525127    1269536
     HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

Results
   P EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
   P Mac HFS                   409640 1475462951 1475053312
     HFS+ blocksize=4096 + Backup, 755 GB / 703 GiB
   P Mac HFS               1475725096 1952255591  476530496
     HFS+ blocksize=4096 + Backup, 243 GB / 227 GiB
   P Mac HFS               1952255592 1953525127    1269536
     HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

   P Mac HFS                   409640 1475462951 1475053312
     HFS+ blocksize=4096 + Backup, 755 GB / 703 GiB
Support for this filesystem hasn't been enable during compilation.

interface_write()
 1 P EFI System                    40     409639     409600 [EFI]
 2 P Mac HFS                   409640 1475462951 1475053312
 3 P Mac HFS               1475725096 1952255591  476530496
 4 P Mac HFS               1952255592 1953525127    1269536
simulate write!

TestDisk exited normally.
 
Any suggestions on how I can proceed to recover this disk?

Duane

Locked