Page 1 of 1

testdisk - Bad jump in FAT partition

Posted: 06 Sep 2015, 07:03
by rubbermonkey
Hi all...

I've got a bad drive with no partition. It's a mac drive, HFS

I've run test disk and got the following result:

Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029168 sectors
Partition Start End Size in sectors
HFS 3516034640 3906766983 390732344

check_FAT: Bad jump in FAT partition

I've tried to fix it using this:

sudo pdisk /dev/rdisk1
pdisk: No valid block 1 on '/dev/rdisk1'
Edit /dev/rdisk1 -
Command (? for help): i
A physical block is 512 bytes:
A logical block is 512 bytes:
size of 'device' is 1951908304 blocks (512 byte blocks):
new size of 'device' is 1951908304 blocks (512 byte blocks)
Command (? for help): c
First block: 3516034640
Length in blocks: 390732344
Name of partition: blah
requested base and length is not within an existing free partition

another error I've gotten is 'Map is not big enough'.

I've then used the following, which has apparently created a GPT partition:

Ashleys-MacBook-Pro:~ Ashley$ sudo gpt create -f /dev/rdisk2
gpt create: /dev/rdisk2: error: device already contains a GPT

can anyone help? I'm totally lost now! Should I try to delete the partition created with get create? the finder can't see it.

Re: testdisk - Bad jump in FAT partition

Posted: 06 Sep 2015, 08:45
by cgrenier
Your disk is using an EFI GPT partition table, not a Mac one. It's not an error, it's how Mac OS X works.
Please choose EFI GPT when using TestDisk and post the testdisk.log content if you have questions.

Re: testdisk - Bad jump in FAT partition

Posted: 07 Sep 2015, 06:46
by rubbermonkey
thanks so much for looking into this! here is the log file:



Sun Sep 6 21:47:43 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 14.0.0 (Darwin Kernel Version 14.0.0: Fri Sep 19 00:26:44 PDT 2014; root:xnu-2782.1
Compiler: GCC 4.0
Compilation date: 2015-04-18T13:01:34
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 2000 GB / 1863 GiB - 3907029168 sectors (RO), sector size=512
Disk /dev/disk1 - 1000 GB / 931 GiB - 1954210120 sectors (RO), sector size=512
Disk /dev/rdisk0 - 2000 GB / 1863 GiB - 3907029168 sectors (RO), sector size=512
Disk /dev/rdisk1 - 1000 GB / 931 GiB - 1954210120 sectors (RO), sector size=512
Disk /dev/rdisk2 - 999 GB / 930 GiB - 1951908304 sectors, sector size=512

Partition table type (auto): EFI GPT
Media is opened in read-only.
Partition table type (auto): EFI GPT
Media is opened in read-only.
Disk /dev/disk0 - 2000 GB / 1863 GiB (RO)
Partition table type: EFI GPT

Analyse Disk /dev/disk0 - 2000 GB / 1863 GiB - 3907029168 sectors (RO)
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029167 (expected 3907029167)
hdr_lba_start=34
hdr_lba_end=3907029134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P Mac HFS 3516034640 3906766983 390732344

search_part()
Disk /dev/disk0 - 2000 GB / 1863 GiB - 3907029168 sectors (RO)

LVM magic value at 75304087/0/1
Unknown 759501303 1444410084 684908782
FATX, 350 GB / 326 GiB
Partition not added.
check_FAT: Bad number of sectors per cluster
check_FAT: Bad jump in FAT partition
Unknown 1380429473 3455503875 2075074403
FATX, 1062 GB / 989 GiB
Partition not added.

cramfs Marker at 1820537404/0/1

recover_cramfs
MS Data 1820537404 1825829716 5292312 [7Ωs[[œ˙dq<8n6¥€I]
cramfs, 2709 MB / 2584 MiB

HFS+ magic value at 3515772492/0/1
part_size 3124737856
Mac HFS 3515772492 6640510347 3124737856
HFS+ blocksize=4096, 1599 GB / 1489 GiB
This partition ends after the disk limits. (start=3515772492, size=3124737856, end=6640510347, disk end=3907029168)

HFS+ magic value at 3515772494/0/1
part_size 3124737856
Mac HFS 391034640 3515772495 3124737856
HFS+ found using backup sector!, 1599 GB / 1489 GiB

HFS+ magic value at 3516034640/0/1

HFS+ magic value at 3516034640/0/1
part_size 390732344
Mac HFS 3516034640 3906766983 390732344
HFS+ blocksize=4096 + Backup, 200 GB / 186 GiB
NTFS at 3907024064/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size 3907024002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 63 3907024064 3907024002
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 3907024064/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size 3907024002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
MS Data 3907024064 7814048065 3907024002
NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=3907024064, size=3907024002, end=7814048065, disk end=3907029168)
Disk /dev/disk0 - 2000 GB / 1863 GiB - 3907029168 sectors (RO)
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partitions can't be recovered:
Mac HFS 3515772492 6640510347 3124737856
HFS+ blocksize=4096, 1599 GB / 1489 GiB
MS Data 3907024064 7814048065 3907024002
NTFS, blocksize=4096, 2000 GB / 1863 GiB

Results
MS Data 63 3907024064 3907024002
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
Mac HFS 391034640 3515772495 3124737856
HFS+ found using backup sector!, 1599 GB / 1489 GiB
MS Data 1820537404 1825829716 5292313 [7Ωs[[œ˙dq<8n6¥€I]
cramfs, 2709 MB / 2584 MiB
Mac HFS 3516034640 3906766983 390732344
HFS+ blocksize=4096 + Backup, 200 GB / 186 GiB

interface_write()

No partition found or selected for recovery
simulate write!

TestDisk exited normally.

Re: testdisk - Bad jump in FAT partition

Posted: 07 Sep 2015, 17:06
by cgrenier
The disk is in read-only mode. Mac OS X has probably mounted the HFS partition available on the disk.
Can you check the files from this partition ?

Re: testdisk - Bad jump in FAT partition

Posted: 07 Sep 2015, 20:28
by rubbermonkey
Previous to this log, I had incorrectly scanned using testdisk and HFS, not GPT EFI

It gave me this info:

Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029168 sectors
Partition Start End Size in sectors
HFS 3516034640 3906766983 390732344

I then tried to create a partition using this:

sudo gpt create -f /dev/rdisk2
(i cant remember the next command but I used the start 3516034640 and length 390732344

this failed - stating the drive was smaller than the partition, but apparently it did create some sort of partition, I think this is now showing up in the log as:
Disk /dev/rdisk2 - 999 GB / 930 GiB - 1951908304 sectors, sector size=512

I'm not 100% but I think this is the drive that osx is seeing, but there's nothing on it.

Should I delete this partition to get the drive back to where it was before I started meddling? If so how?

What should I use to correctly recreate the GPT EFI partition?

Re: testdisk - Bad jump in FAT partition

Posted: 09 Sep 2015, 09:00
by rubbermonkey
By the way, I wasn't correct saying that finder can't see the drive. It can see the drive, it thinks it's called HDD3.

It is 200gb, and contains 3 files:

testfile
testfile_2m
testfile_16M

Am I correct in thinking I should destroy this partition, as it was created with incorrect numbers from my HFS scan, not the EFI GPT scan?

Should I use gpt destroy on it?

Re: testdisk - Bad jump in FAT partition

Posted: 11 Sep 2015, 16:34
by cgrenier
Unmount this partition and try to recover
Mac HFS 391034640 3515772495 3124737856
HFS+ found using backup sector!, 1599 GB / 1489 GiB
Maybe it's the partition you are looking for.

Re: testdisk - Bad jump in FAT partition

Posted: 13 Sep 2015, 09:56
by rubbermonkey
thanks for the advice, I have managed to recover all the files on this drive using a program called red undead. The fiels are movies in the r3d format. photorec also got them but without metadata.