cgsecurity.org

Dear,

An external drive used on a OSX system has been connected to a Windows OS. The partition seems to be overwritten.
The analyses of testDisk you find below and fully in the attached file. I am not quite sure what to do.
Could it be easily recovered?
If so, may should the P Mac HFS partition of 499/165 Gib be written to disk?

Thank you for your help.

Geert.



Sat Dec 19 10:48:04 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 13.4.0 (Darwin Kernel Version 13.4.0: Sun Aug 17 19:50:11 PDT 2014; root:xnu-2422.1
Compiler: GCC 4.0
Compilation date: 2015-04-18T13:01:34
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 640 GB / 596 GiB - 1250263728 sectors (RO), sector size=512
Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors, sector size=512
Disk /dev/rdisk0 - 640 GB / 596 GiB - 1250263728 sectors (RO), sector size=512
Disk /dev/rdisk1 - 8107 MB / 7731 MiB - 3958760 sectors (RO), sector size=2048
Disk /dev/rdisk2 - 500 GB / 465 GiB - 976773168 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/disk2 - 500 GB / 465 GiB
Partition table type: EFI GPT

Analyse Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976773167 (expected 976773167)
hdr_lba_start=34
hdr_lba_end=976773134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]

search_part()
Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors

HFS+ magic value at 10561/0/1

HFS+ magic value at 10561/0/1
part_size 61440
Mac HFS 10561 72000 61440
HFS+ blocksize=4096 + Backup, 31 MB / 30 MiB

HFS+ magic value at 262208/0/1
part_size 976510944
Mac HFS 262208 976773151 976510944
HFS+ blocksize=4096, 499 GB / 465 GiB

Results
P Mac HFS 10561 72000 61440
HFS+ blocksize=4096 + Backup, 31 MB / 30 MiB
P Mac HFS 262208 976773151 976510944
HFS+ blocksize=4096, 499 GB / 465 GiB

interface_write()
1 P Mac HFS 10561 72000 61440
2 P Mac HFS 262208 976773151 976510944

Did you already try to write both HFS+-partitions into your GUID partition table?

Your current partition table contain only a MS Reserved partition, The size should be approximately 100 MB and the file system is probably NTFS?
There are no HFS+-partitions in your partition table, but TestDisk found some after Quick Search.

Results
P Mac HFS 10561 72000 61440
HFS+ blocksize=4096 + Backup, 31 MB / 30 MiB
P Mac HFS 262208 976773151 976510944
HFS+ blocksize=4096, 499 GB / 465 GiB

interface_write()
1 P Mac HFS 10561 72000 61440
2 P Mac HFS 262208 976773151 976510944

At the Interface Write, you can try to use the menu Write to write it into your GUID partition table and test it.

Fiona