Mac formatted drive (HFS) overwritten by Windows partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
MyRoSec
Posts: 1
Joined: 21 Dec 2015, 08:31

Mac formatted drive (HFS) overwritten by Windows partition

#1 Post by MyRoSec »

Dear,

An external drive used on a OSX system has been connected to a Windows OS. The partition seems to be overwritten.
The analyses of testDisk you find below and fully in the attached file. I am not quite sure what to do.
Could it be easily recovered?
If so, may should the P Mac HFS partition of 499/165 Gib be written to disk?

Thank you for your help.

Geert.



Sat Dec 19 10:48:04 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 13.4.0 (Darwin Kernel Version 13.4.0: Sun Aug 17 19:50:11 PDT 2014; root:xnu-2422.1
Compiler: GCC 4.0
Compilation date: 2015-04-18T13:01:34
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 640 GB / 596 GiB - 1250263728 sectors (RO), sector size=512
Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors, sector size=512
Disk /dev/rdisk0 - 640 GB / 596 GiB - 1250263728 sectors (RO), sector size=512
Disk /dev/rdisk1 - 8107 MB / 7731 MiB - 3958760 sectors (RO), sector size=2048
Disk /dev/rdisk2 - 500 GB / 465 GiB - 976773168 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/disk2 - 500 GB / 465 GiB
Partition table type: EFI GPT

Analyse Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976773167 (expected 976773167)
hdr_lba_start=34
hdr_lba_end=976773134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]

search_part()
Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors

HFS+ magic value at 10561/0/1

HFS+ magic value at 10561/0/1
part_size 61440
Mac HFS 10561 72000 61440
HFS+ blocksize=4096 + Backup, 31 MB / 30 MiB

HFS+ magic value at 262208/0/1
part_size 976510944
Mac HFS 262208 976773151 976510944
HFS+ blocksize=4096, 499 GB / 465 GiB

Results
P Mac HFS 10561 72000 61440
HFS+ blocksize=4096 + Backup, 31 MB / 30 MiB
P Mac HFS 262208 976773151 976510944
HFS+ blocksize=4096, 499 GB / 465 GiB

interface_write()
1 P Mac HFS 10561 72000 61440
2 P Mac HFS 262208 976773151 976510944
Attachments
testdisk.log.gz
(8.13 KiB) Downloaded 284 times

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Mac formatted drive (HFS) overwritten by Windows partiti

#2 Post by Fiona »

Did you already try to write both HFS+-partitions into your GUID partition table?

Your current partition table contain only a MS Reserved partition, The size should be approximately 100 MB and the file system is probably NTFS?
There are no HFS+-partitions in your partition table, but TestDisk found some after Quick Search.
Results
P Mac HFS 10561 72000 61440
HFS+ blocksize=4096 + Backup, 31 MB / 30 MiB
P Mac HFS 262208 976773151 976510944
HFS+ blocksize=4096, 499 GB / 465 GiB

interface_write()
1 P Mac HFS 10561 72000 61440
2 P Mac HFS 262208 976773151 976510944
At the Interface Write, you can try to use the menu Write to write it into your GUID partition table and test it.

Fiona

Locked