Trying to restore a partition. Need help

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Rafaal
Posts: 4
Joined: 22 Jan 2016, 03:51

Trying to restore a partition. Need help

#1 Post by Rafaal »

Hi Folk,

I read a post ( http://forum.cgsecurity.org/phpBB3/help ... -t325.html) talking about a similar case of mine, but I want to receive personal and "custom-made suit" feedback to resolve this headache for me.

The thing is this: I have a Toshiba PA4236E 500GB with 3 Partitions. In the creation of the newest partition something went wrong this the connexion between external drive and Mac, and my biggest partition (where I have all my personal data) shows "unbootable" on Disk Utility (The partition doesn't appear on Finder). After 2 attempts with ITs I am here actually trying with Testdisk. Before the Quick Search process, I could find the "unbootable" Partition (which is a 300 GB HTFS+ Partition) on the list with a P (Every partition has one). After the quick search I become the message:

The hard disk (500 GB / 465 GiB) seems too small! (< 800 GB / 745 GiB)
Check the hard disk size: HD jumpers settings, BIOS detection...

The following partition can't be recovered:
MAC HFS 976773131 1562710626 585937496

Anything else.

I clicked on Continue and then I saw to partition, one of the, started and ended at the same point as the Partition 4 before the Quick Search. I tried to write this, without success.

Could you please help me? I am upset :(

A wait your reply! Thanks a lot!

Rafa




Thu Jan 21 22:01:39 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 15.3.0 (Darwin Kernel Version 15.3.0: Thu Dec 10 18:40:58 PST 2015; root:xnu-3248.3
Compiler: GCC 4.0
Compilation date: 2015-04-18T13:01:34
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 121 GB / 113 GiB - 236978176 sectors (RO), sector size=512
Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors, sector size=512
Disk /dev/rdisk0 - 121 GB / 113 GiB - 236978176 sectors (RO), sector size=512
Disk /dev/rdisk1 - 90 GB / 83 GiB - 176000776 sectors, sector size=512
Disk /dev/rdisk2 - 500 GB / 465 GiB - 976773168 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/rdisk2 - 500 GB / 465 GiB
Partition table type: EFI GPT

Analyse Disk /dev/rdisk2 - 500 GB / 465 GiB - 976773168 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976773167 (expected 976773167)
hdr_lba_start=34
hdr_lba_end=976773134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 40 409639 409600
Warning: number of heads/cylinder mismatches 255 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD)
2 P MS Data 409640 6269007 5859368 [WIN]
3 P Mac HFS 6678365 348160044 341481680
4 P Mac HFS 348160045 934097540 585937496

search_part()
Disk /dev/rdisk2 - 500 GB / 465 GiB - 976773168 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
FAT32 at 409640/0/1
FAT1 : 32-5742
FAT2 : 5743-11453
start_rootdir : 11454 root cluster : 2
Data : 11454-5859365
sectors : 5859368
cluster_size : 8
no_of_cluster : 730989 (2 - 730990)
fat_length 5711 calculated 5711
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 409640/0/1
MS Data 409640 6269007 5859368 [WIN]
FAT32, blocksize=4096, 2999 MB / 2861 MiB

HFS+ magic value at 6678365/0/1

HFS+ magic value at 6678365/0/1
part_size 341481680
Mac HFS 6678365 348160044 341481680
HFS+ blocksize=4096 + Backup, 174 GB / 162 GiB

HFS+ magic value at 348160045/0/1

HFS+ magic value at 348160045/0/1
part_size 585937496
Mac HFS 348160045 934097540 585937496
HFS+ blocksize=4096 + Backup, 299 GB / 279 GiB

HFS+ magic value at 976773131/0/1
part_size 585937496
Mac HFS 976773131 1562710626 585937496
HFS+ blocksize=4096, 299 GB / 279 GiB
This partition ends after the disk limits. (start=976773131, size=585937496, end=1562710626, disk end=976773168)

HFS+ magic value at 976773133/0/1
part_size 585937496
Mac HFS 390835639 976773134 585937496
HFS+ found using backup sector!, 299 GB / 279 GiB
Disk /dev/rdisk2 - 500 GB / 465 GiB - 976773168 sectors
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 800 GB / 745 GiB)
The following partition can't be recovered:
Mac HFS 976773131 1562710626 585937496
HFS+ blocksize=4096, 299 GB / 279 GiB

Results
P EFI System 40 409639 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
P MS Data 409640 6269007 5859368 [WIN]
FAT32, blocksize=4096, 2999 MB / 2861 MiB
P Mac HFS 6678365 348160044 341481680
HFS+ blocksize=4096 + Backup, 174 GB / 162 GiB
Mac HFS 348160045 934097540 585937496
HFS+ blocksize=4096 + Backup, 299 GB / 279 GiB
Mac HFS 390835639 976773134 585937496
HFS+ found using backup sector!, 299 GB / 279 GiB

interface_write()
1 P EFI System 40 409639 409600 [EFI]
2 P MS Data 409640 6269007 5859368 [WIN]
3 P Mac HFS 6678365 348160044 341481680
4 P Mac HFS 348160045 934097540 585937496
write!
No extended partition
You will have to reboot for the change to take effect.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Trying to restore a partition. Need help

#2 Post by cgrenier »

If I understand correctly you want to recover files from the following partition:
Mac HFS 348160045 934097540 585937496
HFS+ blocksize=4096 + Backup, 299 GB / 279 GiB

Try something like

Code: Select all

sudo fsck_hfs -fy /dev/disk2s4

Rafaal
Posts: 4
Joined: 22 Jan 2016, 03:51

Re: Trying to restore a partition. Need help

#3 Post by Rafaal »

Hi cgreiner,

Thanks for your reply. This is correct. I want to restore the partition with almost 300GB.
I have 3 partitions on my external disk:

1) One in FAT format which is 3 GB big.
2) Another one with 174,84 GB in HFS Format, which has my Time Machine Backup,
3) And the this one with 300 GB which is the one, that I want t recover.

I tried the sudo code on terminal, but Terminal says this:

Last login: Fri Jan 22 00:05:55 on console
MacBook-Pro-2:~ Rafaal$ sudo fsck_hfs -fy /dev/disk2s4
Password:
/dev/disk2s4: No such file or directory
Can't stat /dev/disk2s4
Can't stat /dev/disk2s4: No such file or directory
MacBook-Pro-2:~ Rafaal$

Thanks
Rafa

Rafaal
Posts: 4
Joined: 22 Jan 2016, 03:51

Re: Trying to restore a partition. Need help

#4 Post by Rafaal »

Disk Utility shows me my external drive as the image. The "Untitled1" Partition had, of course, another name, before this happened.
Attachments
Screen Shot 2016-01-23 at 07.45.37.png
Screen Shot 2016-01-23 at 07.45.37.png (23.33 KiB) Viewed 2966 times

Rafaal
Posts: 4
Joined: 22 Jan 2016, 03:51

Re: Trying to restore a partition. Need help

#5 Post by Rafaal »

HI again,

What I did before, was writing the sudo command, without any partition mounted (As test disk wants), and I became that message.

Now I had the idea to do the same sudo command, but with the 2 functional partition on. And I became this message now:

Last login: Sat Jan 23 10:12:01 on ttys000
MacBook-Pro-2:~ Rafaal$ sudo fsck_hfs -fy /dev/disk2s4
** /dev/rdisk2s4
Executing fsck_hfs (version hfs-305.10.1).
** Checking Journaled HFS Plus volume.
Invalid node structure
(4, 3)
Invalid B-tree node size
(8, 0)
** The volume could not be verified completely.
MacBook-Pro-2:~ Rafaal$

I hope this could help for solution.

Thanks!
Attachments
Screen Shot 2016-01-23 at 10.12.30.png
Screen Shot 2016-01-23 at 10.12.30.png (62.37 KiB) Viewed 2955 times

Locked