HFS+ partition recovery

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
ethanweb
Posts: 3
Joined: 16 May 2016, 21:26

HFS+ partition recovery

#1 Post by ethanweb »

2 hard drives in an enclosure got their partition tables corrupted, I'm guessing due to some error with the RAID controller (set on JBOD, never changed it or triggered any RAID initialization).

Both drives have a single HFS+ partition. One is non-essential, a 1 TB drive. I am testing some recovery methods on it. The following is what I've done.

I ran testdisk, which detected EFI GPT, but instructions said to use the Mac option. So, I ran the testdisk analyze tool in Mac mode, and got this:

partition: DOS_FAT_32
start: 40
end: 409639
size: 409600 [EFI]

partition: HFS
start: 578880
end: 1953432223
size: 1952853344

I then followed https://perrohunter.com/repair-a-mac-os ... ion-table/, and used pdisk to initialize a partition table, and attempted to create the partitions using the info above. It would not let me create the first one, said the base and length were not available empty space. I did create the second partition, and wrote the partition table. The drive is still not readable though.

I went back to testdisk and this time ran analyze in EFI GPT mode. The second result from above now looked like this:

partition: Mac HFS
start: 495388
end: 1953348731
size: 195283344

Running analyze in Mac mode still shows the result from earlier.

Which is the correct mode? What is the proper way to recreate the partition table, as the Mac partition table write is not supported?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: HFS+ partition recovery

#2 Post by cgrenier »

The correct partition table type is EFI:
- TestDisk has detected it as EFI
- An EFI partition is present.
- Mac OS X is using EFI partition table for more than 10 years

Try fsck on the partition and next Disk Utility
http://osxdaily.com/2013/08/07/how-to-r ... user-mode/

ethanweb
Posts: 3
Joined: 16 May 2016, 21:26

Re: HFS+ partition recovery

#3 Post by ethanweb »

cgrenier wrote: Try fsck on the partition and next Disk Utility
http://osxdaily.com/2013/08/07/how-to-r ... user-mode/
Thanks for the reply. This seems to be for a bootable drive. The two drives I am working on are not bootable, just external storage drives. I'm looking for information now on how to pass what drive fsck should work on, but haven't found anything yet.

ethanweb
Posts: 3
Joined: 16 May 2016, 21:26

Re: HFS+ partition recovery

#4 Post by ethanweb »

Ok, found where you can pass the identifier for the drive to fsck.

I got error "Invalid B-tree node size (3,0) The volume could not be verified completely" from running fsck.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: HFS+ partition recovery

#5 Post by cgrenier »

You can try PhotoRec to recover your data but it will not recover the original filenames.

Locked