Hi all,
I've accidentally repartitioned my external drive, and trying to recover using testdisk.
I've run "Quick Search", and it showed only currently active partitions, there were no deleted partitions.
Then I've run "Deep Search", this time it found thousands of deleted partitions whose sector sizes are the same but start/end values are shifted by some margin.
And because the partition that I want to save is an HFS partition, I can't try using "list" option and detecting which of the listed partitions will show the file list.
How can I detect which of the partitions is the true one?
Deep Search shows tons of deleted partitions
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
- cgrenier
- Site Admin
- Posts: 5432
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Deep Search shows tons of deleted partitions
To find the correct HFS+ partition, you should try the partition where "+ Backup" is listed on the last line of the screen when highlighted.
Re: Deep Search shows tons of deleted partitions
Thanks for the fast response!
So I'll move with the following partitions:
Changing these from Deleted to Primary and then continuing would be enough right?
So I'll move with the following partitions:
Code: Select all
>P EFI System 40 409639 409600 [EFI] (Which can list files via "p" button)
>P Mac HFS 411648 488692895 488281248 (HFS+ blocksize=4096 + Backup, 249 GB / 232 GiB)
>P Mac HFS 488955040 1465517535 976562496 (HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB)
>P Mac HFS 1465779680 1758486527 292706848 (HFS+ blocksize=4096 + Backup, 149 GB / 139 GiB)
>P MS Data 1758748672 1953523711 194775040 (exFAT, blocksize=131072, 99 GB / 92 GiB) (Which can list files via "p" button)
Re: Deep Search shows tons of deleted partitions
I've tried to write new partition table but write failed with "write error" message.
By the way, I see that the above partition table which I selected from deleted partitions seems to be exactly the same with current partition structure, which is the folowing:
What should I do to be able to correctly write deleted partition and reach the files?
By the way, I see that the above partition table which I selected from deleted partitions seems to be exactly the same with current partition structure, which is the folowing:
Code: Select all
1 P EFI System 40 409639 409600 [EFI System Partition]
2 P Mac HFS 411648 488692895 488281248 [Apple_HFSX_Untitled_2]
3 P Mac HFS 488955040 1465517535 976562496 [TimeMachine]
4 P Mac HFS 1465779680 1758486527 292706848 [MacMini]
5 P MS Data 1758748672 1953523711 194775040 [windows]
Re: Deep Search shows tons of deleted partitions
Hi again,
I had to run a Deeper Search from scratch. Here is the full log file : Is it possible to switch only one partition from deleted to primary? I really need to save only one partition, namely the following (most probably):
which has the same Start/End sectors with the current partition table:
How should I continue now? Would switching only the above partition work without switching EFI System to primary?
I had to run a Deeper Search from scratch. Here is the full log file : Is it possible to switch only one partition from deleted to primary? I really need to save only one partition, namely the following (most probably):
Code: Select all
HFS+ magic value at 1465517534/0/1
part_size 976562496
Mac HFS 488955040 1465517535 976562496
HFS+ found using backup sector!, 499 GB / 465 GiB
Code: Select all
Results
P EFI System 40 409639 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
P Mac HFS 411648 488692895 488281248
HFS+ blocksize=4096 + Backup, 249 GB / 232 GiB
P Mac HFS 488955040 1465517535 976562496
HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB
P Mac HFS 1465779680 1758486527 292706848
HFS+ blocksize=4096 + Backup, 149 GB / 139 GiB
P MS Data 1758748672 1953523711 194775040
exFAT, blocksize=131072, 99 GB / 92 GiB