Please help recover 4 TB External HFS+

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
coyler
Posts: 2
Joined: 14 Nov 2016, 21:05

Please help recover 4 TB External HFS+

#1 Post by coyler »

In August of this year I accidentally formatted my 4tb usb g-drive from HFS+ to HFS+ using Disk Utility on my Mac Pro/El Capitan. Drive was purchased in April, 2016 and came pre-formatted HFS+. When I accidentally formatted it, the drive had approximately 2.6 - 3 TB of data on it, mostly in the form of video files (primarily used as storage for video production/editing). Since August, I have tried recovering it using EaseUS, Remo, Disk Drill, and CNW recovery. I have been able to recover the raw files (no filenames or folder structure), but out of almost 3tb of data, only about 300 MB of video are actually playable and some of the videos were reconstructed using Grau GmbH repair. I also reformatted the drive two more times: once as MS-DOS so that I could mount it on a PC and once more as HFS+ (current). I know that was probably the wrong thing to do. I have not written anything to the disk since it was accidentally formatted though. I learned about TestDisk and have been trying to recover the original partition for two weeks now and I'm at a loss. After doing quick search and deep search, TestDisk shows multiple partitions and I'm not sure what to choose or how I should proceed.

Here is the log from the Deepscan (EFI Partition selected in step 1) I ran over the weekend (I stopped it at 56% after 60 hours):
TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/rdisk2 - 4000 GB / 3726 GiB - 7814037168 sectors
Partition Start End Size in sectors
>D EFI System 40 409639 409600 [EFI System Partition] [EFI]
D EFI System 46 409645 409600 [EFI System Partition] [EFI]
D MS Data 264192 2312191 2048000
D Mac HFS 409640 7813774983 7813365344
D MS Data 411648 3519068159 3518656512 [4TB]
D MS Data 411654 3519068165 3518656512 [4TB]
D MS Data 2312191 4360190 2048000
D Mac HFS 409419020 409439499 20480
D Mac HFS 409419124 409439603 20480
D Mac HFS 409419149 409439628 20480
D Mac HFS 409419166 409439645 20480
D Mac HFS 409419199 409439678 20480
D Mac HFS 409419232 409439711 20480
D Mac HFS 409419377 409439856 20480
D Mac HFS 409419402 409439881 20480
D Mac HFS 409419421 409439900 20480
D Mac HFS 409419550 409440029 20480
D Mac HFS 409419927 409440406 20480
D Mac HFS 409419952 409440431 20480
D Mac HFS 409419969 409440448 20480
D Mac HFS 409420050 409440529 20480
D Mac HFS 409423157 409443636 20480
D Mac HFS 409423318 409443797 20480
D Mac HFS 409423415 409443894 20480
D Mac HFS 409423496 409443975 20480
D Mac HFS 409423561 409444040 20480
D Mac HFS 409423690 409444169 20480
D Mac HFS 409423851 409444330 20480
D Mac HFS 409423996 409444475 20480
D Mac HFS 409424085 409444564 20480
D Mac HFS 409424246 409444725 20480
D Mac HFS 409424343 409444822 20480
D Mac HFS 409424424 409444903 20480
D Mac HFS 409424489 409444968 20480
D Mac HFS 409424618 409445097 20480
D Mac HFS 409424699 409445178 20480
D Mac HFS 409424764 409445243 20480
D Mac HFS 409424877 409445356 20480
D Mac HFS 409424958 409445437 20480
D Mac HFS 409425023 409445502 20480
D Mac HFS 409425208 409445687 20480
D Mac HFS 409425377 409445856 20480
D Mac HFS 409425450 409445929 20480
D Mac HFS 409425515 409445994 20480
D Mac HFS 409425620 409446099 20480
D Mac HFS 409425805 409446284 20480
D Mac HFS 409425942 409446421 20480
D Mac HFS 409426071 409446550 20480
D Mac HFS 409426200 409446679 20480
D Mac HFS 409426329 409446808 20480
D Mac HFS 409426458 409446937 20480
D Mac HFS 409426587 409447066 20480
D Mac HFS 409426716 409447195 20480
D Mac HFS 409426837 409447316 20480
D Mac HFS 409426918 409447397 20480
D Mac HFS 409427047 409447526 20480
D Mac HFS 409427176 409447655 20480
D Mac HFS 409427305 409447784 20480
D Mac HFS 409427426 409447905 20480
D Mac HFS 409427579 409448058 20480
D Mac HFS 409427692 409448171 20480
D Mac HFS 409427837 409448316 20480
D Mac HFS 409427918 409448397 20480
D Mac HFS 409427983 409448462 20480
D Mac HFS 409428104 409448583 20480
D Mac HFS 409428329 409448808 20480
D Mac HFS 409428418 409448897 20480
D Mac HFS 409428483 409448962 20480
D Mac HFS 409428580 409449059 20480
D Mac HFS 409428653 409449132 20480
D Mac HFS 409428742 409449221 20480
D Mac HFS 409428823 409449302 20480
D Mac HFS 409428888 409449367 20480
D Mac HFS 409429009 409449488 20480
D Mac HFS 409429146 409449625 20480
D Mac HFS 409429452 409449931 20480
D Mac HFS 409429613 409450092 20480
D Mac HFS 409429822 409450301 20480
D Mac HFS 409429911 409450390 20480
D Mac HFS 409429976 409450455 20480
D Mac HFS 409430113 409450592 20480
D Mac HFS 409430306 409450785 20480
D Mac HFS 409430387 409450866 20480
D Mac HFS 409430452 409450931 20480
D Mac HFS 409430653 409451132 20480
D Mac HFS 409430742 409451221 20480
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
FAT32, blocksize=512, 209 MB / 200 MiB
I also ran a quickscan with Intel partition selected and I'm running a deepscan (intel) right now. Here is some info from the Intel quickscan:
TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/rdisk2 - 4000 GB / 3726 GiB - 7814037168 sectors
Current partition structure:
Partition Start End Size in sectors

1 * HFS 409640 4295376934 4294967295

*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition
TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/rdisk2 - 4000 GB / 3726 GiB - 7814037168 sectors

Warning: the current number of heads per cylinder is 1
but the correct value may be 8.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlap.


[ Continue ]
TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/rdisk2 - 4000 GB / 3726 GiB - 7814037168 sectors
Partition Start End Size in sectors
>* FAT32 LBA 40 409639 409600 [EFI System Partition] [EFI]
P HFS 409640 7813774983 7813365344


Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
FAT32, blocksize=512, 209 MB / 200 MiB
And this is what TD is showing in the current deepscan (Intel Partition):
TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/rdisk2 - 4000 GB / 3726 GiB - 7814037168 sectors
Analyse sector 41025536/7814037167: 00%


check_FAT: Unusual media descriptor (0xf0!=0xf8)
Warning: number of heads/cylinder mismatches 16 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD)
FAT32 LBA 40 409639 409600 [EFI System Partition] [EFI]
check_FAT: Unusual media descriptor (0xf0!=0xf8)
Warning: number of heads/cylinder mismatches 16 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD)
FAT32 LBA 46 409645 409600 [EFI System Partition] [EFI]
Warning: number of heads/cylinder mismatches 255 (NTFS) != 1 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 1 (HD)
Warning: number of heads/cylinder mismatches 255 (NTFS) != 1 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 1 (HD)
HPFS - NTFS 264192 2312191 2048000
HFS 409640 7813774983 7813365344
Warning: number of heads/cylinder mismatches 255 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD)
FAT32 LBA 411648 3519068159 3518656512 [4TB]
Warning: number of heads/cylinder mismatches 255 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD)
FAT32 LBA 411648 3519068159 3518656512 [4TB]
Warning: number of heads/cylinder mismatches 255 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD)
FAT32 LBA 411654 3519068165 3518656512 [4TB]
Warning: number of heads/cylinder mismatches 255 (NTFS) != 1 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 1 (HD)
HPFS - NTFS 264192 2312191 2048000
Warning: number of heads/cylinder mismatches 255 (NTFS) != 1 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 1 (HD)
HPFS - NTFS 2312191 4360190 2048000
Invalid FAT boot sector
0 D FAT16 LBA 552318243 1762233581 1209915339
FAT16 LBA 552318243 1762233581 1209915339
Invalid FAT boot sector
0 D FAT16 LBA 4015720250 7890883116 3875162867
FAT16 LBA 4015720250 7890883116 3875162867
Invalid NTFS or EXFAT boot
0 D HPFS - NTFS 313333947 3440080989 3126747043
HPFS - NTFS 313333947 3440080989 3126747043
Invalid FAT boot sector
0 D FAT16 >32M 2685313182 2802761242 117448061
FAT16 >32M 2685313182 2802761242 117448061
Invalid FAT boot sector
0 D FAT12 4116858944 5935958472 1819099529
FAT12 4116858944 5935958472 1819099529
Invalid FAT boot sector
0 D FAT16 LBA 328820184 3245128229 2916308046
FAT16 LBA 328820184 3245128229 2916308046
Invalid FAT boot sector
0 D FAT12 1076432235 5052733922 3976301688
FAT12 1076432235 5052733922 3976301688
Invalid FAT boot sector
0 D FAT12 2268687958 2331605743 62917786
FAT12 2268687958 2331605743 62917786
Invalid FAT boot sector
0 D FAT32 LBA 2794496476 5616812130 2822315655
FAT32 LBA 2794496476 5616812130 2822315655
Invalid FAT boot sector
0 D FAT16 >32M 4013012148 7285066755 3272054608
FAT16 >32M 4013012148 7285066755 3272054608
Invalid FAT boot sector
0 D FAT16 LBA 1273825066 4025405053 2751579988
FAT16 LBA 1273825066 4025405053 2751579988
Invalid FAT boot sector
0 D FAT16 >32M 1760441235 2817444405 1057003171
FAT16 >32M 1760441235 2817444405 1057003171

Sorry for the long post but I wanted to add as much info as I could to give viewers a comprehensive idea of my situation. Any input/advice/suggestions, would be immensely appreciated!!

Thank you!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Please help recover 4 TB External HFS+

#2 Post by cgrenier »

The correct partition table type is EFI GPT, not PC Intel.
As your disk has been reformated too many times, TestDisk will not help.
You can use PhotoRec to recover your files but like other data recovery utilities, files will be recovered without the original filenames. Results may (should) be better than with the other tools, so you should try it.
Please let us know of the results

coyler
Posts: 2
Joined: 14 Nov 2016, 21:05

Re: Please help recover 4 TB External HFS+

#3 Post by coyler »

Thank you. I ran Photorec and it recovered pretty much exactly what CNW Recovery did. It looks like many of my Mp4's and AVCHD fils are missing their footer so they are not complete files and wont play in any player. Are there advanced functions in Photrec that would enable me to apply the footer? Or should i post in the appropriate forum? Thanks for your help and for your great service!

Locked