Need help recovering HFS+ from exFAT formatted drive Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
DrSteak
Posts: 5
Joined: 21 Nov 2016, 20:09

Need help recovering HFS+ from exFAT formatted drive

#1 Post by DrSteak »

I accidentally formatted my whole OS X storage drive to exFAT in windows and then copied a 100mb file in there. I've tried using other recovery tools and they can find most of my stuff, but they would require paying before getting the actual files back.
I tried using TestDisk on osx but the instructions on the documentation (http://www.cgsecurity.org/wiki/Data_Rec ... _partition) cannot be followed, since there is no "boot" option.
Instead I tried changing the type of the exFat volume to HFS+ and then creating an image, but that only recovered the file I had put in there AFTER reformatting. Any help is appreciated!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Need help recovering HFS+ from exFAT formatted drive

#2 Post by cgrenier »

You can try TestDisk, Advanced, set the type to HFS+, Superblock
If it doesn't work, try fsck (see https://www.cgsecurity.org/testdisk.pdf for details)
If you have no success, it also possible to use PhotoRec to recover your files but it will not recover the original file structure and original filenames.

DrSteak
Posts: 5
Joined: 21 Nov 2016, 20:09

Re: Need help recovering HFS+ from exFAT formatted drive

#3 Post by DrSteak »

cgrenier wrote:You can try TestDisk, Advanced, set the type to HFS+, Superblock
If it doesn't work, try fsck (see https://www.cgsecurity.org/testdisk.pdf for details)
If you have no success, it also possible to use PhotoRec to recover your files but it will not recover the original file structure and original filenames.
Thanks for the reply! Should I buy another drive and duplicate the disk before attempting that? Is there a risk that the other recovery programs won't be able to find the files anymore after doing that?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Need help recovering HFS+ from exFAT formatted drive

#4 Post by cgrenier »

testdisk and fsck are usually safe to use but it's always better to have a sector by sector copy of the original disk (see ddrescue example in the documentation).

DrSteak
Posts: 5
Joined: 21 Nov 2016, 20:09

Re: Need help recovering HFS+ from exFAT formatted drive

#5 Post by DrSteak »

cgrenier wrote:testdisk and fsck are usually safe to use but it's always better to have a sector by sector copy of the original disk (see ddrescue example in the documentation).
Ok so I tried doing the superblock method but the problem is I can only see two partitions,
Screen Shot 2016-11-23 at 22.15.50.png
Screen Shot 2016-11-23 at 22.15.50.png (28.33 KiB) Viewed 3674 times
and if I do superblock to the MS data (type changed to hfs+) it says that volume header is bad. Also I think that I should not do it to this partition, since quick search with the [analyze] shows a third partition, which is much larger and probably has all thats left of my files
Screen Shot 2016-11-23 at 22.18.47.png
Screen Shot 2016-11-23 at 22.18.47.png (21.03 KiB) Viewed 3674 times
In this screen I chose [write] and rebooted.
Now I can see the volume that I had before format but only in disk utility. The volume has the original name but it isn't mountable.
I tried doing super block to this new partition and it says the volume header is ok and also the backup is ok but that they mismatch.
So i tried overwriting the header with the backup, but it says write error. I am now stuck

DrSteak
Posts: 5
Joined: 21 Nov 2016, 20:09

Re: Need help recovering HFS+ from exFAT formatted drive

#6 Post by DrSteak »

Screen Shot 2016-11-24 at 20.02.49.png
Screen Shot 2016-11-24 at 20.02.49.png (51.9 KiB) Viewed 3648 times
It now looks like this. Before disk utility could not see any volumes but writing the partition table made those two appear. Only problem is I cannot mount the "Storage" (the volume that has my files) and fsck says it is read-only, so I cannot repair the filesystem. I cannot figure out how to make it writable, since all the methods I've found require you to mount the volume first.

DrSteak
Posts: 5
Joined: 21 Nov 2016, 20:09

Re: Need help recovering HFS+ from exFAT formatted drive

#7 Post by DrSteak »

I managed to recover the files I need. Solution was to analyze the drive, write the partition table, then I used EaseUs data recovery trial software to get the files. The program was not able to recover the files before, but writing the partition table apparently affected it.

Locked