Recovering a lost Mac partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
camomoab
Posts: 4
Joined: 17 Jan 2017, 00:29

Recovering a lost Mac partition

#1 Post by camomoab »

Hi I just downloaded Test Disk because I can't boot into mac os. When I went to disk utility in windows, It said the partition was unallocated space. I did not format or delete any of the partitions but just randomly disappeared. In the mac installer, disk utility also could not detect the disk. After looking for ways to recovering lost partitions I ended up here and I am currently running test disk to analyze the mac drive. Could you guys give me advice on how to solve this problem because this is the first time I have used test disk.
.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering a lost Mac partition

#2 Post by cgrenier »

Read https://www.cgsecurity.org/testdisk.pdf
If you want specific help, please post the testdisk.log file content.

camomoab
Posts: 4
Joined: 17 Jan 2017, 00:29

Re: Recovering a lost Mac partition

#3 Post by camomoab »

Hi, thank you for the fast reply. I checked out the testdisk pdf and it was helpful. However, when I ran the analysis of the disk, It detected the problem but said that the "write" method was not supported for mac drives. Here is the log

Code: Select all


Mon Jan 16 23:19:00 2017
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build  3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=164696555520
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=126035288064
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2020872192
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=8004304896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=126032543744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=76823337472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=437085274112
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=5074965504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=2020872192
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 164 GB / 153 GiB - CHS 20023 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 126 GB / 117 GiB - CHS 15322 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 2020 MB / 1927 MiB - CHS 245 255 63, sector size=512
Disk \\.\PhysicalDrive4 - 8004 MB / 7633 MiB - CHS 973 255 63, sector size=512
Drive C: - 126 GB / 117 GiB - CHS 15322 255 63, sector size=512
Drive D: - 76 GB / 71 GiB - CHS 9339 255 63, sector size=512
Drive E: - 437 GB / 407 GiB - CHS 53139 255 63, sector size=512
Drive G: - 5074 MB / 4839 MiB - CHS 616 255 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 164 GB / 153 GiB
Partition table type: Mac

Analyse Disk \\.\PhysicalDrive1 - 164 GB / 153 GiB - CHS 20023 255 63
Current partition structure:
Bad MAC partition, invalid block0 signature
read_part_mac: bad DPME signature

search_part()
Disk \\.\PhysicalDrive1 - 164 GB / 153 GiB - CHS 20023 255 63
NTFS at 616/254/63
filesystem size           9912042
sectors_per_cluster       8
mft_lcn                   262144
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     Unknown                  9912104   19824145    9912042
     NTFS, blocksize=4096, 5074 MB / 4839 MiB
Partition not added.
check_FAT: Bad number of sectors per cluster

HFS+ magic value at 9957/29/57

HFS+ magic value at 9957/29/57
part_size 38813696
     HFS                    159961088  198774783   38813696
     HFS+ blocksize=4096 + Backup, 19 GB / 18 GiB

HFS+ magic value at 12373/40/20

HFS+ magic value at 12373/40/20
part_size 122894336
     HFS                    198774784  321669119  122894336
     HFS+ blocksize=4096 + Backup, 62 GB / 58 GiB
file_win32_pread(96,3,buffer,321672958(20023/54/62)) read err: read after end of file
file_win32_pread(96,8,buffer,321672959(20023/54/63)) read err: read after end of file

Results
   P HFS                    159961088  198774783   38813696
     HFS+ blocksize=4096 + Backup, 19 GB / 18 GiB
   P HFS                    198774784  321669119  122894336
     HFS+ blocksize=4096 + Backup, 62 GB / 58 GiB

interface_write()
   P HFS                    159961088  198774783   38813696
   P HFS                    198774784  321669119  122894336
Function write_part_mac not implemented
"HFS+ blocksize=4096 + Backup, 62 GB / 58 GiB" is the partition that was lost. I cannot access it in any way and windows recognizes it as unallocated space. A normal hfs partition appears as "Healthy" with no disk format listed. In my screenshot attached,
Disks.png
Disks.png (6.3 KiB) Viewed 7390 times
The 18gb partition is a normally working mac drive and the one saying "unallocated space" is the lost one. I hope you can tell me the solution for repairing the drive.
Thanks Camomoab

camomoab
Posts: 4
Joined: 17 Jan 2017, 00:29

Re: Recovering a lost Mac partition

#4 Post by camomoab »

By the way in case this would help, I have a mac installer flash drive.

camomoab
Posts: 4
Joined: 17 Jan 2017, 00:29

Re: Recovering a lost Mac partition

#5 Post by camomoab »

Solved THANK YOU SO MUCH cgrenier!!! I made a mistake in which file system I chose. Instead of mac file system, I chose EFI GUID which was actually correct and was able to use the write function to fix the disk. Although it still appears unallocated in disk manager, I can now boot into macos and access my files. Is there anything I should do to prevent this problem from occuring again?

MrAnssaien
Posts: 1
Joined: 23 Oct 2018, 11:29

Re: Recovering a lost Mac partition

#6 Post by MrAnssaien »

camomoab wrote: 18 Jan 2017, 22:32 Solved THANK YOU SO MUCH cgrenier!!! I made a mistake in which file system I chose. Instead of mac file system, I chose EFI GUID which was actually correct and was able to use the write function to fix the disk. Although it still appears unallocated in disk manager, I can now boot into macos and access my files. Is there anything I should do to prevent this problem from occuring again?
If you want to avoid this problem, don't install a new OS in a new partition on the same drive -- especially a Linux-based OS. I had Win10 and OS Mojave on the same SSD both working flawlessly, and when I created a new partition for Kali Linux, it must've messed with the APFS container when it created the SWAP partition -- maybe Kali even changed the block size or something. A few minutes ago, I could still access Win10 and Kali, but the macOS partition became "unknown". I ruined the whole partition table when I tried to recover macOS using TestDisk. Now, nothing works, so I'm trying a deep search, and hopefully, it'll allow me to recover macOS and win10, while removing the Kali Linux partition, so I'll just stick to using the USB live version for now. It was challenging enough to have Mojave and Win10 on the same SSD. Didn't see it coming. All this crap happened because I couldn't afford a new SSD. Dx

Locked