cgsecurity.org

Hi,

I deleted the bootcamp created partition for Windows 7 on my Mac running Os X 10.6.8

i have tried testdisk and the response is:
The following partition can't be recovered:
MS Data 3907028991 4231448574 324419584
NTFS, blocksize=4096, 166 GB / 154 GiB

What can I do?


Sun Jun 17 15:41:45 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 10.8.0 (Darwin Kernel Version 10.8.0: Tue Jun 7 16:33:36 PDT 2011; root:xnu-1504.1
Compiler: GCC 4.0
Compilation date: 2012-06-14T10:10:33
ext2fs lib: 1.41.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
Hard disk list
Disk /dev/disk0 - 2000 GB / 1863 GiB - CHS 3907029168 1 1 (RO), sector size=512
Disk /dev/rdisk0 - 2000 GB / 1863 GiB - CHS 3907029168 1 1 (RO), sector size=512

Partition table type (auto): EFI GPT
Media is opened in read-only.
Disk /dev/rdisk0 - 2000 GB / 1863 GiB (RO)
Partition table type: EFI GPT

Analyse Disk /dev/rdisk0 - 2000 GB / 1863 GiB - CHS 3907029168 1 1 (RO)
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029167 (expected 3907029167)
hdr_lba_start=34
hdr_lba_end=3907029134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 40 409639 409600 [EFI System Partition]
2 P Mac HFS 409640 3906766983 3906357344 [Customer]

search_part()
Disk /dev/rdisk0 - 2000 GB / 1863 GiB - CHS 3907029168 1 1 (RO)
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT32 at 40/0/1
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 409640/0/1
part_size 3906357344
Mac HFS 409640 3906766983 3906357344
HFS+ blocksize=4096, 2000 GB / 1862 GiB
NTFS at 3907028991/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size 324419584
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
MS Data 3907028991 4231448574 324419584
NTFS, blocksize=4096, 166 GB / 154 GiB
This partition ends after the disk limits. (start=3907028991, size=324419584, end=4231448574, disk end=3907029168)
Disk /dev/rdisk0 - 2000 GB / 1863 GiB - CHS 3907029168 1 1 (RO)
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 2166 GB / 2017 GiB)
The following partition can't be recovered:
MS Data 3907028991 4231448574 324419584
NTFS, blocksize=4096, 166 GB / 154 GiB

Results
P EFI System 40 409639 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
P Mac HFS 409640 3906766983 3906357344
HFS+ blocksize=4096, 2000 GB / 1862 GiB

interface_write()
1 P EFI System 40 409639 409600 [EFI]
2 P Mac HFS 409640 3906766983 3906357344

search_part()
Disk /dev/rdisk0 - 2000 GB / 1863 GiB - CHS 3907029168 1 1 (RO)
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT32 at 40/0/1
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT32 at 46/0/1
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 46/0/1
EFI System 46 409645 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
Search for partition aborted

Results
EFI System 40 409639 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
EFI System 46 409645 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

interface_write()

No partition found or selected for recovery

Your MS Data-partition ends beyond the disk limit.
Your HFS-partitions size is 2000 GB It looks like your HFS partition uses the whole disk space. Did you check your disk utilities that you still have 166 GB free space?

Fiona

Hi Fiona and thanks for your reply.

I think the bootcamp application created a single partition when it deleted the MS one.

According to Disk Utility my HDD is a Hitachi HDS722020ALA330 Media
Partition Map Scheme : GUID Partition Table
Disk Identifier : disk0
Media Name : Hitachi HDS722020ALA330 Media
Media Type : Generic
Connection Bus : SATA
Device Tree : IODeviceTree:/PCI0@0/SATA@1F,2/PRT0@0/PMP@0
Total Capacity : 2 TB (2,000,398,934,016 Bytes)
S.M.A.R.T. Status : Verified
Disk Number : 0
Partition Number : 0


The Partition is:
Name : Macintosh HD
Typ : Volume
Disk Identifier : disk0s2
Mount Point : /
System Name : Mac OS X
System Version : 10.6.8
System Build : 10K549
File System : Mac OS Extended (Journaled)
Connection Bus : SATA
Device Tree : IODeviceTree:/PCI0@0/SATA@1F,2/PRT0@0/PMP@0
Writable : Yes
Capacity : 2 TB (2,000,054,960,128 Bytes)
Free Space : 1.76 TB (1,756,114,857,984 Bytes)
Used : 243.94 GB (243,940,102,144 Bytes)
Number of Files : 771,999
Number of Folders : 220,922
Owners Enabled : Yes
Can Turn Owners Off : Yes
Can Repair Permissions : Yes
Can Be Verified : Yes
Can Be Repaired : Yes
Can Be Formatted : Yes
Bootable : Yes
Supports Journaling : Yes
Journaled : Yes
Disk Number : 0
Partition Number : 2

Any suggestions?

Many thanks,

Benny

Hi, Fiona or someone else,

Has anyone any ideas as to a solution for my deleted partition?

I.E Should i just move on and forget about the "lost" partition?

any help would be greatly appreciated.

Regards,

Benny

Hi again,

I understand that this forum is moderated and attended to by probably volunteers and non paid staff, which is great!

I am a little disappointed in the seemingly lack of focus on most topics posted (a couple of replies at the most), but a "massive" response on a few.

I just cold not wait any longer for a possibly answer so I found another software that successfully recovered the files I needed.

Boomerang Data Recovery Software.
Worked a treat!

It is not free, but cost me only $9.95 as I only needed to recover 5MB of data.

You can set this post to solved.

Regards,