Deep analyse 48 hours only 50%

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
pipco
Posts: 4
Joined: 25 May 2017, 06:33

Deep analyse 48 hours only 50%

#1 Post by pipco »

Hi,

ok, accidentally formatted whole 1.5T drive that had 3 partitions (Guid) for Hackintosh with Chimera efi,
2 partitions had Lion and M-Lion,the third was going to install Sierra, instead of formatting 3rd partition for
Sierra I formatted complete drive. Don't know if this is normal but I'm 48 hours into Deep scan and only 50%
has completed, here is what I have so far:-

TestDisk 7.1-WIP, Data Recovery Utility, May 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/rdisk1 - 1500 GB / 1397 GiB - 2930275055 sectors (RO)
Analyse sector 1455161344/2930275054: 49%


Mac HFS 399828037 403428036 3600000
Mac HFS 406963246 410563245 3600000
Mac HFS 403363250 406963249 3600000
Mac HFS 415307328 418907327 3600000
Mac HFS 411707332 415307331 3600000
Mac HFS 415307551 418907550 3600000
Mac HFS 411707555 415307554 3600000
Mac HFS 415307616 418907615 3600000
Mac HFS 411707620 415307619 3600000
Mac HFS 415307753 418907752 3600000
Mac HFS 411707757 415307756 3600000
Mac HFS 415307858 418907857 3600000
Mac HFS 411707862 415307861 3600000
Mac HFS 415308349 418908348 3600000
Mac HFS 411708353 415308352 3600000
Mac HFS 415308630 418908629 3600000
Mac HFS 411708634 415308633 3600000
Mac HFS 415308743 418908742 3600000
Mac HFS 411708747 415308746 3600000
Mac HFS 415308840 418908839 3600000
Mac HFS 411708844 415308843 3600000
Mac HFS 415308929 418908928 3600000
Mac HFS 411708933 415308932 3600000
Mac HFS 418844142 422444141 3600000
Mac HFS 415244146 418844145 3600000
Mac HFS 545916484 545963635 47152
Mac HFS 545869336 545916487 47152
Mac HFS 545916624 545962583 45960

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Deep analyse 48 hours only 50%

#2 Post by cgrenier »

48 hours later, is the deeper partition search completed ? Please copy/paste the testdisk.log file content.

pipco
Posts: 4
Joined: 25 May 2017, 06:33

Re: Deep analyse 48 hours only 50%

#3 Post by pipco »

HI, thanks for the reply and the program,
as I said in first post this is a Hackintosh drive not a Mac.
It's partitioned into 3 x approximately 3 - 400G (GUID)
with either chameleon or chimera using the EFI as a multi boot drive,
if you could please point me in the right direction as the final results after over 4 days don't look good,
thanks again, pipco
Attachments
testdisk.doc.zip
(40.45 KiB) Downloaded 376 times

pipco
Posts: 4
Joined: 25 May 2017, 06:33

Re: Deep analyse 48 hours only 50%

#4 Post by pipco »

sorry, this was after pressing continue,

TestDisk 7.1-WIP, Data Recovery Utility, May 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/rdisk1 - 1500 GB / 1397 GiB - 2930275055 sectors (RO)
Partition Start End Size in sectors
>D EFI System 40 409639 409600 [EFI System Partition] [EFI]
D EFI System 46 409645 409600 [EFI System Partition] [EFI]
D Mac HFS 409640 960666199 960256560
D Mac HFS 409640 1963243807 1962834168
D Mac HFS 409640 2930012871 2929603232
D Mac HFS 499128 2930102359 2929603232
D Mac HFS 499160 2930102391 2929603232
D Mac HFS 499192 2930102423 2929603232
D Mac HFS 499224 2930102455 2929603232
D Mac HFS 499256 2930102487 2929603232
D Mac HFS 499288 2930102519 2929603232
D Mac HFS 499320 2930102551 2929603232
D Mac HFS 499352 2930102583 2929603232
D Mac HFS 499384 2930102615 2929603232
D Mac HFS 499488 2930102719 2929603232
D Mac HFS 499560 2930102791 2929603232
D Mac HFS 499720 2930102951 2929603232
D Mac HFS 499832 2930103063 2929603232
D Mac HFS 499936 2930103167 2929603232
D Mac HFS 499992 2930103223 2929603232
D Mac HFS 500104 2930103335 2929603232
D Mac HFS 500248 2930103479 2929603232
D Mac HFS 500328 2930103559 2929603232
D Mac HFS 500480 2930103711 2929603232
D Mac HFS 500584 2930103815 2929603232
D Mac HFS 500664 2930103895 2929603232
D Mac HFS 500752 2930103983 2929603232
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
FAT32, blocksize=512, 209 MB / 200 MiB

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Deep analyse 48 hours only 50%

#5 Post by cgrenier »

The following partitions may be interesting. Try to recover the 148GB partition first.

Code: Select all

     Mac HFS                215789360  220461343    4671984
     HFS+ blocksize=4096 + Backup, 2392 MB / 2281 MiB
     
     Mac HFS                224856280  241463999   16607720
     HFS+ blocksize=4096 + Backup, 8503 MB / 8109 MiB
     
     Mac HFS                257891480  272670799   14779320
     HFS+ blocksize=4096 + Backup, 7567 MB / 7216 MiB
     
     Mac HFS                287307600  302247919   14940320
     HFS+ blocksize=4096 + Backup, 7649 MB / 7295 MiB
     
     Mac HFS                317018744  326503087    9484344
     HFS+ blocksize=4096 + Backup, 4855 MB / 4631 MiB
     
     Mac HFS                335700344  347939383   12239040
     HFS+ blocksize=4096 + Backup, 6266 MB / 5976 MiB
     
     Mac HFS                359925856  370453695   10527840
     HFS+ blocksize=4096 + Backup, 5390 MB / 5140 MiB

     Mac HFS               2640533504 2930012871  289479368
     HFS+ blocksize=4096 + Backup, 148 GB / 138 GiB

     Mac HFS               2905080440 2930012871   24932432
     HFS+ blocksize=4096 + Backup, 12 GB / 11 GiB
No need to do a deeper search, press 'a' to manually add the partition. Set the partition as P(rimary), the other partition using the whole disk as D(eleted).
On next screen, choose Write, confirm, Quit and restart the computer

pipco
Posts: 4
Joined: 25 May 2017, 06:33

Re: Deep analyse 48 hours only 50%

#6 Post by pipco »

G'day mate,

ok I've re-analyzed the HD unmounted using 'disk' instead of rdisk,
it reduced the time from 5 days down to 10 hours and looks like it's
picked up partitions of approximately the right size.

I don't know if these are actual partitions or can be recovered but the sizes look very close:-


LVM magic value at 1298024551/0/1

HFS+ magic value at 1300211551/0/1
part_size 499902336
Mac HFS 1300211551 1800113886 499902336
HFS+ blocksize=4096, 255 GB / 238 GiB


HFS+ magic value at 1961017419/0/1
part_size 969003904
Mac HFS 992013517 1961017420 969003904
HFS+ found using backup sector!, 496 GB / 462 GiB


HFS+ magic value at 2624646310/0/1
part_size 663651144
Mac HFS 1960995168 2624646311 663651144
HFS+ found using backup sector!, 339 GB / 316 GiB


HFS+ magic value at 2904818292/0/1
part_size 958094920
Mac HFS 2904818292 3862913211 958094920
HFS+ blocksize=4096, 490 GB / 456 GiB
This partition ends after the disk limits. (start=2904818292, size=958094920, end=3862913211, disk end=2930275055)


HFS magic value at 56065948/0/1
part_size 1124860966
Mac HFS 56065948 1180926913 1124860966 [‡]
HFS blocksize=16777216, 575 GB / 536 GiB


I've attached the log file and am hoping at least one of the partitions can be reinstated,
any help as to how I can proceed would be really appreciated, thanks,,,,

Yours, pipco
Attachments
testdisk4.log.zip
(64.81 KiB) Downloaded 256 times

Locked