Attempting recovery

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
aayler
Posts: 4
Joined: 21 Jun 2017, 02:32

Attempting recovery

#1 Post by aayler »

Greetings Christophe,

I hope this finds you well. First of all, I'd like to thank you very much for your invaluable contribution to this community.

Recently, my external hard drive failed to mount after a routine restart on a Mac. I made a full clone to another drive and am now attempting to recover the partition or files, anything ... I've already selected the <superblock> option via testdisk and written the header from the backup -- but the clone still fails to mount.

I've also tried photoRec in an attempt to recover files directly, but am coming up empty ... nothing found ...

I've attached the log from a testdisk analysis, and would appreciate any help, especially through your discerning eyes ... If there is anything that I can provide that would help in your assessment, I would gladly include ... Thanks again.


All the best,

Code: Select all



Tue Jun 20 21:25:36 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, May 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 16.1.0 (Darwin Kernel Version 16.1.0: Mon Oct  3 14:03:15 PDT 2016; root:xnu-3789.2
Compiler: GCC 4.0
Compilation date: 2017-06-16T14:21:47
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors (RO), sector size=512
Disk /dev/disk2 - 4000 GB / 3726 GiB - 7814037167 sectors, sector size=512
Disk /dev/disk3 - 4000 GB / 3725 GiB - 7813969920 sectors (RO), sector size=512
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO), sector size=512
Disk /dev/rdisk1 - 499 GB / 464 GiB - 974700800 sectors (RO), sector size=512
Disk /dev/rdisk2 - 4000 GB / 3726 GiB - 7814037167 sectors, sector size=512
Disk /dev/rdisk3 - 4000 GB / 3725 GiB - 7813969920 sectors (RO), sector size=512

Partition table type (auto): EFI GPT
Disk /dev/rdisk2 - 4000 GB / 3726 GiB
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814037166 (expected 7814037166)
hdr_lba_start=34
hdr_lba_end=7814037133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
 1 P Mac HFS                   409640 7813774983 7813365344
     HFS+ blocksize=8192 + Backup, 4000 GB / 3725 GiB
gpt_change_part_type
Change partition type:
 1 P Mac HFS                   409640 7813774983 7813365344
     HFS+ blocksize=8192 + Backup, 4000 GB / 3725 GiB
Change partition type:
 1 P HFS+                      409640 7813774983 7813365344
     HFS+ blocksize=8192 + Backup, 4000 GB / 3725 GiB

HFS_HFSP_boot_sector
 1 P Mac HFS                   409640 7813774983 7813365344
     HFS+ blocksize=8192 + Backup, 4000 GB / 3725 GiB

HFS+ magic value at 409640/0/1

HFS+ magic value at 409640/0/1
Volume header
HFS+ OK

Backup volume header
HFS+ OK

Sectors are identical.

Analyse Disk /dev/rdisk2 - 4000 GB / 3726 GiB - 7814037167 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814037166 (expected 7814037166)
hdr_lba_start=34
hdr_lba_end=7814037133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P Mac HFS                   409640 7813774983 7813365344

search_part()
Disk /dev/rdisk2 - 4000 GB / 3726 GiB - 7814037167 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
     EFI System                    40     409639     409600 [EFI System Partition] [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 409640/0/1

HFS+ magic value at 409640/0/1
part_size 3518398048
     Mac HFS                   409640 7813774983 7813365344
     HFS+ blocksize=8192 + Backup, 4000 GB / 3725 GiB
Search for partition aborted

Results
   P EFI System                    40     409639     409600 [EFI System Partition] [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
   P Mac HFS                   409640 7813774983 7813365344
     HFS+ blocksize=8192 + Backup, 4000 GB / 3725 GiB

interface_write()
 1 P EFI System                    40     409639     409600 [EFI System Partition] [EFI]
 2 P Mac HFS                   409640 7813774983 7813365344
simulate write!

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814037166 (expected 7814037166)
hdr_lba_start=34
hdr_lba_end=7814037133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
 1 P Mac HFS                   409640 7813774983 7813365344
     HFS+ blocksize=8192 + Backup, 4000 GB / 3725 GiB

HFS_HFSP_boot_sector
 1 P Mac HFS                   409640 7813774983 7813365344
     HFS+ blocksize=8192 + Backup, 4000 GB / 3725 GiB

HFS+ magic value at 409640/0/1

HFS+ magic value at 409640/0/1
Volume header
HFS+ OK

Backup volume header
HFS+ OK

Sectors are identical.
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Attempting recovery

#2 Post by cgrenier »

The partition table and the filesystem look ok.
Run PhotoRec, enable the expert mode in Options,start a recovery, set the blocksize to 512 bytes, use the default options otherwise.
Do you recover more files this way ?
Top
aayler
Posts: 4
Joined: 21 Jun 2017, 02:32

Re: Attempting recovery

#3 Post by aayler »

Greetings Christophe,

Thank you very much for your prompt response -- I truly appreciate your time ...

I followed your recommendation --

There was the option `Try to unformat a FAT filesystem (Y/N)` to which I responded "N"

The scan was initiated but moved quickly, reporting "0 files found". When it completed, there was an error message about unable to write to `Volumes/recup_dir.1` even though I specified a new, empty drive (of the same capacity) for the recovery target ...

And following this, I am suddenly seeing another partition available through photoRec:

Code: Select all

Disk /dev/rdisk2 - 4000 GB / 3726 GiB (RO)
     Partition                  Start        End    Size in sectors
     Unknown                  0   0  1 3519069870   0  1 7814037167 [Whole disk]
I am trying to recover through this partition and it's taking some time:

Code: Select all

Pass 0 - Reading sector   23539074/7814037167, 6/10 headers found
Elapsed time 0h01m32s - Estimated time to completion 8h27m28
Will update once ^ job is concluded, but I remember trying this already, to no avail ...
Top
aayler
Posts: 4
Joined: 21 Jun 2017, 02:32

Re: Attempting recovery

#4 Post by aayler »

After selecting "Y" to save a disk image, I'm seeing the message:

Code: Select all

0 files saved in /Volumes/recup_dir directory.
Cannot create file in current directory.
I've selected a target volume -- at the prompt during the recovery procedure -- that's empty and equal in size but photoRec seems to be writing to the /Volumes folder on my mac ... ie, /Volumes/recup_dir.1 rather than /Volumes/driveName

Any suggestions? Thanks!
Top
aayler
Posts: 4
Joined: 21 Jun 2017, 02:32

Re: Attempting recovery

#5 Post by aayler »

I was able to save to a directory and following recovery, there were 3 plist files, and 2 .gz, one of which is 2.2TB.

I'm not able to open this 2.2TB .gzip file due to an error stating that it's corrupt ... Additionally, there was a 1.8TB image_remaining.dd that does not open either ... any further thoughts or suggestions?


Thanks!
Top
Locked

Return to “Partition Recovery”