Recovering HFS+ partition wiped by Windows

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
plsncld
Posts: 5
Joined: 30 Mar 2017, 07:59

Recovering HFS+ partition wiped by Windows

#1 Post by plsncld »

Running testdisk I can see multiple entries which could be the partition that I wish to recover (350GB HFS+). I've tried to write some of the entries of around the right size and mount them but they won't mount, with errors relating to the filesystem and superblock.

Any suggestions?
Sat Apr 1 11:59:58 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 16.4.0 (Darwin Kernel Version 16.4.0: Thu Dec 22 22:53:21 PST 2016; root:xnu-3789.4
Compiler: GCC 4.0
Compilation date: 2017-03-16T18:15:19
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/disk2 - 2000 GB / 1862 GiB - 3906928640 sectors, sector size=512
Disk /dev/rdisk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/rdisk1 - 178 GB / 165 GiB - 347657384 sectors (RO), sector size=512
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906928640 sectors, sector size=512

Partition table type (auto): Intel
Disk /dev/rdisk2 - 2000 GB / 1862 GiB
Partition table type: EFI GPT

Analyse Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906928640 sectors
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906928640 sectors
FAT32 at 2048/0/1
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)

FAT32 at 2048/0/1
FAT: cluster=2(0x2), pos=26624
EFI System 2048 67110911 67108864 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB

HFS magic value at 347957696/0/1
part_size 2880
Mac HFS 347957696 347960575 2880 [System Startup]
HFS blocksize=512, 1474 KB / 1440 KiB

HFS magic value at 347963568/0/1
part_size 1600
Mac HFS 347963568 347965167 1600 [MacDrawStartup]
HFS blocksize=512, 819 KB / 800 KiB
NTFS at 349272495/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size 20948697
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 1309293
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 328323799 349272495 20948697
NTFS found using backup sector, blocksize=4096, 10725 MB / 10228 MiB
NTFS at 349272495/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size 20948697
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 1309293
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 349272495 370221191 20948697
NTFS, blocksize=4096, 10725 MB / 10228 MiB

HFS+ magic value at 683109580/0/1
part_size 682699944
Mac HFS 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB
Search for partition aborted

Results
P EFI System 2048 67110911 67108864 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB
MS Data 328323799 349272495 20948697
NTFS found using backup sector, blocksize=4096, 10725 MB / 10228 MiB
Mac HFS 347957696 347960575 2880 [System Startup]
HFS blocksize=512, 1474 KB / 1440 KiB
Mac HFS 347963568 347965167 1600 [MacDrawStartup]
HFS blocksize=512, 819 KB / 800 KiB
MS Data 349272495 370221191 20948697
NTFS, blocksize=4096, 10725 MB / 10228 MiB
P Mac HFS 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB
gpt_change_part_type
Change partition type:
P Mac HFS 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB
Change partition type:
P HFS+ 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB

interface_write()
1 P EFI System 2048 67110911 67108864 [EFI System Partition] [ESD-USB]
2 P Mac HFS 683109580 1365809523 682699944
write!
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.


Sat Apr 1 23:05:10 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 16.4.0 (Darwin Kernel Version 16.4.0: Thu Dec 22 22:53:21 PST 2016; root:xnu-3789.4
Compiler: GCC 4.0
Compilation date: 2017-03-16T18:15:19
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/disk2 - 2000 GB / 1862 GiB - 3906928640 sectors, sector size=512
Disk /dev/rdisk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/rdisk1 - 178 GB / 165 GiB - 347657384 sectors (RO), sector size=512
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906928640 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/rdisk2 - 2000 GB / 1862 GiB
Partition table type: EFI GPT

Analyse Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906928640 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906928639 (expected 3906928639)
hdr_lba_start=34
hdr_lba_end=3906928606
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 2048 67110911 67108864 [EFI System Partition]
2 P Mac HFS 683109580 1365809523 682699944

search_part()
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906928640 sectors
FAT32 at 2048/0/1
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)

FAT32 at 2048/0/1
FAT: cluster=2(0x2), pos=26624
EFI System 2048 67110911 67108864 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB

HFS+ magic value at 683109580/0/1
part_size 682699944
Mac HFS 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB
Search for partition aborted

Results
P EFI System 2048 67110911 67108864 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB
P Mac HFS 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB

interface_write()
1 P EFI System 2048 67110911 67108864 [EFI System Partition] [ESD-USB]
2 P Mac HFS 683109580 1365809523 682699944
simulate write!
New geometry
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - CHS 243196 255 63 sector_size=512

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906928639 (expected 3906943739)
hdr_lba_start=34
hdr_lba_end=3906928606
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P EFI System 2048 67110911 67108864 [EFI System Partition]
2 P Mac HFS 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB
New options :
Dump : No
Align partition: Yes
Expert mode : No

Analyse Disk /dev/rdisk2 - 2000 GB / 1862 GiB - CHS 243196 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906928639 (expected 3906943739)
hdr_lba_start=34
hdr_lba_end=3906928606
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 2048 67110911 67108864 [EFI System Partition]
2 P Mac HFS 683109580 1365809523 682699944
Top
Locked

Return to “Partition Recovery”