Recover HFS+ partition incorrectly reformatted as FAT32 - cgsecurity.org

Recover HFS+ partition incorrectly reformatted as FAT32

Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf

Locked

1 post • Page 1 of 1

Message

Author

jiho: Posts: 1; Joined: 13 Feb 2013, 18:35

Recover HFS+ partition incorrectly reformatted as FAT32

#1 Post by jiho » 15 Feb 2013, 09:27

Hi everyone,

[I apologise for the long post, I tried to provide as much information as possible]

I have a laptop with two internal hard drives. One is a 500GB Hitachi drive which I use as a storage drive (the system is on the other one). I made a mistake when trying to reformat a thumb drive and reformatted my 500GB drive instead. I immediately unmounted the drive and did not touch it again.

The drive used to have a single ~500GB HFS+ journaled partition with a GUID partition table. It now has a single ~500GB FAT32 partition with a (new) GUID partition table. (NB: the laptop is a MacBook Pro and the formatting was done with Disk Utility). It was a quick reformat (took a few seconds) of the whole drive (not just the partition), which is why I assume the partition table has been completely rewritten but the data should still be there.

According to this:
http://www.cgsecurity.org/wiki/Data_Rec ... _partition
it seems possible to recover the old partition as it was. It would be ideal for me since that drive had quite many files, including my photo archive. A file based recovery, even if it does recover all files, would require to rename all of them which would be nearly unfeasible.

I made a block-level copy of the 500GB drive to an external drive, with dd, just to be safe, and then started following the instructions above. Here is what I get:

Code: Select all

  TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.

Select a media (use Arrow keys, then press Enter):
 Disk /dev/disk0 - 251 GB / 233 GiB (RO)
>Disk /dev/disk1 - 500 GB / 465 GiB
 Disk /dev/rdisk0 - 251 GB / 233 GiB (RO)
 Disk /dev/rdisk1 - 500 GB / 465 GiB

>[Proceed ]  [  Quit  ]

NB: the /dev/rdisk versions are duplicates that OS X create. I don't know much about them. /dev/disk seems to be the "normal" version.

The partition table type is correctly detected

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB

Please select the partition table type, press Enter when done.
 [Intel  ] Intel/PC partition
>[EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
 [Humax  ] Humax partition table
 [Mac    ] Apple partition map
 [None   ] Non partitioned media
 [Sun    ] Sun Solaris partition
 [XBox   ] XBox partition
 [Return ] Return to disk selection

Hint: EFI GPT partition table type has been detected.

I change the type through the "Advanced" menu, as advised in the URL above:

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB
     976773168 sectors - sector size=512

 [ Analyse  ] Analyse current partition structure and search for lost partitions
>[ Advanced ] Filesystem Utils
 [ Geometry ] Change disk geometry
 [ Options  ] Modify options
 [ Quit     ] Return to disk selection

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB - 976773168 sectors

     Partition                  Start        End    Size in sectors
  1 P EFI System                    40     409639     409600
> 2 P MS Data                   409640  976510983  976101344 [ARCHIVE]

>[  Type  ]  [  Boot  ]  [Undelete]  [Image Creation]  [  Quit  ]

There are now two screens to select the partition type. I am not sure what to select but I assume it is a general type ("Mac HFS") and then a more precise format ("HFS+"):

Code: Select all

 2 P MS Data                   409640  976510983  976101344 [ARCHIVE]
Please choose the partition type, press Enter when done.

 EFI System                HPUX Data                 Solaris /home
 MBR                       HPUX Service              Solaris EFI Alt.
 FreeBSD                  >Mac HFS                   Solaris Reserved1
 FreeBSD Swap              Mac UFS                   Solaris Reserved2
 FreeBSD UFS               Mac Raid                  Solaris Reserved3
 FreeBSD Vinum             Mac Raid (Offline)        Solaris Reserved4
 FreeBSD ZFS               Mac Boot                  Solaris Reserved5
 MS Reserved               Mac Label
 MS Data                   Mac TV Recovery
 MS LDM MetaData           Solaris /boot
 MS LDM Data               Solaris /
 Linux Raid                Solaris Swap
 Linux Swap                Solaris Backup
 Linux LVM                 Solaris /usr
 Linux Reserved            Solaris /var

[ Proceed ]

Code: Select all

 2 P FAT32                     409640  976510983  976101344 [ARCHIVE]
Please choose the partition type, press Enter when done.

 Unknown                   HFSX                      NTFS
 BeFS                      HPFS                      OpenBSD
 btrfs                     ISO                       OS2 Multiboot
 CramFS                    JFS                       ReiserFS 3.5
 exFAT                     Linux SWAP                ReiserFS 3.6
 ext2                      Linux SWAP 2              ReiserFS 3.x
 ext3                      Linux SWAP                ReiserFS 4
 ext4                      Linux SWAP 2              Sun
 FAT12                     Linux SWAP 2              SysV 4
 FAT16                     Linux LUKS                UFS
 FAT32                     Linux LVM                 UFS 2
 FreeBSD                   Linux LVM2                UFS - Little Endian
 GFS2                      Linux md 0.9 RAID         UFS 2 - Little Endian
 HFS                       Linux md 1.x RAID         VMFS
>HFS+                      Netware                   WBFS
                                                     Next
[ Proceed ]

Now the partition is shown as Mac HFS but I do not get menus for boot sector recovery or listing files, just an additional "Superblock" option to "Locate HFS/HFS+ backup volume header":

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB - 976773168 sectors

     Partition                  Start        End    Size in sectors
  1 P EFI System                    40     409639     409600
> 2 P Mac HFS                   409640  976510983  976101344 [ARCHIVE]

 [  Type  ] >[Superblock]  [Image Creation]  [  Quit  ]
                      Locate HFS/HFS+ backup volume header

which cannot find any correct header, I assume they were reformatted:

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB - 976773168 sectors
     Partition                  Start        End    Size in sectors
 2 P Mac HFS                   409640  976510983  976101344 [ARCHIVE]

Volume header
Bad

Backup volume header
Bad

Sectors are identical.

>[  Quit  ]  [  Dump  ]

Quitting TestDisk at this point does not change anything (disk appears as empty and formatted as FAT32) which is expected since I was never able to write the changes to the disk.

So I tried changing the type through the regular menu:

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB
     976773168 sectors - sector size=512

>[ Analyse  ] Analyse current partition structure and search for lost partitions
 [ Advanced ] Filesystem Utils
 [ Geometry ] Change disk geometry
 [ Options  ] Modify options
 [ Quit     ] Return to disk selection

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB - 976773168 sectors
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P EFI System                    40     409639     409600
Warning: number of heads/cylinder mismatches 255 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD)
 2 P MS Data                   409640  976510983  976101344 [ARCHIVE]

                P=Primary  D=Deleted
>[Quick Search]  [ Backup ]

NB: I am not sure how important these warnings are... I proceeded with the quick search.

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB - 976773168 sectors
Analyse cylinder 976683008/976773167: 99%

check_FAT: Unusual media descriptor (0xf0!=0xf8)
Warning: number of heads/cylinder mismatches 16 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD)
  EFI System                    40     409639     409600 [EFI]
Warning: number of heads/cylinder mismatches 255 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD)
  MS Data                   409640  976510983  976101344 [ARCHIVE]

  Stop

and the result was:

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB - 976773168 sectors
     Partition               Start        End    Size in sectors
 P EFI System                    40     409639     409600 [EFI]
>P MS Data                   409640  976510983  976101344 [ARCHIVE]

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
FAT32, blocksize=32768, 499 GB / 465 GiB

At this point I typed "T" and went through the same two screens to select "Mac HFS" and "HFS+". The partition appears as Mac HFS in the list but is still displayed as FAT32 in the info on the last line of the screen:

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB - 976773168 sectors
     Partition               Start        End    Size in sectors
 P EFI System                    40     409639     409600 [EFI]
>P Mac HFS                   409640  976510983  976101344 [ARCHIVE]

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type,
     Enter: to continue
FAT32, blocksize=32768, 499 GB / 465 GiB

I still wrote the partition structure to the disk:

Code: Select all

     Partition                  Start        End    Size in sectors
 1 P EFI System                    40     409639     409600 [EFI]
 2 P Mac HFS                   409640  976510983  976101344 [ARCHIVE]

 [  Quit  ]  [Deeper Search] >[ Write  ]
                       Write partition structure to disk

Code: Select all

Write partition table, confirm ? (Y/N)

Code: Select all

You will have to reboot for the change to take effect.

>[Ok]

Quitting TestDisk at this point makes the disk appear as unreadable by the system and OS X offers me to initialize it (which I don't, of course). In Disk Utility, the disk appears formatted with one HFS+ journaled partition... which does not mount. Verifying the Disk shows an OK partition map. In TestDisk, it appears as:

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB - 976773168 sectors
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P EFI System                    40     409639     409600
No HFS or HFS+ structure
 2 P Mac HFS                   409640  976510983  976101344
 2 P Mac HFS                   409640  976510983  976101344

But a new Quick search gives the FAT32 partition again:

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB - 976773168 sectors
     Partition               Start        End    Size in sectors
>P EFI System                    40     409639     409600 [EFI]
 P MS Data                   409640  976510983  976101344 [ARCHIVE]

At that point I proceeded with a Deep Scan, just to see what it would give and here is the result:

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB - 976773168 sectors

The harddisk (500 GB / 465 GiB) seems too small! (< 14117418 TB / 12839717 TiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
>  MS Data                721131259 27573082889725481 27573082168594222
   Mac HFS                859347305 1835448648  976101344
   Mac HFS                859347410 1835448753  976101344
   Mac HFS                859347499 1835448842  976101344
   Mac HFS                859347684 1835449027  976101344
   Mac HFS                859347957 1835449300  976101344
   Mac HFS                859348358 1835449701  976101344
   Mac HFS                859348647 1835449990  976101344
   Mac HFS                859349528 1835450871  976101344
   Mac HFS                859349761 1835451104  976101344

[ Continue ]
JFS 1162430030, blocksize=1431522668, 14117418 TB / 12839716 TiB

and the last line becomes:

Code: Select all

HFS+ blocksize=4096, 499 GB / 465 GiB

when an HFS partition is selected.

I don't know how important is the warning regarding the size of the disk. It is indeed 500GB. The sizes in TB mentioned on the same line are unrealistic.

When I hit continue I get to:

Code: Select all

Disk /dev/disk1 - 500 GB / 465 GiB - 976773168 sectors
     Partition               Start        End    Size in sectors
 D EFI System                    40     409639     409600 [EFI]
 D EFI System                    46     409645     409600 [EFI]
>D MS Data                   409640  976510983  976101344 [ARCHIVE]
 D MS Data                   409646  976510989  976101344 [ARCHIVE]
 D Mac HFS                 18580459   19406650     826192
 D Mac HFS                 19406647   20232838     826192
 D Mac HFS                 58113610   69873077   11759468
 D Mac HFS                 69873074   81632541   11759468
 D Mac HFS                130673441  130880064     206624
 D Mac HFS                130673467  130880090     206624
 D Mac HFS                130673468  130880091     206624
 D Mac HFS                130673501  130880124     206624
 D Mac HFS                130673555  130880178     206624
 D Mac HFS                130675496  130880063     204568
 D Mac HFS                130841056  131047679     206624
 D Mac HFS                130843113  131047680     204568
 D Mac HFS                130880060  131084627     204568
 D Mac HFS                130880061  131086684     206624
 D Mac HFS                130880087  131086710     206624
 D Mac HFS                130880088  131086711     206624
 D Mac HFS                130880121  131086744     206624
 D Mac HFS                130880175  131086798     206624
 D Mac HFS                131047676  131254299     206624
 D Mac HFS                131047677  131252244     204568
 D Mac HFS                144864668  144894715      30048
 D Mac HFS                144894712  144924759      30048
 D Mac HFS                146902000  146932047      30048
 D Mac HFS                146932044  146962091      30048
 D Mac HFS                154287518  155311437    1023920
 D Mac HFS                154534388  155558307    1023920
 D Mac HFS                155311434  156335353    1023920
 D Mac HFS                155558304  156582223    1023920
 D Mac HFS                220753300  220763539      10240
 D Mac HFS                220758402  220768641      10240
 D Mac HFS                220763536  220773775      10240
 D Mac HFS                220768638  220778877      10240
 D Mac HFS                221558538  221568771      10234 [Toolbox]
 D Mac HFS                221558716  221568859      10144
 D Mac HFS                221568768  221579001      10234 [Toolbox]
 D Mac HFS                221568774  221579007      10234 [Toolbox]
 D Mac HFS                221568856  221578999      10144
 D Mac HFS                221578996  221589139      10144
 D Mac HFS                221579004  221589237      10234 [Toolbox]
 D Mac HFS                221812658  221817163       4506 [PL2303 driver]
 D Mac HFS                221812836  221817251       4416
 D Mac HFS                221813953  221818458       4506 [PL2303 driver]
 D Mac HFS                221814042  221818457       4416
 D Mac HFS                221817160  221821665       4506 [PL2303 driver]
 D Mac HFS                221817248  221821663       4416
 D Mac HFS                221818454  221822869       4416
 D Mac HFS                221818455  221822960       4506 [PL2303 driver]
 D Mac HFS                323651004  335410471   11759468
 D Mac HFS                335410468  347169935   11759468
 D MS Data                700266254  700475117     208864
 D MS Data                700266336  700475199     208864
 D MS Data                714366328  714369207       2880 [NO NAME]
 D Mac HFS                793292520  793317839      25320
 D Mac HFS                793317836  793343155      25320
 D Mac HFS                826279657  826284162       4506 [PL2303 driver]
 D Mac HFS                826279746  826284161       4416
 D Mac HFS                826284158  826288573       4416
 D Mac HFS                826284159  826288664       4506 [PL2303 driver]
 D Mac HFS                940385419  940578019     192601 [Corel Painter 8]
 D Mac HFS                940578016  940770616     192601 [Corel Painter 8]
 D Mac HFS                940578152  940770752     192601 [Corel Painter 8]
 D Mac HFS                940770749  940963349     192601 [Corel Painter 8]
 D Mac HFS                949231804  950370547    1138744
 D Mac HFS                950370544  951509287    1138744
>D Mac HFS                951509284  952648027    1138744
 Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
FAT32, blocksize=32768, 499 GB / 465 GiB

when an HFS partition is selected I get this at the end

Code: Select all

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, 
     Enter: to continue
HFS+ blocksize=4096, 583 MB / 556 MiB

So I cannot list files on those.

Many of the small HFS partitions appear to be disk images of applications, which were indeed on the disk, and are duplicated (see [Corel Painter 8]).

I don't know what to do at this point. Can I rewrite the partition table manually assuming some of the sizes? Did I do something wrong in TestDisk? I would welcome all advice. I am no expert but I am not scared of the command line. I have Linux and Windows machines handy if needed.

The data on this drive is quite important to me (I thought it was backed up and it was not completely...) so thank you very much in advance.

Locked

1 post • Page 1 of 1

Return to “Partition Recovery”