URGENT: newbie needs help mixed partitions OSX +NT

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
sakker
Posts: 3
Joined: 28 Jan 2018, 14:19

URGENT: newbie needs help mixed partitions OSX +NT

#1 Post by sakker »

Hi
Sorry for barely knowing what Im doing but need help please!
I'm attaching test disk output below.

I have an external 2GB disk. This disk used to have 1.5GB Nac OSX time machine backup (encrypted) Partition and a 500 GB Windows NT partition.

I used this disk for months no problems. OSX was backing fine and I could access the NT partition whenever i needed.

1 month ago I decided to delete the Wndows NT partition in order to expand the OSX time machine partition.
( i can not recall what program i used but it was a free windows program, possibly EaseUS or Minitool )

After deletion of the NT partition the disk is NO longer usable. Keeps showing up Un-partitioned in OSX and Windows.

The deep scan output below seems to show only the NT partition is recoverable.

COULD SOMEONE PLS TEL ME HOW I SHUOLD PROCEED TO RECVOER THE OSX Time Machine backups or partition.
(PS once the OSX partition is recovered i plan to use Gnu parted to expand the OSX partition, unless another program is recommended)


---
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

TestDisk 7.1-WIP, Data Recovery Utility, January 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors
Partition Start End Size in sectors
>P EFI System 40 409639 409600 [EFI System Partition]
D MS Data 1959772313 2933269648 973497336
D Linux filesys. data 2759907509 2766837402 6929894 [M~Bl1 ^F 8| t]
D Mac HFS 2933007504 2933269647 262144
D MS Data 2933269648 3906766983 973497336 [Win-Bakup]
P Mac HFS 3906766984 3907029127 262144..



Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
FAT32, blocksize=512, 209 MB / 200 MiB

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: URGENT: newbie needs help mixed partitions OSX +NT

#2 Post by cgrenier »

If your HFS+ partition isn't listed, try Deeper Search.
Please copy and paste the whole testdisk.log.

sakker
Posts: 3
Joined: 28 Jan 2018, 14:19

Re: URGENT: newbie needs help mixed partitions OSX +NT

#3 Post by sakker »

Firstly, Thank you very much!

there is no "deeper search" option available at this screen...? I believe it already did it since it took 21 hours ?

BTW below are screen shots of disk as seen by Gparted, the problem (required) partition is the 1.37TB (/dev/sdb2) where the HFS partition should be.

https://drive.google.com/file/d/1wGkIDp ... sp=sharing

https://drive.google.com/file/d/14ncD8c ... sp=sharing

Image

Image

and the log file , ps i have run it a added to the log a couple of times so you may wanna look at the latest time stamps--



Tue Jan 16 16:51:25 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, January 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 17.3.0 (Darwin Kernel Version 17.3.0: Thu Nov 9 18:09:22 PST 2017; root:xnu-4570.3
Compiler: GCC 4.0
Compilation date: 2018-01-08T19:00:18
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors, sector size=512
Disk /dev/rdisk2 - 2000 GB / 1863 GiB - 3907029167 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/rdisk2 - 2000 GB / 1863 GiB
Partition table type: EFI GPT

Analyse Disk /dev/rdisk2 - 2000 GB / 1863 GiB - 3907029167 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029166 (expected 3907029166)
hdr_lba_start=34
hdr_lba_end=3907029133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 40 409639 409600 [EF]
2 P Windows Recovery Env 409640 2933007503 2932597864 [Ol]

search_part()
Disk /dev/rdisk2 - 2000 GB / 1863 GiB - 3907029167 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

LVM magic value at 14260281/0/1
Search for partition aborted

Results
P EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
0 0000 0000 00 00 00 00 00 00 00 00
gpt_change_part_type
0 0000 0000 00 00 00 00 00 00 00 00
SIGINT detected! TestDisk has been killed.


Tue Jan 16 18:14:46 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, January 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 17.3.0 (Darwin Kernel Version 17.3.0: Thu Nov 9 18:09:22 PST 2017; root:xnu-4570.3
Compiler: GCC 4.0
Compilation date: 2018-01-08T19:00:18
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors, sector size=512
Disk /dev/rdisk2 - 2000 GB / 1863 GiB - 3907029167 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/disk2 - 2000 GB / 1863 GiB
Partition table type: EFI GPT

Analyse Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029166 (expected 3907029166)
hdr_lba_start=34
hdr_lba_end=3907029133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 40 409639 409600 [EF]
2 P Windows Recovery Env 409640 2933007503 2932597864 [Ol]

search_part()
Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

LVM magic value at 14260281/0/1

LVM magic value at 967539093/0/1
check_FAT: Bad number of sectors per cluster

SYSV4 Marker at 2735697731/0/1

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 2735697731 2735697730 0 [\Dµa{]
SysV4, 0 B
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

cramfs Marker at 2759907509/0/1

recover_cramfs
Linux filesys. data 2759907509 2766837402 6929893 [M‚l1ºé¼Dîd¡8|¨t]
cramfs, 3548 MB / 3383 MiB

0 0000 0000 00 00 00 00 00 00 00 00
Unknown 2841266873 5005641195866808 5005638354599936
WBFS, 2562886 TB / 2330932 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

HFS+ magic value at 2933007504/0/1

HFS+ magic value at 2933007504/0/1
part_size 262144
Mac HFS 2933007504 2933269647 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB
NTFS at 2933269648/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size 973497336
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1959772313 2933269648 973497336
NTFS found using backup sector, blocksize=4096, 498 GB / 464 GiB
NTFS at 2933269648/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size 973497336
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2933269648 3906766983 973497336 [Win-Bakup]
NTFS, blocksize=4096, 498 GB / 464 GiB

HFS+ magic value at 3906766984/0/1

HFS+ magic value at 3906766984/0/1
part_size 262144
Mac HFS 3906766984 3907029127 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB

Results
P EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
MS Data 1959772313 2933269648 973497336
NTFS found using backup sector, blocksize=4096, 498 GB / 464 GiB
Linux filesys. data 2759907509 2766837402 6929894 [M‚l1ºé¼Dîd¡8|¨t]
cramfs, 3548 MB / 3383 MiB
Mac HFS 2933007504 2933269647 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB
MS Data 2933269648 3906766983 973497336 [Win-Bakup]
NTFS, blocksize=4096, 498 GB / 464 GiB
P Mac HFS 3906766984 3907029127 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB
0 0000 0000 00 00 00 00 00 00 00 00
gpt_change_part_type
0 0000 0000 00 00 00 00 00 00 00 00
Change partition type:
Mac HFS 1 3907029166 3907029166
Change partition type:
Unknown 1 3907029166 3907029166
0 0000 0000 00 00 00 00 00 00 00 00
gpt_change_part_type
0 0000 0000 00 00 00 00 00 00 00 00
Change partition type:
Mac HFS 1 3907029166 3907029166
Change partition type:
HFS 1 3907029166 3907029166
0 0000 0000 00 00 00 00 00 00 00 00
gpt_change_part_type
0 0000 0000 00 00 00 00 00 00 00 00
Change partition type:
Mac HFS 1 3907029166 3907029166
Change partition type:
HFS 1 3907029166 3907029166
0 0000 0000 00 00 00 00 00 00 00 00
gpt_change_part_type
0 0000 0000 00 00 00 00 00 00 00 00
Change partition type:
Mac HFS 1 3907029166 3907029166
Change partition type:
HFS 1 3907029166 3907029166
0 0000 0000 00 00 00 00 00 00 00 00
gpt_change_part_type
0 0000 0000 00 00 00 00 00 00 00 00
Change partition type:
Mac HFS 1 3907029166 3907029166
Change partition type:
HFS+ 1 3907029166 3907029166
Invalid partition structure.

TestDisk exited normally.


Wed Jan 17 22:35:01 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, January 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 17.3.0 (Darwin Kernel Version 17.3.0: Thu Nov 9 18:09:22 PST 2017; root:xnu-4570.3
Compiler: GCC 4.0
Compilation date: 2018-01-08T19:00:18
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors, sector size=512
Disk /dev/rdisk2 - 2000 GB / 1863 GiB - 3907029167 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/disk2 - 2000 GB / 1863 GiB
Partition table type: EFI GPT

Analyse Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029166 (expected 3907029166)
hdr_lba_start=34
hdr_lba_end=3907029133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 40 409639 409600 [EF]
2 P Windows Recovery Env 409640 2933007503 2932597864 [Ol]

search_part()
Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
Search for partition aborted

Results
P EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

interface_write()
1 P EFI System 40 409639 409600 [EFI System Partition] [EFI]
simulate write!

Analyse Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029166 (expected 3907029166)
hdr_lba_start=34
hdr_lba_end=3907029133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 40 409639 409600 [EF]
2 P Windows Recovery Env 409640 2933007503 2932597864 [Ol]
Backup partition structure
partition_save

search_part()
Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

LVM magic value at 14260281/0/1

LVM magic value at 967539093/0/1
check_FAT: Bad number of sectors per cluster

SYSV4 Marker at 2735697731/0/1

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 2735697731 2735697730 0 [\Dµa{]
SysV4, 0 B
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

cramfs Marker at 2759907509/0/1

recover_cramfs
Linux filesys. data 2759907509 2766837402 6929893 [M‚l1ºé¼Dîd¡8|¨t]
cramfs, 3548 MB / 3383 MiB

0 0000 0000 00 00 00 00 00 00 00 00
Unknown 2841266873 5005641195866808 5005638354599936
WBFS, 2562886 TB / 2330932 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

HFS+ magic value at 2933007504/0/1

HFS+ magic value at 2933007504/0/1
part_size 262144
Mac HFS 2933007504 2933269647 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB
NTFS at 2933269648/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size 973497336
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1959772313 2933269648 973497336
NTFS found using backup sector, blocksize=4096, 498 GB / 464 GiB
NTFS at 2933269648/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size 973497336
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2933269648 3906766983 973497336 [Win-Bakup]
NTFS, blocksize=4096, 498 GB / 464 GiB

HFS+ magic value at 3906766984/0/1

HFS+ magic value at 3906766984/0/1
part_size 262144
Mac HFS 3906766984 3907029127 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB

Results
P EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
MS Data 1959772313 2933269648 973497336
NTFS found using backup sector, blocksize=4096, 498 GB / 464 GiB
Linux filesys. data 2759907509 2766837402 6929894 [M‚l1ºé¼Dîd¡8|¨t]
cramfs, 3548 MB / 3383 MiB
Mac HFS 2933007504 2933269647 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB
MS Data 2933269648 3906766983 973497336 [Win-Bakup]
NTFS, blocksize=4096, 498 GB / 464 GiB
P Mac HFS 3906766984 3907029127 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB
0 0000 0000 00 00 00 00 00 00 00 00
gpt_change_part_type
0 0000 0000 00 00 00 00 00 00 00 00
Change partition type:
Mac HFS 1 3907029166 3907029166
Change partition type:
HFS+ 1 3907029166 3907029166
0 0000 0000 00 00 00 00 00 00 00 00
gpt_change_part_type
0 0000 0000 00 00 00 00 00 00 00 00
Change partition type:
EFI System 1 3907029166 3907029166
Change partition type:
HFS+ 1 3907029166 3907029166
0 0000 0000 00 00 00 00 00 00 00 00
gpt_change_part_type
0 0000 0000 00 00 00 00 00 00 00 00
Change partition type:
Mac HFS 1 3907029166 3907029166
Change partition type:
HFS+ 1 3907029166 3907029166
0 0000 0000 00 00 00 00 00 00 00 00
gpt_change_part_type
0 0000 0000 00 00 00 00 00 00 00 00
Change partition type:
MS Data 1 3907029166 3907029166
Change partition type:
NTFS 1 3907029166 3907029166
gpt_change_part_type
Change partition type:
P Mac HFS 3906766984 3907029127 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB
Change partition type:
P HFS+ 3906766984 3907029127 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB
Invalid partition structure.

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029166 (expected 3907029166)
hdr_lba_start=34
hdr_lba_end=3907029133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P EFI System 40 409639 409600 [EF]
2 P Windows Recovery Env 409640 2933007503 2932597864 [Ol]

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029166 (expected 3907029166)
hdr_lba_start=34
hdr_lba_end=3907029133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P EFI System 40 409639 409600 [EF]
2 P Windows Recovery Env 409640 2933007503 2932597864 [Ol]
New options :
Dump : No
Align partition: Yes
Expert mode : No

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029166 (expected 3907029166)
hdr_lba_start=34
hdr_lba_end=3907029133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P EFI System 40 409639 409600 [EF]
2 P Windows Recovery Env 409640 2933007503 2932597864 [Ol]
gpt_change_part_type
Change partition type:
2 P Mac HFS 409640 2933007503 2932597864 [Ol]
Change partition type:
2 P HFS+ 409640 2933007503 2932597864 [Ol]

HFS_HFSP_boot_sector
2 P Mac HFS 409640 2933007503 2932597864 [Ol]
Volume header
Bad

Backup volume header
Bad

Sectors are not identical.

HFS_HFSP_boot_sector
2 P Mac HFS 409640 2933007503 2932597864 [Ol]
Volume header
Bad

Backup volume header
Bad

Sectors are not identical.
gpt_change_part_type
Change partition type:
1 P Mac HFS 40 409639 409600 [EF]
Change partition type:
1 P HFS+ 40 409639 409600 [EF]

HFS_HFSP_boot_sector
1 P Mac HFS 40 409639 409600 [EF]
Volume header
Bad

Backup volume header
Bad

Sectors are identical.

TestDisk exited normally.


Sun Jan 28 03:33:33 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, January 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 17.3.0 (Darwin Kernel Version 17.3.0: Thu Nov 9 18:09:22 PST 2017; root:xnu-4570.3
Compiler: GCC 4.0
Compilation date: 2018-01-08T19:00:18
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors, sector size=512
Disk /dev/rdisk2 - 2000 GB / 1863 GiB - 3907029167 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/disk2 - 2000 GB / 1863 GiB
Partition table type: EFI GPT

Analyse Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029166 (expected 3907029166)
hdr_lba_start=34
hdr_lba_end=3907029133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 40 409639 409600 [EF]
2 P Windows Recovery Env 409640 2933007503 2932597864 [Ol]

search_part()
Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
Search for partition aborted

Results
P EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

interface_write()
1 P EFI System 40 409639 409600 [EFI System Partition] [EFI]

search_part()
Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
FAT32 at 46/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 46/0/1
EFI System 46 409645 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
Search for partition aborted

Results
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
EFI System 46 409645 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

interface_write()

No partition found or selected for recovery
simulate write!

Analyse Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029166 (expected 3907029166)
hdr_lba_start=34
hdr_lba_end=3907029133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 40 409639 409600 [EF]
2 P Windows Recovery Env 409640 2933007503 2932597864 [Ol]

search_part()
Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

LVM magic value at 14260281/0/1

LVM magic value at 967539093/0/1
check_FAT: Bad number of sectors per cluster

SYSV4 Marker at 2735697731/0/1

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 2735697731 2735697730 0 [\Dµa{]
SysV4, 0 B
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

cramfs Marker at 2759907509/0/1

recover_cramfs
Linux filesys. data 2759907509 2766837402 6929893 [M‚l1ºé¼Dîd¡8|¨t]
cramfs, 3548 MB / 3383 MiB

0 0000 0000 00 00 00 00 00 00 00 00
Unknown 2841266873 5005641195866808 5005638354599936
WBFS, 2562886 TB / 2330932 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

HFS+ magic value at 2933007504/0/1

HFS+ magic value at 2933007504/0/1
part_size 262144
Mac HFS 2933007504 2933269647 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB
NTFS at 2933269648/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size 973497336
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1959772313 2933269648 973497336
NTFS found using backup sector, blocksize=4096, 498 GB / 464 GiB
NTFS at 2933269648/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size 973497336
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2933269648 3906766983 973497336 [Win-Bakup]
NTFS, blocksize=4096, 498 GB / 464 GiB

HFS+ magic value at 3906766984/0/1

HFS+ magic value at 3906766984/0/1
part_size 262144
Mac HFS 3906766984 3907029127 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB

Results
P EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
MS Data 1959772313 2933269648 973497336
NTFS found using backup sector, blocksize=4096, 498 GB / 464 GiB
Linux filesys. data 2759907509 2766837402 6929894 [M‚l1ºé¼Dîd¡8|¨t]
cramfs, 3548 MB / 3383 MiB
Mac HFS 2933007504 2933269647 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB
MS Data 2933269648 3906766983 973497336 [Win-Bakup]
NTFS, blocksize=4096, 498 GB / 464 GiB
P Mac HFS 3906766984 3907029127 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB

interface_write()
1 P EFI System 40 409639 409600 [EFI System Partition] [EFI]
2 P Mac HFS 3906766984 3907029127 262144
simulate write!

TestDisk exited normally.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: URGENT: newbie needs help mixed partitions OSX +NT

#4 Post by cgrenier »

There is more than 1 TB for your missing partition after the EFI partition and before the NTFS filesystem.
I don't know why no partition is detected. Try other data recovery utilities...

sakker
Posts: 3
Joined: 28 Jan 2018, 14:19

Re: URGENT: newbie needs help mixed partitions OSX +NT

#5 Post by sakker »

OK Thanks, trying EaseUS Data Recovery -any util in particular you might suggest?

Locked