recover deleted Mac partitions

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
rudycox
Posts: 1
Joined: 16 Mar 2018, 08:48

recover deleted Mac partitions

#1 Post by rudycox »

Hi to everyone.
I accidentallly deleted the partion table on my MacBook ( 128ssd ) during a bootcamp installation of win 7

I tried to fix it using testdisk but something went wrong

I remember that there were 4 partitions after creating the windows one (seen during windows intallation)
the third ~25Gb was for windows
Could someone help me to restore the partition table ?

Below the testdisk log
Thankyou in advance

rudy

Code: Select all



Fri Mar 16 10:29:26 2018
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.14.20-std521-amd64 (#2 SMP Sun Feb 18 15:31:04 UTC 2018) x86_64
Compiler: GCC 6.4
Compilation date: 2018-02-21T20:22:41
ext2fs lib: 1.43.6, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA, LBA48 support
/dev/sda: size       236978176 sectors
/dev/sda: user_max   236978176 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/md0 - 0 B - CHS 1 2 4, sector size=512
Hard disk list
Disk /dev/sda - 121 GB / 113 GiB - CHS 14751 255 63, sector size=512 - APPLE SSD TS0128F, S/N:94IB30GEK9GX, FW:109R0219
Disk /dev/sdb - 1993 MB / 1901 MiB - CHS 1012 62 62, sector size=512 - SMI USB DISK, FW:1100
Disk /dev/sr0 - 570 MB / 544 MiB - 278578 sectors (RO), sector size=2048 - HL-DT-ST DVDRAM GP10NW20, FW:1.01

Partition table type (auto): EFI GPT
Disk /dev/sda - 121 GB / 113 GiB - APPLE SSD TS0128F
Partition table type: EFI GPT

Analyse Disk /dev/sda - 121 GB / 113 GiB - CHS 14751 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=236978175 (expected 236978175)
hdr_lba_start=34
hdr_lba_end=236978142
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of heads/cylinder mismatches 2 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 18 (FAT) != 63 (HD)
 1 P MS Data                  2488728    2491607       2880 [EFISECTOR]
Warning: number of heads/cylinder mismatches 2 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 18 (FAT) != 63 (HD)
 2 P MS Data                  2491608    2494487       2880 [EFISECTOR]
 3 P Mac HFS                136682775  136715014      32240
 4 P Mac HFS                152685078  169743233   17058156

search_part()
Disk /dev/sda - 121 GB / 113 GiB - CHS 14751 255 63
FAT12 at 154/233/40
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 154/233/40
     MS Data                  2488728    2491607       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT12 at 155/24/22
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 155/24/22
     MS Data                  2491608    2494487       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB

HFS magic value at 651/127/13
part_size 2145334861
     Mac HFS                 10466328 2155801188 2145334861 [ƒLP]
     HFS blocksize=16777216, 1098 GB / 1022 GiB
This partition ends after the disk limits. (start=10466328, size=2145334861, end=2155801188, disk end=236978176)

HFS magic value at 651/127/15

HFS magic value at 1154/54/21
part_size 2145334861
     Mac HFS                 18542432 2163877292 2145334861 [ƒLP]
     HFS blocksize=16777216, 1098 GB / 1022 GiB
This partition ends after the disk limits. (start=18542432, size=2145334861, end=2163877292, disk end=236978176)

HFS magic value at 1154/54/23

LVM magic value at 1267/40/37

LVM magic value at 3158/20/43

LVM magic value at 3161/234/38

HFS+ magic value at 8508/27/55
part_size 32240
     Mac HFS                136682775  136715014      32240
     HFS+ blocksize=4096, 16 MB / 15 MiB
     Unknown                139160923 2024134832 1884973910
     FATX, 965 GB / 898 GiB
Partition not added.

LVM magic value at 8708/6/42

HFS+ magic value at 9504/52/43
part_size 17058156
     Mac HFS                152685078  169743233   17058156
     HFS+ blocksize=2048, 8733 MB / 8329 MiB

HFS+ magic value at 11066/150/45
part_size 17058156
     Mac HFS                177784784  194842939   17058156
     HFS+ blocksize=2048, 8733 MB / 8329 MiB
NTFS at 14734/194/52
filesystem size           49606656
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                187107328  236713983   49606656
     NTFS found using backup sector, blocksize=4096, 25 GB / 23 GiB
NTFS at 14734/194/52
filesystem size           49606656
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                236713983  286320638   49606656
     NTFS, blocksize=4096, 25 GB / 23 GiB
This partition ends after the disk limits. (start=236713983, size=49606656, end=286320638, disk end=236978176)
NTFS at 14734/226/44
filesystem size           49609248
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                187106744  236715991   49609248
     NTFS found using backup sector, blocksize=4096, 25 GB / 23 GiB
NTFS at 14734/226/44
filesystem size           49609248
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                236715991  286325238   49609248
     NTFS, blocksize=4096, 25 GB / 23 GiB
This partition ends after the disk limits. (start=236715991, size=49609248, end=286325238, disk end=236978176)
Disk /dev/sda - 121 GB / 113 GiB - CHS 14751 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (121 GB / 113 GiB) seems too small! (< 1107 GB / 1031 GiB)
The following partitions can't be recovered:
     Mac HFS                 10466328 2155801188 2145334861 [ƒLP]
     HFS blocksize=16777216, 1098 GB / 1022 GiB
     Mac HFS                 18542432 2163877292 2145334861 [ƒLP]
     HFS blocksize=16777216, 1098 GB / 1022 GiB
     MS Data                236713983  286320638   49606656
     NTFS, blocksize=4096, 25 GB / 23 GiB
     MS Data                236715991  286325238   49609248
     NTFS, blocksize=4096, 25 GB / 23 GiB

Results
   P MS Data                  2488728    2491607       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
   P MS Data                  2491608    2494487       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
   P Mac HFS                136682775  136715014      32240
     HFS+ blocksize=4096, 16 MB / 15 MiB
   P Mac HFS                152685078  169743233   17058156
     HFS+ blocksize=2048, 8733 MB / 8329 MiB
     Mac HFS                177784784  194842939   17058156
     HFS+ blocksize=2048, 8733 MB / 8329 MiB
     MS Data                187106744  236715991   49609248
     NTFS found using backup sector, blocksize=4096, 25 GB / 23 GiB
     MS Data                187107328  236713983   49606656
     NTFS found using backup sector, blocksize=4096, 25 GB / 23 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 2880 linear /dev/sda 2488728" | dmsetup create test0
echo "0 2880 linear /dev/sda 2491608" | dmsetup create test1
echo "0 32240 linear /dev/sda 136682775" | dmsetup create test2
echo "0 17058156 linear /dev/sda 152685078" | dmsetup create test3
echo "0 17058156 linear /dev/sda 177784784" | dmsetup create test4
echo "0 49609248 linear /dev/sda 187106744" | dmsetup create test5
echo "0 49606656 linear /dev/sda 187107328" | dmsetup create test6

interface_write()
 1 P MS Data                  2488728    2491607       2880 [EFISECTOR]
 2 P MS Data                  2491608    2494487       2880 [EFISECTOR]
 3 P Mac HFS                136682775  136715014      32240
 4 P Mac HFS                152685078  169743233   17058156

search_part()
Disk /dev/sda - 121 GB / 113 GiB - CHS 14751 255 63
FAT12 at 154/233/40
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 154/233/40
     MS Data                  2488728    2491607       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT12 at 155/24/22
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 155/24/22
     MS Data                  2491608    2494487       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB

HFS magic value at 651/127/13
part_size 2145334861
     Mac HFS                 10466328 2155801188 2145334861 [ƒLP]
     HFS blocksize=16777216, 1098 GB / 1022 GiB
This partition ends after the disk limits. (start=10466328, size=2145334861, end=2155801188, disk end=236978176)

HFS magic value at 651/127/15

HFS magic value at 1154/54/21
part_size 2145334861
     Mac HFS                 18542432 2163877292 2145334861 [ƒLP]
     HFS blocksize=16777216, 1098 GB / 1022 GiB
This partition ends after the disk limits. (start=18542432, size=2145334861, end=2163877292, disk end=236978176)

HFS magic value at 1154/54/23

LVM magic value at 1267/40/37

LVM magic value at 3158/20/43

LVM magic value at 3161/234/38

HFS+ magic value at 8508/27/55
part_size 32240
     Mac HFS                136682775  136715014      32240
     HFS+ blocksize=4096, 16 MB / 15 MiB

HFS+ magic value at 8508/27/57
part_size 32240
     Mac HFS                136650539  136682778      32240
     HFS+ found using backup sector!, 16 MB / 15 MiB
     Unknown                139160923 2024134832 1884973910
     FATX, 965 GB / 898 GiB
Partition not added.

LVM magic value at 8708/6/42

HFS+ magic value at 9504/52/43
part_size 17058156
     Mac HFS                152685078  169743233   17058156
     HFS+ blocksize=2048, 8733 MB / 8329 MiB

HFS+ magic value at 9504/52/45
part_size 17058156
     Mac HFS                135626926  152685081   17058156
     HFS+ found using backup sector!, 8733 MB / 8329 MiB
NTFS at 10441/56/32
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     MS Data                167732051  167738224       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 10441/56/32
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     MS Data                167738224  167744397       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB

HFS magic value at 10471/182/10
part_size 138412290
     Mac HFS                168228090  306640379  138412290
     HFS blocksize=16777216, 70 GB / 66 GiB
This partition ends after the disk limits. (start=168228090, size=138412290, end=306640379, disk end=236978176)

HFS magic value at 10471/182/12
part_size 138412290
     Mac HFS                 29815804  168228093  138412290
     HFS found using backup sector!, 70 GB / 66 GiB

HFS+ magic value at 11066/150/45
part_size 17058156
     Mac HFS                177784784  194842939   17058156
     HFS+ blocksize=2048, 8733 MB / 8329 MiB

HFS+ magic value at 11066/150/47
part_size 17058156
     Mac HFS                160726632  177784787   17058156
     HFS+ found using backup sector!, 8733 MB / 8329 MiB
NTFS at 11646/218/21
filesystem size           49609248
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                137497497  187106744   49609248
     NTFS found using backup sector, blocksize=4096, 25 GB / 23 GiB
NTFS at 11646/218/21
filesystem size           49609248
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                187106744  236715991   49609248
     NTFS, blocksize=4096, 25 GB / 23 GiB
NTFS at 11646/227/38
filesystem size           49606656
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                137500673  187107328   49606656
     NTFS found using backup sector, blocksize=4096, 25 GB / 23 GiB
NTFS at 11646/227/38
filesystem size           49606656
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                187107328  236713983   49606656
     NTFS, blocksize=4096, 25 GB / 23 GiB
NTFS at 14734/194/52
filesystem size           49606656
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                187107328  236713983   49606656
     NTFS found using backup sector, blocksize=4096, 25 GB / 23 GiB
NTFS at 14734/194/52
filesystem size           49606656
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                236713983  286320638   49606656
     NTFS, blocksize=4096, 25 GB / 23 GiB
This partition ends after the disk limits. (start=236713983, size=49606656, end=286320638, disk end=236978176)
NTFS at 14734/226/44
filesystem size           49609248
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                187106744  236715991   49609248
     NTFS found using backup sector, blocksize=4096, 25 GB / 23 GiB
NTFS at 14734/226/44
filesystem size           49609248
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                236715991  286325238   49609248
     NTFS, blocksize=4096, 25 GB / 23 GiB
This partition ends after the disk limits. (start=236715991, size=49609248, end=286325238, disk end=236978176)
Disk /dev/sda - 121 GB / 113 GiB - CHS 14751 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (121 GB / 113 GiB) seems too small! (< 1107 GB / 1031 GiB)
The following partitions can't be recovered:
     Mac HFS                 10466328 2155801188 2145334861 [ƒLP]
     HFS blocksize=16777216, 1098 GB / 1022 GiB
     Mac HFS                 18542432 2163877292 2145334861 [ƒLP]
     HFS blocksize=16777216, 1098 GB / 1022 GiB
     Mac HFS                168228090  306640379  138412290
     HFS blocksize=16777216, 70 GB / 66 GiB
     MS Data                236713983  286320638   49606656
     NTFS, blocksize=4096, 25 GB / 23 GiB
     MS Data                236715991  286325238   49609248
     NTFS, blocksize=4096, 25 GB / 23 GiB

Results
   P MS Data                  2488728    2491607       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
   P MS Data                  2491608    2494487       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
     Mac HFS                 29815804  168228093  138412290
     HFS found using backup sector!, 70 GB / 66 GiB
     Mac HFS                135626926  152685081   17058156
     HFS+ found using backup sector!, 8733 MB / 8329 MiB
     Mac HFS                136650539  136682778      32240
     HFS+ found using backup sector!, 16 MB / 15 MiB
     Mac HFS                136682775  136715014      32240
     HFS+ blocksize=4096, 16 MB / 15 MiB
     MS Data                137497497  187106744   49609248
     NTFS found using backup sector, blocksize=4096, 25 GB / 23 GiB
     MS Data                137500673  187107328   49606656
     NTFS found using backup sector, blocksize=4096, 25 GB / 23 GiB
     Mac HFS                152685078  169743233   17058156
     HFS+ blocksize=2048, 8733 MB / 8329 MiB
     Mac HFS                160726632  177784787   17058156
     HFS+ found using backup sector!, 8733 MB / 8329 MiB
     MS Data                167732051  167738224       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
     MS Data                167738224  167744397       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
     Mac HFS                177784784  194842939   17058156
     HFS+ blocksize=2048, 8733 MB / 8329 MiB
     MS Data                187106744  236715991   49609248
     NTFS, blocksize=4096, 25 GB / 23 GiB
     MS Data                187107328  236713983   49606656
     NTFS, blocksize=4096, 25 GB / 23 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 2880 linear /dev/sda 2488728" | dmsetup create test0
echo "0 2880 linear /dev/sda 2491608" | dmsetup create test1
echo "0 138412290 linear /dev/sda 29815804" | dmsetup create test2
echo "0 17058156 linear /dev/sda 135626926" | dmsetup create test3
echo "0 32240 linear /dev/sda 136650539" | dmsetup create test4
echo "0 32240 linear /dev/sda 136682775" | dmsetup create test5
echo "0 49609248 linear /dev/sda 137497497" | dmsetup create test6
echo "0 49606656 linear /dev/sda 137500673" | dmsetup create test7
echo "0 17058156 linear /dev/sda 152685078" | dmsetup create test8
echo "0 17058156 linear /dev/sda 160726632" | dmsetup create test9
echo "0 6174 linear /dev/sda 167732051" | dmsetup create test10
echo "0 6174 linear /dev/sda 167738224" | dmsetup create test11
echo "0 17058156 linear /dev/sda 177784784" | dmsetup create test12
echo "0 49609248 linear /dev/sda 187106744" | dmsetup create test13
echo "0 49606656 linear /dev/sda 187107328" | dmsetup create test14

interface_write()
 1 P MS Data                  2488728    2491607       2880 [EFISECTOR]
 2 P MS Data                  2491608    2494487       2880 [EFISECTOR]
simulate write!

TestDisk exited normally.


User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: recover deleted Mac partitions

#2 Post by cgrenier »

After Deeper Search, several NTFS partitions are listed. Try to list the files from them, this way you should be able to find the correct one.
Set the partition to keep/recover as P(rimary). On next screen, choose Write, confirm, Quit and restart the computer.

Locked