The drive I am trying to fix is a 3TB 3.5" HDD retrieved from a Toshiba external drive I have been using for a couple of years. Recently the drive stopped working with no warning signs or explanation.
The drive had been partitioned into 2 1.5TB HFS+ partitions, named "Backups" (for my Mac's Time Machine backups) and "Storage" (to offload files which were taking up too much space on my Mac's internal SSD).
The enclosure was not designed to be user-opened so I have had to break open the plastic enclosure to remove the hard drive inside. The drive itself is a standard SATA HDD, and was connected via its SATA port to a circuit board which then had the USB 3.0 and power connectors. There is what looks like some visible damage on this circuit board, which I believe may be the reason why the drive stopped working. I do not believe that the drive itself has been physically damaged, and the way in which it stopped working without warning makes me believe that the fault is with the enclosure and not the drive itself. However, whatever happened resulted in the drive becoming unreadable.
Steps taken so far
(the following is from memory, apologies as I wasn't documenting these steps at the time and this has taken place over the past week)
I initially bought an enclosure to connect the drive to my Mac via USB, however while the drive appeared in Disk Utility, the drive's contents were not recognised and it could not be mounted. Running First Aid didn't help.
At first I couldn't find any Mac software which could help, so I connected the drive to my Windows 10 PC directly through the motherboard via SATA cable. The drive was detected and appeared to run normally, however again the contents were not recognised. After trying a couple of Windows programs which also didn't work, I came across TestDisk.
TestDisk recognised the drive and recommend it was an Intel/PC partitioned drive. After running Analyse it detected 2 HFS partitions, which both appeared to be the same size. I wrote this partition information, restarted, and Windows' Disk Management now detected 4 partitions on the drive - 2 very small partitions, and 2 large partitions. As Windows cannot natively read HFS format, I then removed the drive from the PC and reconnected it via enclosure to my Mac.
My Mac initially saw 4 partitions, but as before it could not read or mount any of the 4 partitions. I then downloaded the Mac version of TestDisk, and ran the Analyse function again, and could now see 3 partitions instead of 4. After writing this partition information and restarting, I then had some success:
https://i.imgur.com/D8yE3V2.png
TestDisk has successfully recovered one of the two partitions! The "Backups" partition in the screenshot is readable, and I have verified that the contents of the drive (Time Machine backups) are present. TestDisk even recovered the partition's original name, which I didn't expect it to do! (I have disabled Time Machine for the time being to avoid it trying to reuse the drive before I am finished fixing it.)
Unfortunately, I still have the problem that the second partition ("Storage") has not been recovered, and I am now going round in circles trying to work out what the issue might be. As you can see from the Disk Utility screenshot, the drive currently sees 3 partitions - the successfully recovered Backups partition and 2 unmountable partitions, "disk2s2" and "disk2s3".
Current status
When I run Analyse on the drive, TestDisk is currently giving me the following warnings:
Code: Select all
TestDisk 7.1-WIP, Data Recovery Utility, April 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
Current partition structure:
Partition Start End Size in sectors
1 * HFS 614448 2930302975 2929688528
Warning: Bad starting head (CHS and LBA don't match)
2 P HFS 2930306128 2930568271 262144
Warning: Bad starting head (CHS and LBA don't match)
3 P HFS 2930657736 5860363599 2929705864
Warning: Bad starting head (CHS and LBA don't match)
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
>[Quick Search] [ Backup ]
Code: Select all
Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
The harddisk (3000 GB / 2794 GiB) seems too small! (< 3000 GB / 2794 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...
The following partitions can't be recovered:
Partition Start End Size in sectors
HFS 91568 5860619695 5860528128
HFS 91680 5860619807 5860528128
HFS 91744 5860619871 5860528128
HFS 91776 5860619903 5860528128
HFS 91824 5860619951 5860528128
HFS 91880 5860620007 5860528128
HFS 92024 5860620151 5860528128
HFS 92088 5860620215 5860528128
HFS 92208 5860620335 5860528128
HFS 92320 5860620447 5860528128
HFS 92384 5860620511 5860528128
HFS 92448 5860620575 5860528128
HFS 92496 5860620623 5860528128
HFS 92624 5860620751 5860528128
HFS 92696 5860620823 5860528128
HFS 92808 5860620935 5860528128
HFS 92856 5860620983 5860528128
HFS 92976 5860621103 5860528128
HFS 93040 5860621167 5860528128
HFS 93120 5860621247 5860528128
HFS 93184 5860621311 5860528128
HFS 93248 5860621375 5860528128
HFS 93320 5860621447 5860528128
HFS 93432 5860621559 5860528128
HFS 93544 5860621671 5860528128
HFS 93576 5860621703 5860528128
[ Continue ]
HFS+ blocksize=8192, 3000 GB / 2794 GiB
Code: Select all
Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
Warning: the current number of heads per cylinder is 1
but the correct value may be 8.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlap.
[ Continue ]
Code: Select all
Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
Partition Start End Size in sectors
>* HFS 614448 2930302975 2929688528
P HFS 2930306128 2930568271 262144
P HFS 2930657736 5860363599 2929705864
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type,
Enter: to continue
HFS+ blocksize=4096 + Backup, 1500 GB / 1396 GiB
Writing this partition structure doesn't yield any changes - after restarting I still have the Backups partition and the two unmountable disk2s2/disk2s3 partitions. I haven't yet completed a Deeper Search to see if this yields results, as when I've tried to run this it has taken an extremely long time to scan through the disk, even after leaving it running overnight it was only about 1/5 done.
As TestDisk has suggested trying to alter the heads per cylinder, I have tried to do so via the Geometry menu by changing the value from 1 to 8, as so:
Code: Select all
Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors, sector size=512
Because these numbers change the way that TestDisk looks for partitions
and calculates their sizes, it's important to have the correct disk geometry.
PC partitioning programs often make partitions end on cylinder boundaries.
A partition's CHS values are based on disk translations which make them
different than its physical geometry. The most common CHS head values
are: 255, 240 and sometimes 16.
Enter the number of heads (1-255): 8
Code: Select all
Disk /dev/rdisk2 - 3000 GB / 2794 GiB - CHS 732566646 8 1
Current partition structure:
Partition Start End Size in sectors
1 * HFS 76806 0 1 366287871 7 1 2929688528
2 P HFS 366288266 0 1 366321033 7 1 262144
3 P HFS 366332217 0 1 732545449 7 1 2929705864
Code: Select all
Disk /dev/rdisk2 - 3000 GB / 2794 GiB - CHS 732566646 8 1
The harddisk (3000 GB / 2794 GiB) seems too small! (< 3000 GB / 2794 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...
The following partitions can't be recovered:
Partition Start End Size in sectors
HFS 11446 0 1 732577461 7 1 5860528128
HFS 11460 0 1 732577475 7 1 5860528128
HFS 11468 0 1 732577483 7 1 5860528128
HFS 11472 0 1 732577487 7 1 5860528128
HFS 11478 0 1 732577493 7 1 5860528128
HFS 11485 0 1 732577500 7 1 5860528128
HFS 11503 0 1 732577518 7 1 5860528128
HFS 11511 0 1 732577526 7 1 5860528128
HFS 11526 0 1 732577541 7 1 5860528128
HFS 11540 0 1 732577555 7 1 5860528128
HFS 11548 0 1 732577563 7 1 5860528128
HFS 11556 0 1 732577571 7 1 5860528128
HFS 11562 0 1 732577577 7 1 5860528128
HFS 11578 0 1 732577593 7 1 5860528128
HFS 11587 0 1 732577602 7 1 5860528128
HFS 11601 0 1 732577616 7 1 5860528128
HFS 11607 0 1 732577622 7 1 5860528128
HFS 11622 0 1 732577637 7 1 5860528128
HFS 11630 0 1 732577645 7 1 5860528128
HFS 11640 0 1 732577655 7 1 5860528128
HFS 11648 0 1 732577663 7 1 5860528128
HFS 11656 0 1 732577671 7 1 5860528128
HFS 11665 0 1 732577680 7 1 5860528128
HFS 11679 0 1 732577694 7 1 5860528128
HFS 11693 0 1 732577708 7 1 5860528128
HFS 11697 0 1 732577712 7 1 5860528128
[ Continue ]
HFS+ blocksize=8192, 3000 GB / 2794 GiB
Code: Select all
Disk /dev/rdisk2 - 3000 GB / 2794 GiB - CHS 732566646 8 1
Partition Start End Size in sectors
>* HFS 76806 0 1 366287871 7 1 2929688528
P HFS 366288266 0 1 366321033 7 1 262144
P HFS 366332217 0 1 732545449 7 1 2929705864
I should also note that after restarting and re-running TestDisk, the head number is reset to 1 again. I do not know if that is significant or intended behaviour of TestDisk.
Where I'm at now
As TestDisk was able to recover the "Backups" partition, I feel confident that the "Storage" partition is also recoverable. However, the steps which recovered Backups are not working in recovering Storage, and I'm not sure why.
I believe the 2 unreadable partitions are actually the Storage partition, and somehow are being misread as two separate partitions instead of one single partition. However, I know very little about hard drives beyond basic partitioning, so this is just a guess based on how TestDisk initially saw 4 partitions, and then after Backups was recovered 3 partitions remained, with the extra two being one very small partition and the other being the full 1.5TB.
I think that the key to fixing the remaining partition is in one of the two error messages I've received in this process:
- Warning: Bad starting head (CHS and LBA don't match)
Warning: the current number of heads per cylinder is 1 but the correct value may be 8.