Please help recover Mac OS Extended partition Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
robertosc
Posts: 7
Joined: 10 Apr 2019, 11:30

Please help recover Mac OS Extended partition

#1 Post by robertosc » 11 Aug 2019, 02:43

Can you please help me recovering my backup HDD? I don't know how to proceed.

It's a WD Elements 1.5TB, one 1TB exFAT partition that successfully gets mounted and a 0.5TB that doesn't get mounted.

This is what I get when running fsck_hfs /dev/disk2s1:

Executing fsck_hfs (version hfs-366.70.3).
** Checking Journaled HFS Plus volume.
Invalid B-tree node size
(3, 0)
** The volume could not be verified completely.

This is the result of a deep search:
deep search.png
deep search.png (81.48 KiB) Viewed 2801 times
I see two repeated partitions. I think I'm supposed to mark one of them as primary and let the other be deleted, but I don't know which one to choose since I can't see files in HFS partitions.
What should I do?
Thank you!

Sponsored links

recuperation
Posts: 368
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Please help recover Mac OS Extended partition

#2 Post by recuperation » 11 Aug 2019, 07:40

The first partition labeled "Mac HFS" should be the right one because the second partition labeled "Mac HFS" overlaps with your partition that is 1TB big.

robertosc
Posts: 7
Joined: 10 Apr 2019, 11:30

Re: Please help recover Mac OS Extended partition

#3 Post by robertosc » 10 Dec 2019, 08:56

Thank you. I selected the first and thrid as Primary (for some reason Logical doesn't show up as an option for me) and later selected Write.
Restarted my computer but I'm getting the same result (the third gets mounted, the first doesn't).
I ran sudo fsck_hfs -r -d /dev/disk2s1 many times, and I always get:

Code: Select all

journal_replay(/dev/disk2s1) returned 0
** /dev/rdisk2s1
	Using cacheBlockSize=32K cacheTotalBlock=32768 cacheSize=1048576K.
   Executing fsck_hfs (version hfs-366.70.3).
** Checking Journaled HFS Plus volume.
   Invalid B-tree node size
(3, 0)
** The volume   could not be verified completely.
	volume check failed with error 7
	volume type is pure HFS+
	primary MDB is at block 0 0x00
	alternate MDB is at block 0 0x00
	primary VHB is at block 2 0x02
	alternate VHB is at block 894661246 0x3553727e
	sector size = 512 0x200
	VolumeObject flags = 0x07
	total sectors for volume = 894661248 0x35537280
	total sectors for embedded volume = 0 0x00
	CheckHFS returned -1317, fsmodified = 0
I have no idea what all this means and I'm completely stuck :(

recuperation
Posts: 368
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Please help recover Mac OS Extended partition

#4 Post by recuperation » 10 Dec 2019, 09:57

I don't know either. I am not familiar with HFS+ type partitions!

Run Testdisk and use the p-key to look inside the partitions to see if the content meets your expectations.
If that fails you can try "deep search" as well.

robertosc
Posts: 7
Joined: 10 Apr 2019, 11:30

Re: Please help recover Mac OS Extended partition

#5 Post by robertosc » 10 Dec 2019, 10:14

Testdisk is not able to see content inside HFS+ partitions, is it?

Those were the results of a deep search :(

recuperation
Posts: 368
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Please help recover Mac OS Extended partition

#6 Post by recuperation » 10 Dec 2019, 14:50

As for logical partitions, this is a term based on the definitions of the old school nested partition tables (primary partitions, extended partitions, logical partitions)
Youre drive is using the modern and better GPT scheme. There are no "logical" partitions anymore, as far as I know - I use legacy products with old structures. :P

I don't kow either if Testdisk is able to list directories of HFS+ partitions.
Without knowing this you could set the first MAC HFS partition to primary, save and restart or reconnect to an Apple computer.
Then you will see if an Apple computer lists the partition and content in there.

The next step is to set the first partition back to "deleted" and to set the second partition to "primary", write and restart or reconnect to see if your Apple computer can look into the second partition.

You should not set both of them simultaneously to "primary" because they are overlapping.

What confuses me is that your computer is mounting the 1TB partition although it is marked as deleted!

robertosc
Posts: 7
Joined: 10 Apr 2019, 11:30

Re: Please help recover Mac OS Extended partition

#7 Post by robertosc » 11 Dec 2019, 01:14

I tried to set the first MAC HFS and it didn't work, so will try to set the second as you said.
The problem is it takes days for Testdisk to find these partitions on deep search, is there a way to save a search so I can load and try multiple combinations?

I'm doing a deep search now... should be ready before the weekend.

Meanwhile, another question: I'm selecting "EFI GPT" for the disk type when I start Testdisk. That's the correct type, not "Intel", right? This is an external USB drive with a HFS+ and an ExFat partition, I don't understand what makes a disk be "EFI GPT" or "Intel"... :?
What confuses me is that your computer is mounting the 1TB partition although it is marked as deleted!
That's a screenshot from after a deep search. The PDF says chances are partitions will be listed as deleted after a search, so I guess that's what's happening.

recuperation
Posts: 368
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Please help recover Mac OS Extended partition

#8 Post by recuperation » 11 Dec 2019, 10:13

robertosc wrote:
11 Dec 2019, 01:14
I tried to set the first MAC HFS and it didn't work, so will try to set the second as you said.
The problem is it takes days for Testdisk to find these partitions on deep search, is there a way to save a search so I can load and try multiple combinations?
I don't think so.
I'm doing a deep search now... should be ready before the weekend.

Meanwhile, another question: I'm selecting "EFI GPT" for the disk type when I start Testdisk. That's the correct type, not "Intel", right? This is an external USB drive with a HFS+ and an ExFat partition, I don't understand what makes a disk be "EFI GPT" or "Intel"... :?
Obviously with two partitions on the drive somebody has modified the original partitioning scheme if this had been purchased as a preformatted external drive which usually contains one partition.

Your partitioning program should show this type of information somewhere.
With a total of 1,5TB disk space both schemes are possible.

If EFI GPT has been used, there is a traditional "Intel" scheme as well on disk. It contains one partition spanning the whole disk.
This is to inform dumb programs that only know the "Intel" structure that the disk is already in use.
If you find this information EFI GPT is very likely.

Post Reply