Recover Mac partition on external HDD

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
CMvar
Posts: 1
Joined: 04 Jan 2020, 06:13

Recover Mac partition on external HDD

#1 Post by CMvar »

Please help with recovery of a Mac partition on an external HDD. I have been told it is an encrypted partition and I am not sure as to how to continue.

Here is the contents of Testdisk.log:

Wed Jan 1 19:11:46 2020
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.3.13-200.fc30.x86_64 (#1 SMP Mon Nov 25 23:02:12 UTC 2019) x86_64
Compiler: GCC 9.1
ext2fs lib: 1.44.6, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
/dev/mapper/fedora30-home: LBA, HPA, LBA48, DCO support
/dev/mapper/fedora30-home: size 31457280 sectors
/dev/mapper/fedora30-home: user_max 976773168 sectors
/dev/mapper/fedora30-home: native_max 976773168 sectors
/dev/mapper/fedora30-root: LBA, HPA, LBA48, DCO support
/dev/mapper/fedora30-root: size 20971520 sectors
/dev/mapper/fedora30-root: user_max 976773168 sectors
/dev/mapper/fedora30-root: native_max 976773168 sectors
/dev/mapper/fedora30-swap: LBA, HPA, LBA48, DCO support
/dev/mapper/fedora30-swap: size 4194304 sectors
/dev/mapper/fedora30-swap: user_max 976773168 sectors
/dev/mapper/fedora30-swap: native_max 976773168 sectors
/dev/mapper/fedora30-var: LBA, HPA, LBA48, DCO support
/dev/mapper/fedora30-var: size 20971520 sectors
/dev/mapper/fedora30-var: user_max 976773168 sectors
/dev/mapper/fedora30-var: native_max 976773168 sectors
/dev/dm-0: LBA, HPA, LBA48, DCO support
/dev/dm-0: size 20971520 sectors
/dev/dm-0: user_max 976773168 sectors
/dev/dm-0: native_max 976773168 sectors
/dev/dm-1: LBA, HPA, LBA48, DCO support
/dev/dm-1: size 4194304 sectors
/dev/dm-1: user_max 976773168 sectors
/dev/dm-1: native_max 976773168 sectors
/dev/dm-2: LBA, HPA, LBA48, DCO support
/dev/dm-2: size 31457280 sectors
/dev/dm-2: user_max 976773168 sectors
/dev/dm-2: native_max 976773168 sectors
/dev/dm-3: LBA, HPA, LBA48, DCO support
/dev/dm-3: size 20971520 sectors
/dev/dm-3: user_max 976773168 sectors
/dev/dm-3: native_max 976773168 sectors
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000BPVT-75A1YT0, S/N:WX91C12C3711, FW:01.01A01
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729601 255 63, sector size=512 - WDC WD60 EFRX-68MYMN1, FW:82.0
Disk /dev/mapper/fedora30-home - 16 GB / 15 GiB - 31457280 sectors, sector size=512 - WDC WD5000BPVT-75A1YT0, S/N:WX91C12C3711, FW:01.01A01
Disk /dev/mapper/fedora30-root - 10 GB / 10 GiB - 20971520 sectors, sector size=512 - WDC WD5000BPVT-75A1YT0, S/N:WX91C12C3711, FW:01.01A01
Disk /dev/mapper/fedora30-swap - 2147 MB / 2048 MiB - 4194304 sectors, sector size=512 - WDC WD5000BPVT-75A1YT0, S/N:WX91C12C3711, FW:01.01A01
Disk /dev/mapper/fedora30-var - 10 GB / 10 GiB - 20971520 sectors, sector size=512 - WDC WD5000BPVT-75A1YT0, S/N:WX91C12C3711, FW:01.01A01
Disk /dev/dm-0 - 10 GB / 10 GiB - 20971520 sectors, sector size=512 - WDC WD5000BPVT-75A1YT0, S/N:WX91C12C3711, FW:01.01A01
Disk /dev/dm-1 - 2147 MB / 2048 MiB - 4194304 sectors, sector size=512 - WDC WD5000BPVT-75A1YT0, S/N:WX91C12C3711, FW:01.01A01
Disk /dev/dm-2 - 16 GB / 15 GiB - 31457280 sectors, sector size=512 - WDC WD5000BPVT-75A1YT0, S/N:WX91C12C3711, FW:01.01A01
Disk /dev/dm-3 - 10 GB / 10 GiB - 20971520 sectors, sector size=512 - WDC WD5000BPVT-75A1YT0, S/N:WX91C12C3711, FW:01.01A01

Partition table type (auto): EFI GPT
Disk /dev/sdb - 6001 GB / 5589 GiB - WDC WD60 EFRX-68MYMN1
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729601 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11721045167 (expected 11721045167)
hdr_lba_start=34
hdr_lba_end=11721045134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 34 409633 409600 [EFI System Partition]
2 P Mac HFS 9031552 11719396991 11710365440

search_part()
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729601 255 63
FAT32 at 0/0/35
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT32 at 0/0/35
EFI System 34 409633 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

recover_EXT2: s_block_group_nr=0/15, s_mnt_count=29/35, s_blocks_per_group=32768, s_inodes_per_group=7824
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 499952
recover_EXT2: part_size 3999616
Filesystem created: Mon Jun 30 17:48:09 2014
Last mount time: Tue Dec 31 19:42:35 2019
Linux filesys. data 1032192 5031807 3999616
ext3 blocksize=4096 Large_file Sparse_SB, 2047 MB / 1952 MiB

Raid magic value at 313/54/62
Raid apparent size: 3999616 sectors
Raid chunk size: 0 bytes
md127 md 0.90.0 L.Endian Raid 1: devices 0(8,18)* 1(8,19)
Linux Raid 1032192 5031935 3999744 [md127]
md 0.90.0 L.Endian Raid 1: devices 0(8,18)* 1(8,19), 2047 MB / 1953 MiB

recover_EXT2: s_block_group_nr=0/15, s_mnt_count=27/35, s_blocks_per_group=32768, s_inodes_per_group=7824
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 499952
recover_EXT2: part_size 3999616
Filesystem created: Mon Jun 30 17:48:09 2014
Last mount time: Tue Dec 31 19:42:35 2019
Linux filesys. data 5031936 9031551 3999616
ext3 blocksize=4096 Large_file Sparse_SB, 2047 MB / 1952 MiB

Raid magic value at 562/47/62
Raid apparent size: 3999616 sectors
Raid chunk size: 0 bytes
md127 md 0.90.0 L.Endian Raid 1: devices 0(8,18) 1(8,19)* 83908680(6291584,1801679718)
Linux Raid 5031936 9031679 3999744 [md127]
md 0.90.0 L.Endian Raid 1: devices 0(8,18) 1(8,19)* 83908680(6291584,1801679718), 2047 MB / 1953 MiB
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 631394567 24542084784607494 24542084153212928 [_âž+%•r
@Påk5·Ìo®döào†í5RSÑ+]
BeFS blocksize=128, 12565547 TB / 11428298 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

LVM magic value at 58463/145/19

LVM magic value at 77304/7/4
check_FAT: Bad jump in FAT partition
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 1361781566 14572928476324669 14572927114543104 [éÓùïVd*Mœ“ˆ ^bÕ}ˆoŠ–.Ôá¯Ç8ú<k­]
BeFS blocksize=262144, 7461338 TB / 6786048 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad number of sectors per cluster
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 1607129297 155032746645712 155031139516416 [(J£œaYÉpƒ}ÙG>LÜ(n€Šõ LL8ªÂ»Ú]
BeFS blocksize=131072, 79375 TB / 72192 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad number of sectors per cluster
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition

LVM magic value at 153047/135/4
check_FAT: Bad jump in FAT partition
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 3913727831 23206321685357398 23206317771629568 [Dvá#©+©Ó‹ÒÝDRaz>ÿ_kó«£~þOØÍn[Œ]
BeFS blocksize=131072, 11881634 TB / 10806283 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad number of sectors per cluster
check_FAT: Bad number of sectors per cluster

SYSV4 Marker at 302165/222/56

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 4854294766 1393920119318765 1393915265024000 [ˆ£æ4;g]
SysV4, 713684 TB / 649092 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad number of sectors per cluster

cramfs Marker at 370344/123/31

recover_cramfs
Linux filesys. data 5949584139 5952216854 2632715 [‡ÅoKÑG;Ÿr°ÔÅ]
cramfs, 1347 MB / 1285 MiB

SYSV4 Marker at 371610/73/4

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 5969919252 523124559123 517154639872 [:ȉY^N]
SysV4, 264 TB / 240 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad number of sectors per cluster

SYSV4 Marker at 385829/125/58

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 6198350817 2638481990624 2632283639808 [$Â3§è!]
SysV4, 1347 TB / 1225 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

0 0000 0000 00 00 00 00 00 00 00 00
Unknown 6202018168 9007205456759159 9007199254740992
WBFS, 4611686 TB / 4194304 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad number of sectors per cluster

LVM magic value at 433952/101/51

SYSV4 Marker at 442575/207/4

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 7109980419 7109980418 0 [rV|ñ±Å]
SysV4, 0 B
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad jump in FAT partition
check_FAT: Bad number of sectors per cluster
check_FAT: Bad number of sectors per cluster

0 0000 0000 00 00 00 00 00 00 00 00
Unknown 7782789030 12170387737800613 12170379955011584
WBFS, 6231234 TB / 5667274 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

LVM magic value at 535297/1/44
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 9484823696 34553781321919631 34553771837095936 [Ò}þRH±6!_g4ôó®&u9¥#Ž3;i‘ҏ©1]
BeFS blocksize=32, 17691531 TB / 16090353 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad jump in FAT partition

cramfs Marker at 632949/214/55

recover_cramfs
Linux filesys. data 10168339221 10173143269 4804048 [Š³mû1ÜthÓœ·F¶$¥ë]
cramfs, 2459 MB / 2345 MiB
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 11474586770 12879712315 1405125546
FATX, 719 GB / 670 GiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad jump in FAT partition

HFSX magic value at 729568/154/55
part_size 11710365440
Mac HFS 11720519676 23430885115 11710365440
HFSX blocksize=8192, 5995 GB / 5583 GiB
This partition ends after the disk limits. (start=11720519676, size=11710365440, end=23430885115, disk end=11721045168)

HFSX magic value at 729568/154/57
part_size 11710365440
Mac HFS 10154240 11720519679 11710365440
HFS+ found using backup sector!, 5995 GB / 5583 GiB

HFS+ magic value at 729568/154/59

HFS+ magic value at 729568/154/59
part_size 262144
Mac HFS 11720519680 11720781823 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (6001 GB / 5589 GiB) seems too small! (< 11 TB / 10 TiB)
The following partition can't be recovered:
Mac HFS 11720519676 23430885115 11710365440
HFSX blocksize=8192, 5995 GB / 5583 GiB

Results
P EFI System 34 409633 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
Linux filesys. data 1032192 5031807 3999616
ext3 blocksize=4096 Large_file Sparse_SB, 2047 MB / 1952 MiB
Linux Raid 1032192 5031935 3999744 [md127]
md 0.90.0 L.Endian Raid 1: devices 0(8,18)* 1(8,19), 2047 MB / 1953 MiB
Linux filesys. data 5031936 9031551 3999616
ext3 blocksize=4096 Large_file Sparse_SB, 2047 MB / 1952 MiB
Linux Raid 5031936 9031679 3999744 [md127]
md 0.90.0 L.Endian Raid 1: devices 0(8,18) 1(8,19)* 83908680(6291584,1801679718), 2047 MB / 1953 MiB
Mac HFS 10154240 11720519679 11710365440
HFS+ found using backup sector!, 5995 GB / 5583 GiB
Linux filesys. data 5949584139 5952216854 2632716 [‡ÅoKÑG;Ÿr°ÔÅ]
cramfs, 1347 MB / 1285 MiB
Linux filesys. data 10168339221 10173143269 4804049 [Š³mû1ÜthÓœ·F¶$¥ë]
cramfs, 2459 MB / 2345 MiB
P Mac HFS 11720519680 11720781823 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 409600 linear /dev/sdb 34" | dmsetup create test0
echo "0 3999616 linear /dev/sdb 1032192" | dmsetup create test1
echo "0 3999744 linear /dev/sdb 1032192" | dmsetup create test2
echo "0 3999616 linear /dev/sdb 5031936" | dmsetup create test3
echo "0 3999744 linear /dev/sdb 5031936" | dmsetup create test4
echo "0 11710365440 linear /dev/sdb 10154240" | dmsetup create test5
echo "0 2632716 linear /dev/sdb 5949584139" | dmsetup create test6
echo "0 4804049 linear /dev/sdb 10168339221" | dmsetup create test7
echo "0 262144 linear /dev/sdb 11720519680" | dmsetup create test8

P Mac HFS 11720519680 11720781823 262144
HFS+ blocksize=4096 + Backup, 134 MB / 128 MiB
Support for this filesystem hasn't been implemented.

Mac HFS 10154240 11720519679 11710365440
HFS+ found using backup sector!, 5995 GB / 5583 GiB

Support for this filesystem hasn't been implemented.

Linux Raid 5031936 9031679 3999744 [md127]
md 0.90.0 L.Endian Raid 1: devices 0(8,18) 1(8,19)* 83908680(6291584,1801679718), 2047 MB / 1953 MiB
Support for this filesystem hasn't been implemented.


dir_partition inode=2
Linux filesys. data 5031936 9031551 3999616
ext3 blocksize=4096 Large_file Sparse_SB, 2047 MB / 1952 MiB
Directory /
2 drwxr-xr-x 0 0 4096 21-Jul-2017 05:03 .
2 drwxr-xr-x 0 0 4096 21-Jul-2017 05:03 ..
11 drwx------ 0 0 16384 30-Jun-2014 17:48 lost+found
7825 drwxr-xr-x 0 0 4096 30-Jun-2014 17:49 bin
15649 drwxr-xr-x 0 0 4096 30-Jun-2014 17:40 boot
78241 drwxr-xr-x 0 0 4096 3-Jun-2013 17:00 dev
39121 drwxr-xr-x 0 0 4096 21-Jul-2017 05:03 etc
23473 drwxr-xr-x 0 0 4096 10-Sep-2013 01:54 home
31297 drwxr-xr-x 0 0 4096 30-Jun-2014 17:42 lib
54769 drwxr-xr-x 0 0 4096 28-Sep-2013 00:42 media
62593 drwxr-xr-x 0 0 4096 10-Sep-2013 01:54 mnt
70417 drwxr-xr-x 0 0 4096 28-Sep-2013 00:42 opt
86065 drwxr-xr-x 0 0 4096 10-Sep-2013 01:54 proc
101713 drwx------ 0 0 4096 30-Jun-2014 17:40 root
93889 drwxr-xr-x 0 0 4096 12-Jul-2012 20:25 run
109537 drwxr-xr-x 0 0 4096 30-Jun-2014 17:42 sbin
7927 drwxr-xr-x 0 0 4096 10-Sep-2013 02:06 selinux
54770 drwxr-xr-x 0 0 4096 30-Jun-2014 17:45 srv
15651 drwxr-xr-x 0 0 4096 10-Sep-2013 01:54 sys
86066 drwxrwxrwt 0 0 4096 21-Jul-2017 05:02 tmp
101717 drwxr-xr-x 0 0 4096 30-Jun-2014 17:46 usr
46945 drwxr-xr-x 0 0 4096 30-Jun-2014 17:50 var
70418 drwxr-xr-x 0 0 4096 12-Jul-2012 20:37 DataVolume
78288 drwxr-xr-x 0 0 4096 30-Jun-2014 17:48 CacheVolume
2223 lrwxrwxrwx 0 0 18 21-Jul-2017 05:03 shares
86067 drwxr-xr-x 0 0 4096 21-Jul-2017 05:03 nfs

interface_write()
1 P EFI System 34 409633 409600 [EFI System Partition] [EFI]
2 P Mac HFS 11720519680 11720781823 262144

interface_write()
1 P EFI System 34 409633 409600 [EFI System Partition] [EFI]
2 P Mac HFS 10154240 11720519679 11710365440
3 P Mac HFS 11720519680 11720781823 262144
A number of Linux partitions showed up and I can view these files but it is the Mac partitions I am interested in. I suspect the partition I have marked in bold is the one I am looking for.

I have not yet run a deed search. The search takes a few days to run.

Any advice would be greatly appreciated.

Locked