The following parition can't be recovered

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
beckyl
Posts: 3
Joined: 12 Feb 2020, 03:08

The following parition can't be recovered

#1 Post by beckyl »

I have accidentally deleted my MS bootcamp partition on my Mac and wish to restore it. I have completed the Analyse function and there is one partition listed and can't be recovered. Unfortunately, this is the partition that I want to recover.

I am a total noob and I tried to search in the forum for an answer, and I found some relating to the same subject but I couldn't understand the instruction. Please help. Thanks in advance for your help

Image

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 5289
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: The following parition can't be recovered

#2 Post by cgrenier »

NTFS partition may be listed twice, once at the correct location, once at a shifted offset.
So continue on next screen, you may find your missing partition.

beckyl
Posts: 3
Joined: 12 Feb 2020, 03:08

Re: The following parition can't be recovered

#3 Post by beckyl »

Hi,

Sorry for the long delay. I was waiting for the arrival of my new disk to backup my Mac before proceeding.

My MAC filesystem is APFS (encypted) and I am currently using Mojave. My Mac hdd is 500gb of which 100gb is Bootcamp and 400GB is OSX. After I realised I have deleted the partition via Bootcamp Assistant, there was a pop up message saying the erased partition could not merge into 1 disk. Currently, my Bootcamp space (100GB) is missing.

When I was running TestDisk, there was also a warning that TestDisk would not be able to write on my disk.

I have gone as far as Deep Search and please find the attached log file for your reference. I couldn't list the files for MS Data in both searches because apparently, the filesystem has been damaged.

Your help is very much appreciated as I have important work files in there which I hope I can recover. Thanks very much.

LOG FILE

Code: Select all

Mon Feb 17 16:35:17 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 18.7.0 (Darwin Kernel Version 18.7.0: Tue Aug 20 16:57:14 PDT 2019; root:xnu-4903.271.2~2/RELEASE_X86_64) x86_64
Compiler: GCC 4.0
Compilation date: 2020-01-26T20:59:54
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors (RO), sector size=512
Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors (RO), sector size=512
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO), sector size=512
Disk /dev/rdisk1 - 400 GB / 372 GiB - 97656315 sectors (RO), sector size=4096
Disk /dev/rdisk2 - 2000 GB / 1863 GiB - 3907029167 sectors (RO), sector size=512

Partition table type (auto): EFI GPT
Media is opened in read-only.
Disk /dev/rdisk0 - 500 GB / 465 GiB (RO)
Partition table type: EFI GPT

Analyse Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=977105059 (expected 977105059)
hdr_lba_start=34
hdr_lba_end=977105026
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P EFI System                    40     409639     409600 [EFI System Partition]
 2 P Apple APFS                409640  781660159  781250520 [Customer]

search_part()
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
     EFI System                    40     409639     409600 [EFI System Partition] [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
check_FAT: Bad number of sectors per cluster
NTFS at 977104895/0/1
heads/cylinder 0 (NTFS) != 1 (HD)
sect/track 0 (NTFS) != 1 (HD)
filesystem size           195444736
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               12215295
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                781660160  977104895  195444736
     NTFS found using backup sector, blocksize=4096, 100 GB / 93 GiB
NTFS at 977104895/0/1
heads/cylinder 0 (NTFS) != 1 (HD)
sect/track 0 (NTFS) != 1 (HD)
filesystem size           195444736
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               12215295
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                977104895 1172549630  195444736
     NTFS, blocksize=4096, 100 GB / 93 GiB
This partition ends after the disk limits. (start=977104895, size=195444736, end=1172549630, disk end=977105060)
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 600 GB / 559 GiB)
The following partition can't be recovered:
     MS Data                977104895 1172549630  195444736
     NTFS, blocksize=4096, 100 GB / 93 GiB

Results
   P EFI System                    40     409639     409600 [EFI System Partition] [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
   P MS Data                781660160  977104895  195444736
     NTFS found using backup sector, blocksize=4096, 100 GB / 93 GiB
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error

   P MS Data                781660160  977104895  195444736
     NTFS found using backup sector, blocksize=4096, 100 GB / 93 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 P EFI System                    40     409639     409600 [EFI System Partition] [EFI]
 2 P MS Data                781660160  977104895  195444736

search_part()
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
     EFI System                    40     409639     409600 [EFI System Partition] [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
FAT32 at 46/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 46/0/1
     EFI System                    46     409645     409600 [EFI System Partition] [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
check_FAT: Bad number of sectors per cluster
NTFS at 977104895/0/1
heads/cylinder 0 (NTFS) != 1 (HD)
sect/track 0 (NTFS) != 1 (HD)
filesystem size           195444736
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               12215295
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                781660160  977104895  195444736
     NTFS found using backup sector, blocksize=4096, 100 GB / 93 GiB
NTFS at 977104895/0/1
heads/cylinder 0 (NTFS) != 1 (HD)
sect/track 0 (NTFS) != 1 (HD)
filesystem size           195444736
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               12215295
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                977104895 1172549630  195444736
     NTFS, blocksize=4096, 100 GB / 93 GiB
This partition ends after the disk limits. (start=977104895, size=195444736, end=1172549630, disk end=977105060)
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 600 GB / 559 GiB)
The following partition can't be recovered:
     MS Data                977104895 1172549630  195444736
     NTFS, blocksize=4096, 100 GB / 93 GiB

Results
     EFI System                    40     409639     409600 [EFI System Partition] [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
     EFI System                    46     409645     409600 [EFI System Partition] [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
   P MS Data                781660160  977104895  195444736
     NTFS found using backup sector, blocksize=4096, 100 GB / 93 GiB
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
Screenshots after DeepSearch

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)

The harddisk (500 GB / 465 GiB) seems too small! (< 600 GB / 559 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...

The following partition can't be recovered:
     Partition               Start        End    Size in sectors
>  MS Data                977104895 1172549630  195444736










[ Continue ]
NTFS, blocksize=4096, 100 GB / 93 GiB



-----------------------------------------------------------------------------
TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)
     Partition               Start        End    Size in sectors
 D EFI System                    40     409639     409600 [EFI System Partition]
 D EFI System                    46     409645     409600 [EFI System Partition]
>P MS Data                781660160  977104895  195444736









Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
NTFS found using backup sector, blocksize=4096, 100 GB / 93 GiB

--------------------------------------------------------------------------------

TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

   P MS Data                781660160  977104895  195444736



Can't open filesystem. Filesystem seems damaged.













>[  Quit  ]
                               Quit this section

beckyl
Posts: 3
Joined: 12 Feb 2020, 03:08

Re: The following parition can't be recovered

#4 Post by beckyl »

Not sure if it will help, when i list the files on the 1st D EFI Partition, it brings me to P MS Data again. For the 2nd partition, there were a whole bunch of funny character files which were created not at the times when i had the Bootcamp.

Should i try again with the cloned external hard disk? Cos i duno how to unmount the Mac when im still using it to recover my files...

Post Reply