Page 1 of 1

hfs+ image partition rewrite linux

Posted: 11 Jan 2013, 18:23
by kikker
Hi, I'm trying to help a friend recover her data.
The disk is 1TB in size and HFS+ formatted. I managed with photorec to recover probably most of the data, but it will of course be a mess to sort everything out. Not a huge problem but I am wondering if there's an easier/testdisk way which I may have missed to just recover the partition with directories etc.

With testdisk I can see the following disk (using an image file)

Image

I then write the updated partition table

Image

And finally try to mount the image

(the number 134250496 comes from 262208x512 (cylinder x size))

Code: Select all

# mount -t hfsplus -o ro,loop,offset=134250496  image.dd  /mnt/testmount
# cd /mnt/testmount
# ls -ltrha
total 81M
---------- 1 root root 4.0K Oct  5  2011 .journal_info_block
dr-xr-xr-t 1 root root    2 Oct  5  2011 .HFS+ Private Directory Data?
---------- 1 root root  80M Oct  5  2011 .journal
drwx------ 1   99   99    3 Oct  5  2011 .Spotlight-V100
drwxrwxr-x 1   99   99    9 Oct  5  2011 .
d-wx-wx-wt 1   99   99    2 Oct  5  2011 .Trashes
drwx------ 1   99   99    6 Oct  5  2011 .fseventsd
drwxr-xr-x 5 root root 4.0K Jan 11 18:04 ..
However, unfortunately it seems there is nothing there.
Upon deeper search testdisk also seems to show a load of other disks.. I'm not sure what they all are.
So my questions are
1) Is my method correct? Would it have shown the data if the parition/journal was not corrupted?
2) Would those other partitions offer any hope? Personally I don't see much point in going trough all of them, they seem more like a sign of some scattered/broken partition table.
Finally, just a note that someone else has been messing with the disk before me so (s)he might've (re)written partition tables possibly causing this long list of partition tables.

Thanks for any suggestions/comments !

Image