Page 1 of 1

Repair a HFS+ drive (windows)

Posted: 05 Feb 2015, 09:19
by Stemar
I have a MAC HFS+ formatted drive with my wedding pictures on them.

The disk itself is not found by windows with HFS explorer.
Through macdrive i was able to find the HDD, but can not read it.
Testdrive was able to find the HDD.

Because i want to restore my pictures i ran an Analyse and a quick search and these were the results.(see attachment for a screenshot from the partitions.)


Wed Feb 4 17:26:11 2015
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, January 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2015-01-19T21:26:37
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500000882688
filewin32_getfilesize(\\.\D:) GetFileSize err Onjuiste functie.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Onjuiste functie.

Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Onjuiste functie.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Onjuiste functie.

Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HTS727550A9E, S/N:3J2300288GV9A3, FW:JF3O
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - TOSHIBA External USB 3.0, S/N:22LIF93OS, FW:0001

Partition table type (auto): Mac
Disk /dev/sdb - 500 GB / 465 GiB - TOSHIBA External USB 3.0
Partition table type: Mac

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63

HFS+ magic value at 16/82/3

HFS+ magic value at 16/82/3
Current partition structure:
1 P partition_map 1 63 63
2 P Free 64 262207 262144
3 P HFS 262208 976773151 976510944
4 P Free 976773152 976773167 16

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
file_pread(5,16,buffer,2128(0/33/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2128(0/33/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2568(0/40/49)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2576(0/40/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2576(0/40/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,910(0/14/29)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,912(0/14/31)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,913(0/14/32)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,913(0/14/32)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,918(0/14/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,918(0/14/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,903(0/14/22)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,911(0/14/30)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,912(0/14/31)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,919(0/14/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,919(0/14/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,913(0/14/32)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,913(0/14/32)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2936(0/46/39)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2936(0/46/39)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,912(0/14/31)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,912(0/14/31)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,913(0/14/32)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,913(0/14/32)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,6,buffer,914(0/14/33)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,3120(0/49/34)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,3128(0/49/42)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,3128(0/49/42)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,3280(0/52/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,3280(0/52/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,3288(0/52/13)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,3296(0/52/21)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,3296(0/52/21)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1609(0/25/35)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1617(0/25/43)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,1624(0/25/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1625(0/25/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,1625(0/25/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1630(0/25/56)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,1630(0/25/56)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1615(0/25/41)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1623(0/25/49)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,1624(0/25/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1631(0/25/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,1631(0/25/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1625(0/25/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

[lots of DATA]...

file_pread(5,1,buffer,2129(0/33/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2134(0/33/56)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2134(0/33/56)) ReadFile Gegevensfout (cyclische redundantiecontrole)

NTFS at 0/32/33
filesystem size 976769072
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
Unknown 2048 976771119 976769072
NTFS, blocksize=4096, 500 GB / 465 GiB
Partition not added.
file_pread(5,16,buffer,2127(0/33/49)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2128(0/33/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2135(0/33/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2135(0/33/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2129(0/33/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2129(0/33/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2128(0/33/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2128(0/33/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2129(0/33/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2129(0/33/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,6,buffer,2130(0/33/52)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,4312(0/68/29)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,4312(0/68/29)) ReadFile Gegevensfout (cyclische redundantiecontrole)

[even more DATA. all the way from 4300 to 25000]


file_pread(5,1,buffer,252944(15/189/63)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,252951(15/190/7)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,252951(15/190/7)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,252945(15/190/1)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,252945(15/190/1)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,252943(15/189/62)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,252944(15/189/63)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,252944(15/189/63)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,252945(15/190/1)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,252945(15/190/1)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,6,buffer,252946(15/190/2)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257208(16/2/43)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257216(16/2/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257216(16/2/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257224(16/2/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257232(16/3/4)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257232(16/3/4)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257201(16/2/36)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257209(16/2/44)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257217(16/2/52)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257225(16/2/60)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257232(16/3/4)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257233(16/3/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257233(16/3/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257238(16/3/10)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257238(16/3/10)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257223(16/2/58)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257231(16/3/3)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257232(16/3/4)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257239(16/3/11)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257239(16/3/11)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257233(16/3/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257233(16/3/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259240(16/34/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259240(16/34/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257224(16/2/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257227(16/2/62)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257232(16/3/4)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257232(16/3/4)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257233(16/3/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257233(16/3/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,6,buffer,257234(16/3/6)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259238(16/34/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259240(16/34/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,8,buffer,259241(16/34/60)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259231(16/34/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259239(16/34/58)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259240(16/34/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259247(16/35/3)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259247(16/35/3)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259241(16/34/60)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259241(16/34/60)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259337(16/36/30)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259345(16/36/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259345(16/36/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259240(16/34/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259240(16/34/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259350(16/36/43)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259350(16/36/43)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259241(16/34/60)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259241(16/34/60)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,6,buffer,259242(16/34/61)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259351(16/36/44)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259351(16/36/44)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259345(16/36/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259345(16/36/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259331(16/36/24)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259336(16/36/29)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259345(16/36/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259345(16/36/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,6,buffer,259346(16/36/39)) ReadFile Gegevensfout (cyclische redundantiecontrole)


HFS+ magic value at 16/82/3

HFS+ magic value at 16/82/3
part_size 976510944
HFS 262208 976773151 976510944
HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB
file_pread(5,3,buffer,976773168(60801/81/1)) ReadFile Het station kan de aangevraagde sector niet vinden.

file_pread(5,1,buffer,976773168(60801/81/1)) ReadFile Het station kan de aangevraagde sector niet vinden.

file_pread(5,3,buffer,976773215(60801/81/48)) lseek err Invalid argument
file_pread(5,8,buffer,976773231(60801/82/1)) lseek err Invalid argument
file_pread(5,11,buffer,976773278(60801/82/48)) lseek err Invalid argument
file_pread(5,2,buffer,976775200(60801/113/17)) lseek err Invalid argument
file_pread(5,7,buffer,976773169(60801/81/2)) lseek err Invalid argument
file_pread(5,3,buffer,976773176(60801/81/9)) lseek err Invalid argument
file_pread(5,3,buffer,976773223(60801/81/56)) lseek err Invalid argument
file_pread(5,8,buffer,976773239(60801/82/9)) lseek err Invalid argument
file_pread(5,8,buffer,976773289(60801/82/59)) lseek err Invalid argument
file_pread(5,2,buffer,976775208(60801/113/25)) lseek err Invalid argument
file_pread(5,5,buffer,976773179(60801/81/12)) lseek err Invalid argument
file_pread(5,3,buffer,976773184(60801/81/17)) lseek err Invalid argument
file_pread(5,8,buffer,976773247(60801/82/17)) lseek err Invalid argument
file_pread(5,8,buffer,976773297(60801/83/4)) lseek err Invalid argument
file_pread(5,2,buffer,976775216(60801/113/33)) lseek err Invalid argument

Results
P HFS 262208 976773151 976510944
HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB

P HFS 262208 976773151 976510944
HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB
Support for this filesystem hasn't been enable during compilation.

interface_write()
P HFS 262208 976773151 976510944
Do i perform a deep search and write the partition tables or is that dangerous?
The most important data on the hard drive are the pictures.