I'm stuck. This can't be the end.

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
mattsoule
Posts: 6
Joined: 12 Nov 2017, 02:51

I'm stuck. This can't be the end.

#1 Post by mattsoule »

Ok, here we go.

There is a Folder I need to recover off of a 4tb external drive that was originally formatted Mac-Journaled. Here's what happened:

I mistakenly attempted to erase the disk through Disk Utility. However, there was an error. The disk was not re-formatted. However, after this error, the partition (named SFX) would not mount. In addition, Disk Utility could see the disk, but the partition to mount was greyed-out and listed as "unknown" Yet, when I would do s disk util list command in the Terminal. . I could see the "name" of the partition (SFX).

My first step was to attempt a fsck repair. However, this was unsuccessful and nothing changed. This is when I discovered TestDisk, and hoped it would make the save.

After discovering through trial and error that Testdisk could not analyze a HFS partition or see it's filesystem, I tried to write the Partition I did see through the Analyze menu. I could see my "SFX" partition. In fact, it was listed twice, and I followed all the various step by step instructions I could find, and attempted to re-write the partition structure.

Now when I opened Disk Utility it would see my drive again, however when I would attempt a disk verify or "first aid" I would receive a invalid b-tree node error.

My trouble shooting continued. I tried changing the partition type through TestDisk to possibly try to see my data. This was probably a bad move, but there aren't very straight forward instructions out there for a noob such as myself. I changed the type to MS Data. Now when I attempted to mount the disk, I would get the "This drive must be initialized" warning. I would hit ignore, crack open Testdisk and try some more stuff.

I changed the partition back to HFS and made an image of my entire 4tb drive. This took 3 days. At the end of it, I received a warning saying that the drive I was copying to was not large enough (even though it was a 4Tb drive.) However the 4Tb image.DD file was there. I renamed it dmg, and double clicked- The warning I got was that it did not recognize the Filesystem. I could not mount the image.

At this point, I was kind of desperate here and trying a lot of things, so my memory is a bit fuzzy. I tried using testDisk on the image, but I could not get it to work. So now, the drive still will not mount. I am currently running another "Deeper search" one last time. It seems that I am running into a bad sector as well. I plan on posting the log from this attempt when it's done, but if anyone has any insight on what I could do with the disk OR the image at this point, it would be greatly appreciated.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: I'm stuck. This can't be the end.

#2 Post by cgrenier »

Try PhotoRec. It will be hard to sort all the recovered files but it may recover your lost files.

mattsoule
Posts: 6
Joined: 12 Nov 2017, 02:51

Re: I'm stuck. This can't be the end.

#3 Post by mattsoule »

cgrenier wrote: 13 Nov 2017, 07:06 Try PhotoRec. It will be hard to sort all the recovered files but it may recover your lost files.
The log is too large to put in this content window. Is there a different way I can attach it?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: I'm stuck. This can't be the end.

#4 Post by cgrenier »

If necessary, you can share your log file using pastebin, google drive...

mattsoule
Posts: 6
Joined: 12 Nov 2017, 02:51

Re: I'm stuck. This can't be the end.

#5 Post by mattsoule »


mattsoule
Posts: 6
Joined: 12 Nov 2017, 02:51

Re: I'm stuck. This can't be the end.

#6 Post by mattsoule »

So, any chance there was something in the log that caught your attention? Perhaps something I could do differently?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: I'm stuck. This can't be the end.

#7 Post by cgrenier »

The HFS+ superblock and its backup are ok.
What is the output of "sudo fsck /dev/disk1s1" ? (Replace /dev/disk1s1 by the correct device as listed by "sudo diskutil list").

If you get Invalid b-tree node size, you can try

Code: Select all

sudo fsck_hfs -r -d /dev/disk1s1

mattsoule
Posts: 6
Joined: 12 Nov 2017, 02:51

Re: I'm stuck. This can't be the end.

#8 Post by mattsoule »

Here is the fsck output: Image

https://imgur.com/a/dZv2N

mattsoule
Posts: 6
Joined: 12 Nov 2017, 02:51

Re: I'm stuck. This can't be the end.

#9 Post by mattsoule »

Any thoughts on the output?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: I'm stuck. This can't be the end.

#10 Post by cgrenier »

Try the fsck_hfs command several times. If nothing changes, use PhotoRec to recover your data.

Locked