non-bootable macbook hd

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
ytsurk
Posts: 2
Joined: 22 Feb 2019, 22:33

non-bootable macbook hd

#1 Post by ytsurk »

Hello,

nice tool :D thx
I'm not really into partitioning / filesystems ..

I got this disk from a macbook (unsure about it's OSX version, probably an older one) connected to ubuntu and run test disk, advanced search,
and have the feeling that the cause of the non-bootable disk can be described with it's output.

But I dont understand .. it - I also used photo rec, and it recovered me files, it did like never end,
always almost at the 100% it found some new "sectors". i'm looking for psd files, but there were only jpegs, pngs, mp3s etc.,
i aborted the photo rec run.

so here's that output:

Code: Select all

Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63
     Partition               Start        End    Size in sectors
 D EFI System                    40     409639     409600 [EFI System Partition] [EFI]
 D EFI System                    46     409645     409600 [EFI System Partition] [EFI]
 D Mac HFS                 55777007   55949061     172055 [^?~Dst�^S~H~P3I~D�~s^B~G�g^D�b^N~S[^^~S]
 D Mac HFS                 55949058   56121112     172055 [^?~Dst�^S~H~P3I~D�~s^B~G�g^D�b^N~S[^^~S]
 D Mac HFS                 65898024   82956179   17058156
 D Mac HFS                 69974679   70146733     172055 [^?~Dst�^S~H~P3I~D�~s^B~G�g^D�b^N~S[^^~S]
 D Mac HFS                 70146730   70318784     172055 [^?~Dst�^S~H~P3I~D�~s^B~G�g^D�b^N~S[^^~S]
 D Mac HFS                 79133932   80928483    1794552
 D Mac HFS                 80928480   82723031    1794552
 D Mac HFS                 80928496   82723047    1794552
 D Mac HFS                 82723044   84517595    1794552
 D Mac HFS                 82956176  100014331   17058156
 ...
 
any hint is appreciated

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: non-bootable macbook hd

#2 Post by cgrenier »

The whole testdisk.log file is needed, otherwise we can't see the actual partition table.
Have you tried to repair the filesystem as described in https://www.cgsecurity.org/testdisk.pdf ?

ytsurk
Posts: 2
Joined: 22 Feb 2019, 22:33

Re: non-bootable macbook hd

#3 Post by ytsurk »

Thanks for your answer Christophe,
Sorry for my poor post, but I'm totally new in this field .. and am a bit over strained,
and not in trail-n-error mode, as I don't want to destroy the disk ..

As far as I understand, I could write this deeper analyzation structure back to the disk.
also I was unsettled because of the false-encoded characters, but I guess this is mac<>ubuntu related.

I could not repair the disk with diskutils on the macbook, as the drive was not mounted.
Running fsck on the ubuntu machine, the disk is plugged in now i get:

Code: Select all

fsck from util-linux 2.31.1
e2fsck 1.44.1 (24-Mar-2018)
ext2fs_open2: Bad magic number in super-block
fsck.ext2: Superblock invalid, trying backup blocks...
fsck.ext2: Bad magic number in super-block while trying to open /dev/sdb

The superblock could not be read or does not describe a valid ext2/ext3/ext4
filesystem.  If the device is valid and it really contains an ext2/ext3/ext4
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>
 or
    e2fsck -b 32768 <device>

Found a gpt partition table in /dev/sdb
using fsck.hfsplus i get this:

Code: Select all

    sudo fsck.hfsplus -d /dev/sdb
    ** /dev/sdb
    	Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
    	Block 2 is not an MDB or Volume Header 
    	Block 468862126 is not an MDB or Volume Header 
    	unknown volume type 
    	primary MDB is at block 0 0x00 
    	alternate MDB is at block 0 0x00 
    	primary VHB is at block 0 0x00 
    	alternate VHB is at block 0 0x00 
    	sector size = 512 0x200 
    	VolumeObject flags = 0x01 
    	total sectors for volume = 468862128 0x1bf244b0 
    	total sectors for embedded volume = 0 0x00 
    

Here's also the testdisk.log

I started trying "7.8 Repairing HFS/HFS+ volume header using TestDisk"
And could change the second partition "unkown" by choosing Mac HSF and then HFS + to
Then I got the superblock option and get this output (also run the dump)

Code: Select all


Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63
     Partition                  Start        End    Size in sectors
 2 P Mac HFS                   409640  468599943  468190304 [FusionDrive]

Volume header
Bad

Backup volume header
Bad

Sectors are identical.
Here the full testdisk.log from that run.

Is there any possibility to rewrite this superblock, or can I "just" use photo_rec ?

Locked