Please help restoring exFat and HFS partitions

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
mmgando
Posts: 2
Joined: 18 Dec 2013, 02:44

Please help restoring exFat and HFS partitions

#1 Post by mmgando »

First of all, I would like to thank the creators of TestDisk and all of you who make this such an active forum community. TestDisk is a wonderful program that has been made even more useful by all of the knowledge shared here. I have recently been using TestDisk to try and recover my partitions but have run into some stumbling blocks. I am therefore hoping that someone here will be able to point me in the right direction.

Back Story/How this happened:
I have a 2tb external drive that was formatted with 2 partitions that were each 1tb each. The first was an exFat partion, the second HFS. Because I am primarily a windows user, I used MacDrive (http://www.mediafour.com/products/macdrive) to copy all the data from the HFS partition to the exfat partition. After all the data had been copied successfully, I attempted to use windows Disk Management to delete the HFS partion so I could extend the exFat to the full 2tb. Unfortunately MacDrive was "protecting" the disk and interceded in the process and offered 3 options.
MacDrive
MacDrive
MacDrive.JPG (28.24 KiB) Viewed 6999 times
(http://support.mediafour.com/entries/21 ... -Mac-disk-).

I chose "Erase the Mac Disk so I can make Windows partitions" but instead of just releasing and erasing the HFS partition, MacDrive allowed Windows Disk Management to delete both partitions and leave the drive "unallocated". Unfortunately, while I am usually a little over protective in terms of backing up, in this case, since I had deleted single partitions countless times before without it affecting the other partitions I did not backup the data on the exFat partition that also was deleted at the same time. So as it stands, while both partitions are a clone of each other, I need to restore at least one to get my data back.

My attempts to restore thus far:
Prior to beginning the restore process I completed a sector to sector copy of the drive to another disk using HDDRawCopy and I am using that drive for any operations that require writing. At first, it seemed that TestDisk was successful in finding the missing HFS partition but then I received an error about the disk appearing too small. This was confusing since the HFS partition seemed correct except that its ending value was higher than the disk's total size
Too Small
Too Small
cant.JPG (48.1 KiB) Viewed 6999 times
.

I therefore completed a "Deeper Scan" which revealed two HFS partitions that were the right size but in the wrong place on the disk.
Deeper Scan
Deeper Scan
deeper.JPG (42.55 KiB) Viewed 6999 times


As I stated above, the drive was setup with an exFat partition in the first half of the drive and the HFS in the second. Therefore, the 121612 0 1 to 243212 165 61 location seems correct except it ends after the drive supposedly ends.

Even though I did not expect it to work, I tried mounting both incorrectly placed HFS partitions from the deeper scan. In both cases they did not function after a restart.

I am therefore hoping someone on the forum can offer a suggestion as to what to try next. Should I use the advanced controls to alter the drive size to match 243212 165 61? Or is there someone who can look at my log file (posted below) and instruct me on how to manually write my partitions based on what I have described?

Lastly, I have been able to use PhotoRec to restore all of the files from the drive but it would be much better if I could restore partition so that my file names will be restored too.

Thank you in advance for all of you help.

mmgando
Posts: 2
Joined: 18 Dec 2013, 02:44

Re: Please help restoring exFat and HFS partitions

#2 Post by mmgando »

Here is the log file:



Tue Dec 17 07:40:46 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=79657172992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=103809024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=3000351064064
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Z:)=3000351326208
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EARS-00MVWB0, S/N:WD-WMAZA3705702, FW:51.0AB51
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EFRX-68AX9N0, S/N:WD-WMC1T0998887, FW:80.00A80
Disk /dev/sdc - 80 GB / 74 GiB - CHS 9729 255 63, sector size=512 - INTEL SSDSA2MH080G1GN, S/N:CVEM836000E9080DGN, FW:045C8820
Drive Y: - 3000 GB / 2794 GiB - CHS 1565093376 1 1, sector size=512

Partition table type default to Intel
Disk /dev/sda - 2000 GB / 1863 GiB - WDC WD20EARS-00MVWB0
Partition table type: Intel

Analyse Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
file_pread(4,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(4,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(4,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(4,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(4,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(4,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(4,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(4,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63

HFS+ magic value at 121612/0/1
part_size 1953514456
HFS 121612 0 1 243212 165 61 1953514456
HFS+ blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=1953696780, size=1953514456, end=3907211235, disk end=3907029168)

HFS+ magic value at 121612/243/39
part_size 1953514456
HFS 12 77 43 121612 243 40 1953514456
HFS+ found using backup sector!, 1000 GB / 931 GiB

HFS+ magic value at 121612/254/63
part_size 1953514456
HFS 12 89 4 121613 0 1 1953514456
HFS+ found using backup sector!, 1000 GB / 931 GiB
BAD_RS LBA=4038277166 16064
file_pread(4,3,buffer,4038277166(251371/32/36)) lseek err Invalid argument
file_pread(4,1,buffer,4038277166(251371/32/36)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
FAT16 >32M 251371 32 36 475890 229 60 3606910171
This partition ends after the disk limits. (start=4038277166, size=3606910171, end=3350220040, disk end=3907029168)
file_pread(4,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(4,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(4,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(4,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(4,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(4,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(4,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(4,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(4,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 3914 GB / 3645 GiB)
The following partitions can't be recovered:
HFS 121612 0 1 243212 165 61 1953514456
HFS+ blocksize=4096, 1000 GB / 931 GiB
FAT16 >32M 251371 32 36 475890 229 60 3606910171

Results
HFS 12 77 43 121612 243 40 1953514456
HFS+ found using backup sector!, 1000 GB / 931 GiB
HFS 12 89 4 121613 0 1 1953514456
HFS+ found using backup sector!, 1000 GB / 931 GiB

interface_write()
1 P HFS 12 77 43 121612 243 40 1953514456
write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

HFS_HFSP_boot_sector
1 P HFS 12 77 43 121612 243 40 1953514456
HFS+ found using backup sector!, 1000 GB / 931 GiB

HFS+ magic value at 12/77/43
Volume header
Bad

Backup volume header
HFS+ OK

Sectors are not identical.
copy backup superblock over main superblock

HFS_HFSP_boot_sector
1 P HFS 12 77 43 121612 243 40 1953514456
HFS+ found using backup sector!, 1000 GB / 931 GiB

HFS+ magic value at 12/77/43

HFS+ magic value at 12/77/43
Volume header
HFS+ OK

Backup volume header
HFS+ OK

Sectors are identical.
You will have to reboot for the change to take effect.

TestDisk exited normally.

Locked