External HDD formatted in error Boot Camp install gone wrong

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
michaelvsprague
Posts: 10
Joined: 25 Jan 2014, 18:24

Re: External HDD formatted in error Boot Camp install gone w

#11 Post by michaelvsprague »

tail end of second pass at deep analysis:
=================================

HFS 19735912 1953725719 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19737976 1953727783 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19739592 1953729399 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19740936 1953730743 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19747792 1953737599 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19749728 1953739535 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19752112 1953741919 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19753352 1953743159 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19754696 1953744503 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19756176 1953745983 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19757680 1953747487 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB

Results
P HFS 1522083229 1533842703 11759475
HFS+ found using backup sector!, 6020 MB / 5741 MiB

interface_write()
P HFS 1522083229 1533842703 11759475
===============================================
end of log


a section up a bit from the end:
===========================

HFS+ magic value at 19752112/0/1
part_size 1933989808
HFS 19752112 1953741919 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
This partition ends after the disk limits. (start=19752112, size=1933989808, end=1953741919, disk end=1953525168)

HFS+ magic value at 19752863/0/1

HFS+ magic value at 19753352/0/1
part_size 1933989808
HFS 19753352 1953743159 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
This partition ends after the disk limits. (start=19753352, size=1933989808, end=1953743159, disk end=1953525168)

HFS+ magic value at 19754351/0/1

HFS+ magic value at 19754696/0/1
part_size 1933989808
HFS 19754696 1953744503 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
This partition ends after the disk limits. (start=19754696, size=1933989808, end=1953744503, disk end=1953525168)

HFS+ magic value at 19755679/0/1

HFS+ magic value at 19756176/0/1
part_size 1933989808
HFS 19756176 1953745983 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
This partition ends after the disk limits. (start=19756176, size=1933989808, end=1953745983, disk end=1953525168)

HFS+ magic value at 19757143/0/1

HFS+ magic value at 19757680/0/1
part_size 1933989808
HFS 19757680 1953747487 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
This partition ends after the disk limits. (start=19757680, size=1933989808, end=1953747487, disk end=1953525168)

LVM magic value at 1117600328/0/1

LVM magic value at 1118051584/0/1

LVM magic value at 1118502880/0/1

LVM magic value at 1164244672/0/1

HFS+ magic value at 1533842695/0/1
part_size 11759468
HFS 1522083229 1533842696 11759468
HFS+ found using backup sector!, 6020 MB / 5741 MiB
Disk /dev/disk3 - 1000 GB / 931 GiB - 1953525168 sectors (RO)
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partitions can't be recovered:
DOS_FAT_32 8 1953525173 1953525166 [WININSTALL]
FAT32, blocksize=32768, 1000 GB / 931 GiB
HFS 19595496 1953585303 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19597032 1953586839 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19599016 1953588823 1933989808
=================================================
end


another section not like most of the rest of the log, a bit further up in the log file:
=====================================================================
HFS 19754696 1953744503 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19756176 1953745983 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19757680 1953747487 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/disk3 - 1000 GB / 931 GiB - 1953525168 sectors (RO)
FAT32 at 8/0/1
FAT1 : 32-238441
FAT2 : 238442-476851
start_rootdir : 476852 root cluster : 2
Data : 476852-1953525107
sectors : 1953525166
cluster_size : 64
no_of_cluster : 30516379 (2 - 30516380)
fat_length 238410 calculated 238410
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 8/0/1
DOS_FAT_32 8 1953525173 1953525166 [WININSTALL]
FAT32, blocksize=32768, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=8, size=1953525166, end=1953525173, disk end=1953525168)

HFS+ magic value at 19594655/0/1

HFS+ magic value at 19595496/0/1
part_size 1933989808
HFS 19595496 1953585303 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
This partition ends after the disk limits. (start=19595496, size=1933989808, end=1953585303, disk end=1953525168)
==================================================================================================
end


This one is a little bit further up, and appears to be the first odd one after the start of the analysis:
===================================================================================
HFS+ magic value at 19756176/0/1
part_size 1933989808
HFS 19756176 1953745983 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
This partition ends after the disk limits. (start=19756176, size=1933989808, end=1953745983, disk end=1953525168)

HFS+ magic value at 19757680/0/1
part_size 1933989808
HFS 19757680 1953747487 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
This partition ends after the disk limits. (start=19757680, size=1933989808, end=1953747487, disk end=1953525168)

LVM magic value at 1117600328/0/1

LVM magic value at 1118051584/0/1

LVM magic value at 1118502880/0/1

LVM magic value at 1164244672/0/1
Disk /dev/disk3 - 1000 GB / 931 GiB - 1953525168 sectors (RO)
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partitions can't be recovered:
DOS_FAT_32 8 1953525173 1953525166 [WININSTALL]
FAT32, blocksize=32768, 1000 GB / 931 GiB
HFS 19595496 1953585303 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
HFS 19597032 1953586839 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
====================================
end

This may be the beginning of the deeper analysis log:
=============================================
Wed Apr 23 22:33:15 2014
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 13.1.0 (Darwin Kernel Version 13.1.0: Wed Apr 2 23:52:02 PDT 2014; root:xnu-2422.9
Compiler: GCC 4.0
Compilation date: 2013-07-30T14:08:37
ext2fs lib: 1.41.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
Hard disk list
Disk /dev/disk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/disk1 - 1032 MB / 985 MiB - 2017280 sectors (RO), sector size=512
Disk /dev/disk2 - 523 MB / 498 MiB - 1021696 sectors (RO), sector size=512
Disk /dev/rdisk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/rdisk1 - 1032 MB / 985 MiB - 2017280 sectors (RO), sector size=512
Disk /dev/rdisk2 - 523 MB / 498 MiB - 1021696 sectors (RO), sector size=512


TestDisk exited normally.


Wed Apr 23 22:33:37 2014
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 13.1.0 (Darwin Kernel Version 13.1.0: Wed Apr 2 23:52:02 PDT 2014; root:xnu-2422.9
Compiler: GCC 4.0
Compilation date: 2013-07-30T14:08:37
ext2fs lib: 1.41.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
Hard disk list
Disk /dev/disk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/disk1 - 1032 MB / 985 MiB - 2017280 sectors (RO), sector size=512
Disk /dev/disk2 - 523 MB / 498 MiB - 1021696 sectors (RO), sector size=512
Disk /dev/disk3 - 1000 GB / 931 GiB - 1953525168 sectors (RO), sector size=512
Disk /dev/rdisk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/rdisk1 - 1032 MB / 985 MiB - 2017280 sectors (RO), sector size=512
Disk /dev/rdisk2 - 523 MB / 498 MiB - 1021696 sectors (RO), sector size=512
Disk /dev/rdisk3 - 1000 GB / 931 GiB - 1953525168 sectors (RO), sector size=512

Partition table type (auto): Intel
Media is opened in read-only.
Disk /dev/disk3 - 1000 GB / 931 GiB (RO)
Partition table type: Mac

Analyse Disk /dev/disk3 - 1000 GB / 931 GiB - 1953525168 sectors (RO)
Current partition structure:
Bad MAC partition, invalid block0 signature
read_part_mac: bad DPME signature

search_part()
Disk /dev/disk3 - 1000 GB / 931 GiB - 1953525168 sectors (RO)
FAT32 at 8/0/1
FAT1 : 32-238441
FAT2 : 238442-476851
start_rootdir : 476852 root cluster : 2
Data : 476852-1953525107
sectors : 1953525166
cluster_size : 64
no_of_cluster : 30516379 (2 - 30516380)
fat_length 238410 calculated 238410
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 8/0/1
DOS_FAT_32 8 1953525173 1953525166 [WININSTALL]
FAT32, blocksize=32768, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=8, size=1953525166, end=1953525173, disk end=1953525168)

HFS+ magic value at 19595496/0/1
part_size 1933989808
HFS 19595496 1953585303 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
This partition ends after the disk limits. (start=19595496, size=1933989808, end=1953585303, disk end=1953525168)

HFS+ magic value at 19597032/0/1
part_size 1933989808
HFS 19597032 1953586839 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
This partition ends after the disk limits. (start=19597032, size=1933989808, end=1953586839, disk end=1953525168)

HFS+ magic value at 19599016/0/1
part_size 1933989808
HFS 19599016 1953588823 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
This partition ends after the disk limits. (start=19599016, size=1933989808, end=1953588823, disk end=1953525168)

HFS+ magic value at 19600672/0/1
part_size 1933989808
HFS 19600672 1953590479 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
This partition ends after the disk limits. (start=19600672, size=1933989808, end=1953590479, disk end=1953525168)

HFS+ magic value at 19602504/0/1
part_size 1933989808
HFS 19602504 1953592311 1933989808
HFS+ blocksize=4096, 990 GB / 922 GiB
This partition ends after the disk limits. (start=19602504, size=1933989808, end=1953592311, disk end=1953525168
==================================================================================================
Does any of this help? Should I write these files off, and give up on recovering them?

Please Let Me Know what you think. Full log file attached, just in case. Zipped, because .log extension was disallowed by the Message Board.

michaelvsprague
Posts: 10
Joined: 25 Jan 2014, 18:24

Re: External HDD formatted in error Boot Camp install gone w

#12 Post by michaelvsprague »

Looking at my message, I do not see the zipped log file attachment.
Attachments
testdisk.log.zip
Didn't see attachment on previous message, so added here
(81.95 KiB) Downloaded 256 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: External HDD formatted in error Boot Camp install gone w

#13 Post by cgrenier »

I don't understand why your second partition hasn't been found. TestDisk have found some trace of your 990GB HFS+ partition but without the correct location. I think the main HFS+ superblock of your first partition has been overwritten too.

At this point, you can contact a data recovery company or you can use PhotoRec to recover your data but recovered files will have generic filenames, the directory structure and the original filenames won't be recovered.

michaelvsprague
Posts: 10
Joined: 25 Jan 2014, 18:24

Re: External HDD formatted in error Boot Camp install gone w

#14 Post by michaelvsprague »

Thanks. I took it to a friend at the first of the year, and have been recovering from his help since - renaming mp3 files, etc., removing duplicates, deleting files I did not need, searching for the passwords file that was on there but never turned up again.

The software organized the recovered files by type, and named them numerically. I will be more careful in the future.

Thank you for all of your time.

Michael

Locked