Drobo formatted partition recovery

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Datah
Posts: 1
Joined: 10 Aug 2014, 13:55

Drobo formatted partition recovery

#1 Post by Datah »

I've got a 1.5TB HDD which had the partition information erased by putting into a Drobo box by mistake. Drobo has probably started changing the partition table once the hdd was added as after removing it from drobo and placing into an external hdd enclosure partitions were no longer recognised.

I've managed to run testdisk and it recognised the partition structure, however I am not sure if the file systems it is suggesting are correct.

I know it had three partitions, first being a clone of an imac hdd, while second and third were used for windows machine backups.

Now the testdisk log seems to have found the start and end of each of them but suggests HFSX for the file system.

Disk /dev/rdisk2 - 1500 GB / 1397 GiB - 2930277168 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/rdisk2 - 1500 GB / 1397 GiB
Partition table type: EFI GPT

Analyse Disk /dev/rdisk2 - 1500 GB / 1397 GiB - 2930277168 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=2930277167 (expected 2930277167)
hdr_lba_start=34
hdr_lba_end=2930277134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]

search_part()
Disk /dev/rdisk2 - 1500 GB / 1397 GiB - 2930277168 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
FAT differs, FAT sectors=48-64/3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 409640/0/1
part_size 589037568
Mac HFS 409640 589447207 589037568
HFS+ blocksize=4096, 301 GB / 280 GiB

HFSX magic value at 977167452/0/1
part_size 976757816
Mac HFS 977167452 1953925267 976757816
HFSX blocksize=4096, 500 GB / 465 GiB

HFS+ magic value at 1954189312/0/1

HFS+ magic value at 1954189312/0/1
part_size 975825672
Mac HFS 1954189312 2930014983 975825672
HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB

Results
P EFI System 40 409639 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
P Mac HFS 409640 589447207 589037568
HFS+ blocksize=4096, 301 GB / 280 GiB
P Mac HFS 977167452 1953925267 976757816
HFSX blocksize=4096, 500 GB / 465 GiB
P Mac HFS 1954189312 2930014983 975825672
HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB
First partition is most likely hfs+ and
as the 2nd and 3rd partitions were 500GB each and recognised by windows I would assume they couldn't be FATs, so probably the only choice is NTFS.

And finally my question - my guess is that they were NTFS and that's what I'm planning to change them to.
If it turns out they were a different format, do I have a second chance, once the partition table has been written with testdisk? I.e. If it doesn't work after will there be much use of doing the change again using testdisk?

I've managed to recover most of the files I needed with photorec so it is more of a practical experiment trying to learn more about hdd recovery.

Thanks for your help in advance.

Locked