Repair a HFS+ drive (windows)

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Stemar
Posts: 1
Joined: 05 Feb 2015, 08:27

Repair a HFS+ drive (windows)

#1 Post by Stemar »

I have a MAC HFS+ formatted drive with my wedding pictures on them.

The disk itself is not found by windows with HFS explorer.
Through macdrive i was able to find the HDD, but can not read it.
Testdrive was able to find the HDD.

Because i want to restore my pictures i ran an Analyse and a quick search and these were the results.(see attachment for a screenshot from the partitions.)


Wed Feb 4 17:26:11 2015
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, January 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2015-01-19T21:26:37
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500000882688
filewin32_getfilesize(\\.\D:) GetFileSize err Onjuiste functie.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Onjuiste functie.

Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Onjuiste functie.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Onjuiste functie.

Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HTS727550A9E, S/N:3J2300288GV9A3, FW:JF3O
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - TOSHIBA External USB 3.0, S/N:22LIF93OS, FW:0001

Partition table type (auto): Mac
Disk /dev/sdb - 500 GB / 465 GiB - TOSHIBA External USB 3.0
Partition table type: Mac

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63

HFS+ magic value at 16/82/3

HFS+ magic value at 16/82/3
Current partition structure:
1 P partition_map 1 63 63
2 P Free 64 262207 262144
3 P HFS 262208 976773151 976510944
4 P Free 976773152 976773167 16

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
file_pread(5,16,buffer,2128(0/33/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2128(0/33/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2568(0/40/49)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2576(0/40/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2576(0/40/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,910(0/14/29)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,912(0/14/31)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,913(0/14/32)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,913(0/14/32)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,918(0/14/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,918(0/14/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,903(0/14/22)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,911(0/14/30)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,912(0/14/31)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,919(0/14/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,919(0/14/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,913(0/14/32)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,913(0/14/32)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2936(0/46/39)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2936(0/46/39)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,912(0/14/31)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,912(0/14/31)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,913(0/14/32)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,913(0/14/32)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,6,buffer,914(0/14/33)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,3120(0/49/34)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,3128(0/49/42)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,3128(0/49/42)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,3280(0/52/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,3280(0/52/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,3288(0/52/13)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,3296(0/52/21)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,3296(0/52/21)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1609(0/25/35)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1617(0/25/43)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,1624(0/25/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1625(0/25/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,1625(0/25/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1630(0/25/56)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,1630(0/25/56)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1615(0/25/41)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1623(0/25/49)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,1624(0/25/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1631(0/25/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,1631(0/25/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,1625(0/25/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

[lots of DATA]...

file_pread(5,1,buffer,2129(0/33/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2134(0/33/56)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2134(0/33/56)) ReadFile Gegevensfout (cyclische redundantiecontrole)

NTFS at 0/32/33
filesystem size 976769072
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
Unknown 2048 976771119 976769072
NTFS, blocksize=4096, 500 GB / 465 GiB
Partition not added.
file_pread(5,16,buffer,2127(0/33/49)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2128(0/33/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2135(0/33/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2135(0/33/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2129(0/33/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2129(0/33/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2128(0/33/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2128(0/33/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,2129(0/33/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,2129(0/33/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,6,buffer,2130(0/33/52)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,4312(0/68/29)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,4312(0/68/29)) ReadFile Gegevensfout (cyclische redundantiecontrole)

[even more DATA. all the way from 4300 to 25000]


file_pread(5,1,buffer,252944(15/189/63)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,252951(15/190/7)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,252951(15/190/7)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,252945(15/190/1)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,252945(15/190/1)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,252943(15/189/62)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,252944(15/189/63)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,252944(15/189/63)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,252945(15/190/1)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,252945(15/190/1)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,6,buffer,252946(15/190/2)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257208(16/2/43)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257216(16/2/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257216(16/2/51)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257224(16/2/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257232(16/3/4)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257232(16/3/4)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257201(16/2/36)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257209(16/2/44)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257217(16/2/52)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257225(16/2/60)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257232(16/3/4)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257233(16/3/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257233(16/3/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257238(16/3/10)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257238(16/3/10)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257223(16/2/58)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257231(16/3/3)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257232(16/3/4)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257239(16/3/11)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257239(16/3/11)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257233(16/3/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257233(16/3/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259240(16/34/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259240(16/34/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257224(16/2/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257227(16/2/62)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257232(16/3/4)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257232(16/3/4)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,257233(16/3/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,257233(16/3/5)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,6,buffer,257234(16/3/6)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259238(16/34/57)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259240(16/34/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,8,buffer,259241(16/34/60)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259231(16/34/50)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259239(16/34/58)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259240(16/34/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259247(16/35/3)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259247(16/35/3)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259241(16/34/60)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259241(16/34/60)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259337(16/36/30)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259345(16/36/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259345(16/36/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259240(16/34/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259240(16/34/59)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259350(16/36/43)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259350(16/36/43)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259241(16/34/60)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259241(16/34/60)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,6,buffer,259242(16/34/61)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259351(16/36/44)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259351(16/36/44)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259345(16/36/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259345(16/36/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259331(16/36/24)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259336(16/36/29)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259344(16/36/37)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,16,buffer,259345(16/36/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,1,buffer,259345(16/36/38)) ReadFile Gegevensfout (cyclische redundantiecontrole)

file_pread(5,6,buffer,259346(16/36/39)) ReadFile Gegevensfout (cyclische redundantiecontrole)


HFS+ magic value at 16/82/3

HFS+ magic value at 16/82/3
part_size 976510944
HFS 262208 976773151 976510944
HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB
file_pread(5,3,buffer,976773168(60801/81/1)) ReadFile Het station kan de aangevraagde sector niet vinden.

file_pread(5,1,buffer,976773168(60801/81/1)) ReadFile Het station kan de aangevraagde sector niet vinden.

file_pread(5,3,buffer,976773215(60801/81/48)) lseek err Invalid argument
file_pread(5,8,buffer,976773231(60801/82/1)) lseek err Invalid argument
file_pread(5,11,buffer,976773278(60801/82/48)) lseek err Invalid argument
file_pread(5,2,buffer,976775200(60801/113/17)) lseek err Invalid argument
file_pread(5,7,buffer,976773169(60801/81/2)) lseek err Invalid argument
file_pread(5,3,buffer,976773176(60801/81/9)) lseek err Invalid argument
file_pread(5,3,buffer,976773223(60801/81/56)) lseek err Invalid argument
file_pread(5,8,buffer,976773239(60801/82/9)) lseek err Invalid argument
file_pread(5,8,buffer,976773289(60801/82/59)) lseek err Invalid argument
file_pread(5,2,buffer,976775208(60801/113/25)) lseek err Invalid argument
file_pread(5,5,buffer,976773179(60801/81/12)) lseek err Invalid argument
file_pread(5,3,buffer,976773184(60801/81/17)) lseek err Invalid argument
file_pread(5,8,buffer,976773247(60801/82/17)) lseek err Invalid argument
file_pread(5,8,buffer,976773297(60801/83/4)) lseek err Invalid argument
file_pread(5,2,buffer,976775216(60801/113/33)) lseek err Invalid argument

Results
P HFS 262208 976773151 976510944
HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB

P HFS 262208 976773151 976510944
HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB
Support for this filesystem hasn't been enable during compilation.

interface_write()
P HFS 262208 976773151 976510944
Do i perform a deep search and write the partition tables or is that dangerous?
The most important data on the hard drive are the pictures.
Attachments
Eerste.PNG
Eerste.PNG (58.23 KiB) Viewed 2373 times

Locked