Which path to take?..

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Jonathan
Posts: 3
Joined: 10 Dec 2015, 02:06

Which path to take?..

#1 Post by Jonathan »

Hi Folks,

I have a 3tb external seagate HD formatted in HFS+ and containing quite a lot of important data. At some point a while ago, I tried to make it cross platform compatible, and in so doing I think I messed up the partition/MBR/ some other wotsit.
(I have three machines - macbook pro running OSX. A desktop running linux ubuntu.And another desktop running windoze 7 (64bit) )
Anyway, ran the awesome TestDisk utility, first of all on the windows machine and pretty much straight away got a result in green. It took me all the way to the new options, one of which was "align partition: yes."
Which is where I chickened out.

I did some more googling and found that by comparing the mismatched sector numbers, and running p-disk in terminal (Mac) i should be able to realign it manually.

But this is where it gets tricky.
Although I can run a terminal in windoze I don't know what the right commands are.
I can't get the drive recognised at all on the mac, so can't even use TestDisk there.
And the ubunut machine is still doing a "quick analyse" - it started 4 hours ago :roll:

So anyway, the log file is pasted below, and I would be super grateful if anyone can give me a suggestion as to how to proceed.
Cheers

Partition table type default to EFI GPT
Disk \\.\PhysicalDrive9 - 3000 GB / 2794 GiB
Partition table type: Mac

Analyse Disk \\.\PhysicalDrive9 - 3000 GB / 2794 GiB - CHS 364801 255 63
Current partition structure:
Bad MAC partition, invalid block0 signature
read_part_mac: bad DPME signature

search_part()
Disk \\.\PhysicalDrive9 - 3000 GB / 2794 GiB - CHS 364801 255 63
FAT32 at 0/0/49
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT32 at 0/0/49
DOS_FAT_32 48 409647 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 25/127/23

HFS+ magic value at 25/127/23
part_size 1564894032
HFS 409648 5860270975 5859861328
HFS+ blocksize=8192 + Backup, 3000 GB / 2794 GiB
NTFS at 364800/190/55
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 732563456
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Which path to take?..

#2 Post by cgrenier »

Use an EFI partition table, not an old Mac partition table.
Top
Jonathan
Posts: 3
Joined: 10 Dec 2015, 02:06

Re: Which path to take?..

#3 Post by Jonathan »

Merci pour votre contribution, Christophe,

Just so I am sure I understand right, to save all the data and gain access again are you saying choose EFI partition table instead of MAC, and then choose "align partition"?

Cheers

Jonathan
Top
Jonathan
Posts: 3
Joined: 10 Dec 2015, 02:06

Re: Which path to take?..

#4 Post by Jonathan »

OK.
So I tried using the "EFI partition" option and got the following:

Code: Select all

Interface Advanced
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

Analyse Disk \\.\PhysicalDrive8 - 3000 GB / 2794 GiB - CHS 364801 255 63
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Disk \\.\PhysicalDrive8 - 3000 GB / 2794 GiB - CHS 364801 255 63
FAT32 at 0/0/49
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT32 at 0/0/49
     EFI System                    48     409647     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 25/127/23

HFS+ magic value at 25/127/23
part_size 1564894032
     Mac HFS                   409648 5860270975 5859861328
     HFS+ blocksize=8192 + Backup, 3000 GB / 2794 GiB
NTFS at 364800/190/55
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           732563456
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               366281727
clusters_per_mft_record   1
clusters_per_index_record 1
     MS Data                    16377 5860524024 5860507648
     NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 364800/190/55
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           732563456
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               366281727
clusters_per_mft_record   1
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data               5860524024 11721031671 5860507648
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=5860524024, size=5860507648, end=11721031671, disk end=5860533168)
file_win32_pread(112,11,buffer,1565565863(364801/80/55)) read err: read after end of file
file_win32_pread(112,11,buffer,1565565866(364801/80/58)) read err: read after end of file
file_win32_pread(112,8,buffer,1565565865(364801/80/57)) read err: read after end of file
file_win32_pread(112,3,buffer,1565565871(364801/80/63)) read err: read after end of file
file_win32_pread(112,8,buffer,1565565869(364801/80/61)) read err: read after end of file
file_win32_pread(112,14,buffer,1565565860(364801/80/52)) read err: read after end of file
file_win32_pread(112,14,buffer,1565565861(364801/80/53)) read err: read after end of file
file_win32_pread(112,14,buffer,1565565862(364801/80/54)) read err: read after end of file
file_win32_pread(112,14,buffer,1565565863(364801/80/55)) read err: read after end of file
file_win32_pread(112,14,buffer,1565565864(364801/80/56)) read err: read after end of file
file_win32_pread(112,14,buffer,1565565866(364801/80/58)) read err: read after end of file
file_win32_pread(112,14,buffer,1565565868(364801/80/60)) read err: read after end of file
file_win32_pread(112,14,buffer,1565565870(364801/80/62)) read err: read after end of file
Disk \\.\PhysicalDrive8 - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 6001 GB / 5589 GiB)
The following partition can't be recovered:
     MS Data               5860524024 11721031671 5860507648
     NTFS, blocksize=4096, 3000 GB / 2794 GiB

Results
     EFI System                    48     409647     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
     MS Data                    16377 5860524024 5860507648
     NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
     Mac HFS                   409648 5860270975 5859861328
     HFS+ blocksize=8192 + Backup, 3000 GB / 2794 GiB

interface_write()
 
No partition found or selected for recovery
simulate write!

TestDisk exited normally.
Not sure what to do next?...
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Which path to take?..

#5 Post by Fiona »

You have only an EFI GPT-Partition in your GUID partition table and partition type is FAT32.
There is no HFS+-partition.
That's why running TestDisk / Advanced will not work.
You should run TestDisk partition table type EFI GPT / Analyse and Quick Search to have a try to find your HFS+-Partition.
If no partitions are found, Deeper Search also.
Unfortunately, TestDisk can't list data on HFS+-partitions.
After search, you'll see the results.
You should select each partition and have a look at the bottom of the display to find a partition with the correct size.
So you can consider to recover it.
To avoid scanning large disks and when partitions are already listed, you can try to stop the scan.
Results might be displayed for recovery.
If you receive a message partitions can't be recovered, you should press enter to get to the results.
It's a message only.

Fiona
Top
Locked

Return to “Partition Recovery”