Formatted HFS+ partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
zealotde
Posts: 3
Joined: 16 Sep 2016, 21:16

Formatted HFS+ partition

#1 Post by zealotde »

Hello everyone

few days ago I wanted to split partition but obviously I can't read and I chose "partitionDisk" option, basically I did:

Code: Select all

diskutil partitionDisk /dev/disk1 GPT JHFS+ New 100g
That was a mistake. It didn't ask me anything about erasing data, but still its terminal so I don't blame it. Now I've got an empty partition, but I want to recover the old one.

Is there any way to to such thing? I tried with testdisk, but it's kinda hard to use this soft, tried also deeper search, I saw there about 100 of rows with multiple partitions, but couldn't preview any because of HFS+ I guess.

However I believe the last option would be to use Photorec and recover files one by one...

Is someone could help I would be grateful.

Disk is 1TB WD Red, formatted to HFS+, earlier (a few months ago) was NTFS filesystem, using OSX.

Attaching testdisk log file.
testdisk.log.zip
(27.39 KiB) Downloaded 263 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Formatted HFS+ partition

#2 Post by cgrenier »

Try TestDisk, select the disk, Advanced, select the partition, Superblock. It may be able to fix the HFS+ superblock.
If it doesn't work, you can use PhotoRec to recover your data but it will not recover the original filenames or the directory structure.

zealotde
Posts: 3
Joined: 16 Sep 2016, 21:16

Re: Formatted HFS+ partition

#3 Post by zealotde »

Hi

thanks for your reply. Will try this in a few moments.
I started recovering within photorec and it's amazing, but filenames are missing as you said. But it's fair enough :-)

EDIT: which option should I use?
Org. BS / Backup BS / Dump

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Formatted HFS+ partition

#4 Post by cgrenier »

If fsck has failed previously, you can try BackupBS and try again a fsck to repair the partition, ie.

Code: Select all

fsck_hfs -fy /dev/rdisk1s1

zealotde
Posts: 3
Joined: 16 Sep 2016, 21:16

Re: Formatted HFS+ partition

#5 Post by zealotde »

I guess it doesn't work either before and after overwriting superblock

what the command returns is

Code: Select all

** /dev/rdisk0s1
   Executing fsck_hfs (version hfs-305.10.1).
volumeType is 0
0000:  eb58 9042 5344 2020 342e 3400 0201 2000       |.X.BSD..4.4.....|
0010:  0200 0000 00f0 0000 2000 1000 0000 0000       |................|
0020:  0040 0600 4f0c 0000 0000 0000 0200 0000       |....O...........|
0030:  0100 0600 0000 0000 0000 0000 0000 0000       |................|
0040:  0000 29ed 17e3 6745 4649 2020 2020 2020       |......gEFI......|
0050:  2020 4641 5433 3220 2020 fa31 c08e d0bc       |..FAT32....1....|
0060:  007c fb8e d8e8 0000 5e83 c619 bb07 00fc       |................|
0070:  ac84 c074 06b4 0ecd 10eb f530 e4cd 16cd       |...t.......0....|
0080:  190d 0a4e 6f6e 2d73 7973 7465 6d20 6469       |...Non.system.di|
0090:  736b 0d0a 5072 6573 7320 616e 7920 6b65       |sk..Press.any.ke|
00a0:  7920 746f 2072 6562 6f6f 740d 0a00 0000       |y.to.reboot.....|
00b0:  0000 0000 0000 0000 0000 0000 0000 0000       |................|
. . .
01f0:  0000 0000 0000 0000 0000 0000 0000 55aa       |..............U.|
So I need to use photorec now?

Locked