Windows partitioned HFS+ drive

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
plsncld
Posts: 5
Joined: 30 Mar 2017, 07:59

Windows partitioned HFS+ drive

#1 Post by plsncld »

When trying to make Windows install media using Windows 10's tool my 2TB external hard disk was repartitioned to 32GB FAT32. It had been partitioned in macOS using Disk Utility Into 3 partitions:
350 GB HFS+ - for files
1550 GB HFS+ - for backup
100 GB FAT - intended destination for Windows 10 installer

I just need some advice for restoring the HFS+ partitions (either partition would do actually). I've run Analysis to 20% as an Intel partition type and 86% as a Mac partition type and it doesn't seem to be picking up the partitions. What is the correct way to pick up these partitions?
Wed Mar 29 08:11:13 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 16.4.0 (Darwin Kernel Version 16.4.0: Thu Dec 22 22:53:21 PST 2016; root:xnu-3789.4
Compiler: GCC 4.0
Compilation date: 2017-03-16T18:15:19
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/disk2 - 2000 GB / 1862 GiB - 3906928640 sectors, sector size=512
Disk /dev/rdisk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/rdisk1 - 169 GB / 158 GiB - 332031248 sectors (RO), sector size=512
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906928640 sectors, sector size=512

Partition table type (auto): Intel
Disk /dev/disk2 - 2000 GB / 1862 GiB
Partition table type: Mac

Analyse Disk /dev/disk2 - 2000 GB / 1862 GiB - 3906928640 sectors
Current partition structure:
Bad MAC partition, invalid block0 signature
read_part_mac: bad DPME signature
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Windows partitioned HFS+ drive

#2 Post by cgrenier »

Try EFI GPT or Intel partition table, not Mac. Your computer is not a Mac PowerPC.
Top
plsncld
Posts: 5
Joined: 30 Mar 2017, 07:59

Re: Windows partitioned HFS+ drive

#3 Post by plsncld »

Using the EFI partition table I can see multiple entries which could be the partition that I wish to recover (350GB HFS+). I have used the rather excellent photorec tool to recover files off the disk, albeit without some metadata from the photos.

I've tried to write some of the entries of around the right size and mount them but they won't mount, with errors relating to the filesystem and superblock.

Any suggestions?
Top
plsncld
Posts: 5
Joined: 30 Mar 2017, 07:59

Re: Windows partitioned HFS+ drive

#4 Post by plsncld »

The log file

Sat Apr 1 11:59:58 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 16.4.0 (Darwin Kernel Version 16.4.0: Thu Dec 22 22:53:21 PST 2016; root:xnu-3789.4
Compiler: GCC 4.0
Compilation date: 2017-03-16T18:15:19
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/disk2 - 2000 GB / 1862 GiB - 3906928640 sectors, sector size=512
Disk /dev/rdisk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/rdisk1 - 178 GB / 165 GiB - 347657384 sectors (RO), sector size=512
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906928640 sectors, sector size=512

Partition table type (auto): Intel
Disk /dev/rdisk2 - 2000 GB / 1862 GiB
Partition table type: EFI GPT

Analyse Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906928640 sectors
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906928640 sectors
FAT32 at 2048/0/1
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)

FAT32 at 2048/0/1
FAT: cluster=2(0x2), pos=26624
EFI System 2048 67110911 67108864 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB

HFS magic value at 347957696/0/1
part_size 2880
Mac HFS 347957696 347960575 2880 [System Startup]
HFS blocksize=512, 1474 KB / 1440 KiB

HFS magic value at 347963568/0/1
part_size 1600
Mac HFS 347963568 347965167 1600 [MacDrawStartup]
HFS blocksize=512, 819 KB / 800 KiB
NTFS at 349272495/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size 20948697
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 1309293
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 328323799 349272495 20948697
NTFS found using backup sector, blocksize=4096, 10725 MB / 10228 MiB
NTFS at 349272495/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size 20948697
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 1309293
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 349272495 370221191 20948697
NTFS, blocksize=4096, 10725 MB / 10228 MiB

HFS+ magic value at 683109580/0/1
part_size 682699944
Mac HFS 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB
Search for partition aborted

Results
P EFI System 2048 67110911 67108864 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB
MS Data 328323799 349272495 20948697
NTFS found using backup sector, blocksize=4096, 10725 MB / 10228 MiB
Mac HFS 347957696 347960575 2880 [System Startup]
HFS blocksize=512, 1474 KB / 1440 KiB
Mac HFS 347963568 347965167 1600 [MacDrawStartup]
HFS blocksize=512, 819 KB / 800 KiB
MS Data 349272495 370221191 20948697
NTFS, blocksize=4096, 10725 MB / 10228 MiB
P Mac HFS 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB
gpt_change_part_type
Change partition type:
P Mac HFS 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB
Change partition type:
P HFS+ 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB

interface_write()
1 P EFI System 2048 67110911 67108864 [EFI System Partition] [ESD-USB]
2 P Mac HFS 683109580 1365809523 682699944
write!
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.


Sat Apr 1 23:05:10 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 16.4.0 (Darwin Kernel Version 16.4.0: Thu Dec 22 22:53:21 PST 2016; root:xnu-3789.4
Compiler: GCC 4.0
Compilation date: 2017-03-16T18:15:19
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/disk2 - 2000 GB / 1862 GiB - 3906928640 sectors, sector size=512
Disk /dev/rdisk0 - 251 GB / 233 GiB - 490234752 sectors (RO), sector size=512
Disk /dev/rdisk1 - 178 GB / 165 GiB - 347657384 sectors (RO), sector size=512
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906928640 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/rdisk2 - 2000 GB / 1862 GiB
Partition table type: EFI GPT

Analyse Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906928640 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906928639 (expected 3906928639)
hdr_lba_start=34
hdr_lba_end=3906928606
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 2048 67110911 67108864 [EFI System Partition]
2 P Mac HFS 683109580 1365809523 682699944

search_part()
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906928640 sectors
FAT32 at 2048/0/1
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)

FAT32 at 2048/0/1
FAT: cluster=2(0x2), pos=26624
EFI System 2048 67110911 67108864 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB

HFS+ magic value at 683109580/0/1
part_size 682699944
Mac HFS 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB
Search for partition aborted

Results
P EFI System 2048 67110911 67108864 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB
P Mac HFS 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB

interface_write()
1 P EFI System 2048 67110911 67108864 [EFI System Partition] [ESD-USB]
2 P Mac HFS 683109580 1365809523 682699944
simulate write!
New geometry
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - CHS 243196 255 63 sector_size=512

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906928639 (expected 3906943739)
hdr_lba_start=34
hdr_lba_end=3906928606
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P EFI System 2048 67110911 67108864 [EFI System Partition]
2 P Mac HFS 683109580 1365809523 682699944
HFS+ blocksize=4096, 349 GB / 325 GiB
New options :
Dump : No
Align partition: Yes
Expert mode : No

Analyse Disk /dev/rdisk2 - 2000 GB / 1862 GiB - CHS 243196 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906928639 (expected 3906943739)
hdr_lba_start=34
hdr_lba_end=3906928606
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 2048 67110911 67108864 [EFI System Partition]
2 P Mac HFS 683109580 1365809523 682699944
Top
plsncld
Posts: 5
Joined: 30 Mar 2017, 07:59

Re: Windows partitioned HFS+ drive

#5 Post by plsncld »

Does anyone have any suggestions? I had lots of really important data on there.

The drive is actually 2 disks in a USB RAID enclosure in RAID 1. Would it help recovery to plug a drive into SATA instead?
Top
Locked

Return to “Partition Recovery”