external HD split into 2 partitions (win + mac) gone wrong - now windows partition missing

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
slindow
Posts: 3
Joined: 09 Nov 2017, 09:07

external HD split into 2 partitions (win + mac) gone wrong - now windows partition missing

#1 Post by slindow »

Hi.

A WD external HD of 1 TB (MDL: wd10000H1Q-00) was filled up with data of 400 GB, so I wanted to split the HD into two parts, creating a new mac os extended partition for the apple time machine of my Macbook. It was unplugged during the process, so the whole disk now is uninitialised (but just one, not two, partitions). When running the analysis of testdisk, it imidiately finds this one drive as a Mac partition.

I want my data back, so I guess that I would need to transform it back to the old file system? I dont care for the structure of the disk, so I am ok with exporting the data and setting the disk to zero, but of course the case would be easy.
1) I dont know which the default file system was. (" Most WD Drives come formatted in the NTFS (Windows) or HFS+ (Mac) format.", says WD)
2) I dont remember if I changed this default years ago.
3) I would not know how to do a filesystem change in textdisk.
4) I dont know what the steps to export data (e.g. with PhotoRec) would be.

I am grateful for any instructions or guidance.

Here is the log:


Tue Nov 07 19:21:42 2017
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=105841670144
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=142682882048
Hard disk list
Disk \\.\PhysicalDrive0 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 105 GB / 98 GiB - CHS 12867 255 63, sector size=512
Drive D: - 142 GB / 132 GiB - CHS 17346 255 63, sector size=512

Partition table type (auto): Mac
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB
Partition table type: Mac

Analyse Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
check_part_mac failed for partition type AF
check_part_mac failed for partition type AF
Current partition structure:
Bad MAC partition, invalid block0 signature
1 P partition_map 1 63 63
2 P HFS 64 262207 262144
2 P HFS 64 262207 262144
3 P HFS 262208 1953525151 1953262944
3 P HFS 262208 1953525151 1953262944
4 P Free 1953525152 1953525167 16

search_part()
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 70608/40/25
filesystem size 1134320002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122095000
clusters_per_mft_record -10
clusters_per_index_record 1
Unknown 1134320064 2268640065 1134320002
NTFS, blocksize=4096, 580 GB / 540 GiB
Partition not added.

HFS+ magic value at 70608/65/50

HFS+ magic value at 70608/65/50
part_size 819200000
HFS 1134321664 1953521663 819200000
HFS+ blocksize=4096 + Backup, 419 GB / 390 GiB
file_win32_pread(220,3,buffer,1953525166(121601/80/62)) read err: read after end of file
file_win32_pread(220,8,buffer,1953525167(121601/80/63)) read err: read after end of file

Results
P HFS 1134321664 1953521663 819200000
HFS+ blocksize=4096 + Backup, 419 GB / 390 GiB

P HFS 1134321664 1953521663 819200000
HFS+ blocksize=4096 + Backup, 419 GB / 390 GiB
Support for this filesystem hasn't been implemented.

P HFS 1134321664 1953521663 819200000
HFS+ blocksize=4096 + Backup, 419 GB / 390 GiB
Support for this filesystem hasn't been implemented.



Thu Nov 09 09:13:48 2017
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: external HD split into 2 partitions (win + mac) gone wrong - now windows partition missing

#2 Post by cgrenier »

You need to post the results of Quick search AND Deeper Search.
Please quit the application properly to get a full log file.

slindow
Posts: 3
Joined: 09 Nov 2017, 09:07

Re: external HD split into 2 partitions (win + mac) gone wrong - now windows partition missing

#3 Post by slindow »

Hi,

I did so. it took several days. After deeper search, I quit the program. Strangely the logfile has the same "date last changed" when I started the procedure. This is its content:




Tue Nov 28 11:44:38 2017
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=105841670144
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=142682882048
Hard disk list
Disk \\.\PhysicalDrive0 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 105 GB / 98 GiB - CHS 12867 255 63, sector size=512
Drive D: - 142 GB / 132 GiB - CHS 17346 255 63, sector size=512

Partition table type (auto): Mac
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB
Partition table type: Mac

Analyse Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
check_part_mac failed for partition type AF
check_part_mac failed for partition type AF
Current partition structure:
Bad MAC partition, invalid block0 signature
1 P partition_map 1 63 63
2 P HFS 64 262207 262144
2 P HFS 64 262207 262144
3 P HFS 262208 1953525151 1953262944
3 P HFS 262208 1953525151 1953262944
4 P Free 1953525152 1953525167 16

search_part()
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 70608/40/25
filesystem size 1134320002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122095000
clusters_per_mft_record -10
clusters_per_index_record 1
Unknown 1134320064 2268640065 1134320002
NTFS, blocksize=4096, 580 GB / 540 GiB
Partition not added.

HFS+ magic value at 70608/65/50

HFS+ magic value at 70608/65/50
part_size 819200000
HFS 1134321664 1953521663 819200000
HFS+ blocksize=4096 + Backup, 419 GB / 390 GiB
file_win32_pread(208,3,buffer,1953525166(121601/80/62)) read err: read after end of file
file_win32_pread(208,8,buffer,1953525167(121601/80/63)) read err: read after end of file

Results
P HFS 1134321664 1953521663 819200000
HFS+ blocksize=4096 + Backup, 419 GB / 390 GiB

interface_write()
P HFS 1134321664 1953521663 819200000

search_part()
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/1
filesystem size 1134320002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122095000
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=32256, part_size=580771841024, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 70608/40/25
filesystem size 1134320002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122095000
clusters_per_mft_record -10
clusters_per_index_record 1
Unknown 1134320064 2268640065 1134320002
NTFS, blocksize=4096, 580 GB / 540 GiB
Partition not added.

HFS+ magic value at 70608/65/50

HFS+ magic value at 70608/65/50
part_size 819200000
HFS 1134321664 1953521663 819200000
HFS+ blocksize=4096 + Backup, 419 GB / 390 GiB
file_win32_pread(208,8,buffer,1953525161(121601/80/57)) read err: read after end of file
file_win32_pread(208,8,buffer,1953525167(121601/80/63)) read err: read after end of file

Results
P HFS 1134321664 1953521663 819200000
HFS+ blocksize=4096 + Backup, 419 GB / 390 GiB

interface_write()
P HFS 1134321664 1953521663 819200000

slindow
Posts: 3
Joined: 09 Nov 2017, 09:07

Re: external HD split into 2 partitions (win + mac) gone wrong - now windows partition missing

#4 Post by slindow »

I found a newer log file which was saved somewhere else (strangely):




Tue Nov 28 11:44:38 2017
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=105841670144
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=142682882048
Hard disk list
Disk \\.\PhysicalDrive0 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 105 GB / 98 GiB - CHS 12867 255 63, sector size=512
Drive D: - 142 GB / 132 GiB - CHS 17346 255 63, sector size=512

Partition table type (auto): Mac
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB
Partition table type: Mac

Analyse Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
check_part_mac failed for partition type AF
check_part_mac failed for partition type AF
Current partition structure:
Bad MAC partition, invalid block0 signature
1 P partition_map 1 63 63
2 P HFS 64 262207 262144
2 P HFS 64 262207 262144
3 P HFS 262208 1953525151 1953262944
3 P HFS 262208 1953525151 1953262944
4 P Free 1953525152 1953525167 16

search_part()
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 70608/40/25
filesystem size 1134320002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122095000
clusters_per_mft_record -10
clusters_per_index_record 1
Unknown 1134320064 2268640065 1134320002
NTFS, blocksize=4096, 580 GB / 540 GiB
Partition not added.

HFS+ magic value at 70608/65/50

HFS+ magic value at 70608/65/50
part_size 819200000
HFS 1134321664 1953521663 819200000
HFS+ blocksize=4096 + Backup, 419 GB / 390 GiB
file_win32_pread(208,3,buffer,1953525166(121601/80/62)) read err: read after end of file
file_win32_pread(208,8,buffer,1953525167(121601/80/63)) read err: read after end of file

Results
P HFS 1134321664 1953521663 819200000
HFS+ blocksize=4096 + Backup, 419 GB / 390 GiB

interface_write()
P HFS 1134321664 1953521663 819200000

search_part()
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/1
filesystem size 1134320002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122095000
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=32256, part_size=580771841024, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 70608/40/25
filesystem size 1134320002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122095000
clusters_per_mft_record -10
clusters_per_index_record 1
Unknown 1134320064 2268640065 1134320002
NTFS, blocksize=4096, 580 GB / 540 GiB
Partition not added.

HFS+ magic value at 70608/65/50

HFS+ magic value at 70608/65/50
part_size 819200000
HFS 1134321664 1953521663 819200000
HFS+ blocksize=4096 + Backup, 419 GB / 390 GiB
file_win32_pread(208,8,buffer,1953525161(121601/80/57)) read err: read after end of file
file_win32_pread(208,8,buffer,1953525167(121601/80/63)) read err: read after end of file

Results
P HFS 1134321664 1953521663 819200000
HFS+ blocksize=4096 + Backup, 419 GB / 390 GiB

interface_write()
P HFS 1134321664 1953521663 819200000

Locked