Please help recover Mac OS Extended partition Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
robertosc
Posts: 9
Joined: 10 Apr 2019, 11:30

Please help recover Mac OS Extended partition

#1 Post by robertosc »

Can you please help me recovering my backup HDD? I don't know how to proceed.

It's a WD Elements 1.5TB, one 1TB exFAT partition that successfully gets mounted and a 0.5TB that doesn't get mounted.

This is what I get when running fsck_hfs /dev/disk2s1:

Executing fsck_hfs (version hfs-366.70.3).
** Checking Journaled HFS Plus volume.
Invalid B-tree node size
(3, 0)
** The volume could not be verified completely.

This is the result of a deep search:
deep search.png
deep search.png (81.48 KiB) Viewed 5647 times
I see two repeated partitions. I think I'm supposed to mark one of them as primary and let the other be deleted, but I don't know which one to choose since I can't see files in HFS partitions.
What should I do?
Thank you!

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Please help recover Mac OS Extended partition

#2 Post by recuperation »

The first partition labeled "Mac HFS" should be the right one because the second partition labeled "Mac HFS" overlaps with your partition that is 1TB big.

robertosc
Posts: 9
Joined: 10 Apr 2019, 11:30

Re: Please help recover Mac OS Extended partition

#3 Post by robertosc »

Thank you. I selected the first and thrid as Primary (for some reason Logical doesn't show up as an option for me) and later selected Write.
Restarted my computer but I'm getting the same result (the third gets mounted, the first doesn't).
I ran sudo fsck_hfs -r -d /dev/disk2s1 many times, and I always get:

Code: Select all

journal_replay(/dev/disk2s1) returned 0
** /dev/rdisk2s1
	Using cacheBlockSize=32K cacheTotalBlock=32768 cacheSize=1048576K.
   Executing fsck_hfs (version hfs-366.70.3).
** Checking Journaled HFS Plus volume.
   Invalid B-tree node size
(3, 0)
** The volume   could not be verified completely.
	volume check failed with error 7
	volume type is pure HFS+
	primary MDB is at block 0 0x00
	alternate MDB is at block 0 0x00
	primary VHB is at block 2 0x02
	alternate VHB is at block 894661246 0x3553727e
	sector size = 512 0x200
	VolumeObject flags = 0x07
	total sectors for volume = 894661248 0x35537280
	total sectors for embedded volume = 0 0x00
	CheckHFS returned -1317, fsmodified = 0
I have no idea what all this means and I'm completely stuck :(

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Please help recover Mac OS Extended partition

#4 Post by recuperation »

I don't know either. I am not familiar with HFS+ type partitions!

Run Testdisk and use the p-key to look inside the partitions to see if the content meets your expectations.
If that fails you can try "deep search" as well.

robertosc
Posts: 9
Joined: 10 Apr 2019, 11:30

Re: Please help recover Mac OS Extended partition

#5 Post by robertosc »

Testdisk is not able to see content inside HFS+ partitions, is it?

Those were the results of a deep search :(

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Please help recover Mac OS Extended partition

#6 Post by recuperation »

As for logical partitions, this is a term based on the definitions of the old school nested partition tables (primary partitions, extended partitions, logical partitions)
Youre drive is using the modern and better GPT scheme. There are no "logical" partitions anymore, as far as I know - I use legacy products with old structures. :P

I don't kow either if Testdisk is able to list directories of HFS+ partitions.
Without knowing this you could set the first MAC HFS partition to primary, save and restart or reconnect to an Apple computer.
Then you will see if an Apple computer lists the partition and content in there.

The next step is to set the first partition back to "deleted" and to set the second partition to "primary", write and restart or reconnect to see if your Apple computer can look into the second partition.

You should not set both of them simultaneously to "primary" because they are overlapping.

What confuses me is that your computer is mounting the 1TB partition although it is marked as deleted!

robertosc
Posts: 9
Joined: 10 Apr 2019, 11:30

Re: Please help recover Mac OS Extended partition

#7 Post by robertosc »

I tried to set the first MAC HFS and it didn't work, so will try to set the second as you said.
The problem is it takes days for Testdisk to find these partitions on deep search, is there a way to save a search so I can load and try multiple combinations?

I'm doing a deep search now... should be ready before the weekend.

Meanwhile, another question: I'm selecting "EFI GPT" for the disk type when I start Testdisk. That's the correct type, not "Intel", right? This is an external USB drive with a HFS+ and an ExFat partition, I don't understand what makes a disk be "EFI GPT" or "Intel"... :?
What confuses me is that your computer is mounting the 1TB partition although it is marked as deleted!
That's a screenshot from after a deep search. The PDF says chances are partitions will be listed as deleted after a search, so I guess that's what's happening.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Please help recover Mac OS Extended partition

#8 Post by recuperation »

robertosc wrote: 11 Dec 2019, 01:14 I tried to set the first MAC HFS and it didn't work, so will try to set the second as you said.
The problem is it takes days for Testdisk to find these partitions on deep search, is there a way to save a search so I can load and try multiple combinations?
I don't think so.
I'm doing a deep search now... should be ready before the weekend.

Meanwhile, another question: I'm selecting "EFI GPT" for the disk type when I start Testdisk. That's the correct type, not "Intel", right? This is an external USB drive with a HFS+ and an ExFat partition, I don't understand what makes a disk be "EFI GPT" or "Intel"... :?
Obviously with two partitions on the drive somebody has modified the original partitioning scheme if this had been purchased as a preformatted external drive which usually contains one partition.

Your partitioning program should show this type of information somewhere.
With a total of 1,5TB disk space both schemes are possible.

If EFI GPT has been used, there is a traditional "Intel" scheme as well on disk. It contains one partition spanning the whole disk.
This is to inform dumb programs that only know the "Intel" structure that the disk is already in use.
If you find this information EFI GPT is very likely.

robertosc
Posts: 9
Joined: 10 Apr 2019, 11:30

Re: Please help recover Mac OS Extended partition

#9 Post by robertosc »

Hi. Sorry for my long delay.

The partitioning program says the map type is indeed GPT.
The next step is to set the first partition back to "deleted" and to set the second partition to "primary", write and restart or reconnect to see if your Apple computer can look into the second partition.
I tried this and it didn't work, nothing shows up.

I'm completely lost now. I tried PhotoRec and it didn't find any files. Do you have any suggestions?

One thing I've noticed is that each program/disk mode I run has a different idea of where the Mac partition ends (or starts!). Please take a look at this screenshot: https://ibb.co/99sLMhh
The top one is PhotoRec, the middle one is TestDisk when I select Intel before searching and the botton one is Testdisk when I select EFI GPT before a deep search (my computer was turned off in the middle of a deep search, and after that it started displaying those weird results). The all have different End values and PhotoRec also has a different Start value.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Please help recover Mac OS Extended partition

#10 Post by recuperation »

robertosc wrote: 23 Dec 2019, 21:34 I'm completely lost now. I tried PhotoRec and it didn't find any files. Do you have any suggestions?
No. The sentence "I tried PhotoRec and it didn't find any files." does not provide any information to work with.

One thing I've noticed is that each program/disk mode I run has a different idea of where the Mac partition ends (or starts!). Please take a look at this screenshot: https://ibb.co/99sLMhh
The top one is PhotoRec, the middle one is TestDisk when I select Intel before searching and the botton one is Testdisk when I select EFI GPT before a deep search (my computer was turned off in the middle of a deep search, and after that it started displaying those weird results). The all have different End values and PhotoRec also has a different Start value.
Picture 2 could be the status quo, Picture 3 is the result of the pending analysis.
Picture 1 could be maybe the result of writing an old school Intel style partition table on a disk that already contained a GPT.

Locked