Recovering HFS+. Last step

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
retrorec
Posts: 12
Joined: 17 Oct 2019, 16:43

Recovering HFS+. Last step

#1 Post by retrorec »

Hi!

I have 2TB Toshiba 3.0 HDD. (1863 GiB) I use it on MAc and Windows (with special soft to read/write HFS+ on Win)in HFS+ format to storage data. I deleted and rewrited the partition table accidently with DiskMaker 6 in Macosx 10.9.5 (app to build a bootable drive from OS X) I recovered data with other software (DiskDrill) but I want to recover not data but the partition with the data.

New patition table

>P EFI System 40 409639 409600 [EFI System Partition] [EFI]
P Mac HFS 409640 3906766983 3906357344 (1862.70GiB)

Old partition table. I need to recover

It had FOUR partitions. GPT table with
1) EFI 200 MB
2) HFS+ 1844 GB (with data) !!!!!!!! i need to recover it
3) HFS+ 10 GB (not important)
4) HFS+ 10 GB (not important)

I am using Test disk 7.2 and after 20 days scanning this is the result:

Steps:

Step 1: I select >Disk /dev/rdisk1 - 2000 GB / 1863 GiB

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

  TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.

Select a media (use Arrow keys, then press Enter):
 Disk /dev/disk0 - 320 GB / 298 GiB (RO)
 Disk /dev/disk1 - 2000 GB / 1863 GiB
 Disk /dev/rdisk0 - 320 GB / 298 GiB (RO)
>Disk /dev/rdisk1 - 2000 GB / 1863 GiB

>[Proceed ]  [  Quit  ]

Note: Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has an incorrect size, check HD jumper settings and BIOS
detection, and install the latest OS patches and disk drivers.
Step 2: I select > [EFI GPT] EFI GPT partition map (Mac i386, some x86_64...) by default

Code: Select all

[EFI GPT]  EFI GPT partition map (Mac i386, some x86_64...)
Step 3: Analize

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/rdisk1 - 2000 GB / 1863 GiB - 3907029164 sectors
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P EFI System                    40     409639     409600 [EFI System Partition]
 2 P Mac HFS                   409640 3906766983 3906357344 [F40ACFF5-8EF4-40F1-9E30-AED3B053FE1]
]]]]]]1]E1]]1]E1]

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/rdisk1 - 2000 GB / 1863 GiB - 3907029164 sectors
     Partition               Start        End    Size in sectors
>P EFI System                    40     409639     409600 [EFI System Partition] [EFI]
 P Mac HFS                   409640 3906766983 3906357344
But TestDisk can only find created new gpt partition table

>P EFI System 40 409639 409600 [EFI System Partition] [EFI]
P Mac HFS 409640 3906766983 3906357344

Step 4: Deep search

And eureka, the entry I want to recover appears:
MS Data 3867961343 7735920638 3867959296 (1844.39 GiB) !!!!!!!!!!!!!!!!!!!!


Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/rdisk1 - 2000 GB / 1863 GiB - 3907029164 sectors

The harddisk (2000 GB / 1863 GiB) seems too small! (< 27 TB / 24 TiB)
Check the harddisk size: HD jumper settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
   Linux Swap             135573589 50820287812 50684714224
   Linux Swap             149321341 34545772140 34396450800
   Linux Swap             155207957 37655431428 37500223472
   Linux Swap             172895965 34569346764 34396450800
   Linux Swap             175850245 31435446820 31259596576
   Linux Swap             190587637 35894870964 35704283328
   Linux Swap            2477126901 53161841124 50684714224
   Linux Swap            2632993125 37029443924 34396450800
   Linux Swap            2652489949 33912086524 31259596576
>  MS Data               3867961343 7735920638 3867959296    >>>>>> I want to recover this partition!!!!!!!!!
   Mac HFS               3906766980 7813124323 3906357344

[ Continue ]
NTFS, blocksize=4096, 1980 GB / 1844 GiB
Step 5: Continue. I choose "MS Data" (I dont know why it is listed as MS Data when the partition was HFS+?)

And I found it!!!

>D MS Data 2048 3867961343 3867959296 [T2_B]

with the correct name: [T2_B]
with the correct size: 1844 GiB
I can see the documents choosing "P" key

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/rdisk1 - 2000 GB / 1863 GiB - 3907029164 sectors
     Partition               Start        End    Size in sectors
 D EFI System                    40     409639     409600 [EFI System Partition] [EFI]
 D EFI System                    46     409645     409600 [EFI System Partition] [EFI]
>D MS Data                     2048 3867961343 3867959296 [T2_B]
 D Mac HFS                   409640 3906766983 3906357344
 D Mac HFS                   528920 3906886263 3906357344
 D Mac HFS                   528992 3906886335 3906357344
 D Mac HFS                   529096 3906886439 3906357344
 D Mac HFS                   529128 3906886471 3906357344
 D Mac HFS                   529168 3906886511 3906357344
 D Mac HFS                   529248 3906886591 3906357344
 D Mac HFS                   529376 3906886719 3906357344
 D Mac HFS                   529456 3906886799 3906357344
 D Mac HFS                   529536 3906886879 3906357344
 D Mac HFS                   529648 3906886991 3906357344
 D Mac HFS                   529704 3906887047 3906357344
 D Mac HFS                   529768 3906887111 3906357344
 D Mac HFS                   529832 3906887175 3906357344
 D Mac HFS                   529888 3906887231 3906357344
 D Mac HFS                   530000 3906887343 3906357344
 D Mac HFS                   530112 3906887455 3906357344
 D Mac HFS                   530216 3906887559 3906357344
 D Mac HFS                   530256 3906887599 3906357344
 D Mac HFS                   530368 3906887711 3906357344
 D Mac HFS                   530432 3906887775 3906357344
 D Mac HFS                   530528 3906887871 3906357344
 D Mac HFS                   530592 3906887935 3906357344
 D Mac HFS                   530680 3906888023 3906357344
 D Mac HFS                   530736 3906888079 3906357344
 D Mac HFS                   530824 3906888167 3906357344
Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
NTFS found using backup sector, blocksize=4096, 1980 GB / 1844 GiB
Step 6: What I have to do?!!!!!

Remenber that I had 4 partitions. EFI (200Mb) , HFHS+ (1844 Gib), HFHS+ (10Gib), HFHS+ (10 Gib).
I want to recover all the partition 3, with data inside (1844 GiB)
It was hfs+ format but I found MS Data format 1844 GiB)

So...What I have to do?!!!!!

a) Use Left/Right Arrow keys to CHANGE partition characteristics: P=Primary D=Deleted. Enter: to continue???
b) Keys A: add partition, L: load backup, T: change type, Enter: to continue ???
c) Use gpt in command line??? https://apple.stackexchange.com/questio ... t-writable
d) Use pdisk in command line??? https://apple.stackexchange.com/questio ... t-writable
e) other solution....
f) If I write the partition table could I find again the partitions?
g) Coul I proceed whith "Write" in the next step only for the partition with 1844 GiB or should I recover all of them?

Thank you in advance. Please. Help me.
Last edited by retrorec on 23 Oct 2019, 06:49, edited 1 time in total.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering HFS+. Last step

#2 Post by cgrenier »

When you see

Code: Select all

D MS Data                     2048 3867961343 3867959296 [T2_B]
use the arrow keys to switch this partition to P(rimary)
On next screen, choose Write, confirm, Quit

retrorec
Posts: 12
Joined: 17 Oct 2019, 16:43

Re: Recovering HFS+. Last step

#3 Post by retrorec »

cgrenier wrote: 20 Oct 2019, 10:14 When you see

Code: Select all

D MS Data                     2048 3867961343 3867959296 [T2_B]
use the arrow keys to switch this partition to P(rimary)
On next screen, choose Write, confirm, Quit
Ok.
Thank you for the reply cgreiner.
Before proceed....Do you recommend me to do a full disk backup (cloning the disk with ddrescue)?

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering HFS+. Last step

#4 Post by recuperation »

retrorec wrote: 20 Oct 2019, 12:02 Before proceed....Do you recommend me to do a full disk backup (cloning the disk with ddrescue)?
Modifications to a GPT table are less risky than modifications to the old MBR style one.
Nevertheless I would recommend cloning because your deep search seemed to be very slow.

retrorec
Posts: 12
Joined: 17 Oct 2019, 16:43

Re: Recovering HFS+. Last step

#5 Post by retrorec »

Ok.
I proceed to clon the disk with ddrescue to anothe 2TB HHD.

Fom
Descripción del disco : TOSHIBA External USB 3.0 Media Capacidad total : 2 TB (2.000.398.931.968 bytes)
To:
Descripción del disco : TOSHIBA External USB 3.0 Media Capacidad total : 2 TB (2.000.398.934.016 bytes)

with:
unmount disks and...

Code: Select all

ddrescue -f /dev/disk1 /dev/disk4 /Users/xxx/Documents/logfile-2000GB.txt
I estimate 4 days. It works.
Is it ok the code?

Thank you.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering HFS+. Last step

#6 Post by recuperation »

I never used the -f parameter because I duplicated to empty disks.

If you know the sustained tranfer rate of your drive and ddrescue seems to be slow without showing read errors for sectors play around with the -c parameter:

[...-c sectors
--cluster-size=sectors
Number of sectors to copy at a time. Defaults to 64 KiB / sector_size. Try smaller values for slow drives. The number of sectors per track (18 or 9) is a good value for floppies.
...]

I used a value of 2048. You can try out a certain value and stop ddrescue afterwards and rerun with a different value to test which one works best. As long as you use the same name of logfile each tryout continues the search process.

retrorec
Posts: 12
Joined: 17 Oct 2019, 16:43

Re: Recovering HFS+. Last step

#7 Post by retrorec »

recuperation wrote: 21 Oct 2019, 21:27 I never used the -f parameter because I duplicated to empty disks.

If you know the sustained tranfer rate of your drive and ddrescue seems to be slow without showing read errors for sectors play around with the -c parameter:

[...-c sectors
--cluster-size=sectors
Number of sectors to copy at a time. Defaults to 64 KiB / sector_size. Try smaller values for slow drives. The number of sectors per track (18 or 9) is a good value for floppies.
...]

I used a value of 2048. You can try out a certain value and stop ddrescue afterwards and rerun with a different value to test which one works best. As long as you use the same name of logfile each tryout continues the search process.
Very interesting. Thank you "recuperation".
I will try it in the future. I can wait 3-4 days and it is my first experience with ddrescue.

After 23 hours aprox., 60 Gib cloned at 7Mb/s

Code: Select all

 
   ipos:  597629 MB, non-trimmed:        0 B,  current rate:   7274 kB/s
   opos:  597629 MB, non-scraped:        0 B,  average rate:   7301 kB/s
non-tried:    9223 PB,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:  597629 MB,   bad areas:        0,        run time: 22h 44m 10s
pct rescued:    0.00%, read errors:        0,  remaining time:         n/a
                              time since last successful read:          0s
Copying non-tried blocks... Pass 1 (forwards)
Is it good speed?

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering HFS+. Last step

#8 Post by recuperation »

retrorec wrote: 22 Oct 2019, 17:51 Is it good speed?
Not really. With an old Thinkpad from 2008 combined with an USB 3.0 expresscard I get transfer rates of 60-70MB/sec on file level with h2testw.

ddrescue can do much better. But at least I don't see any errors.
It's only the huge disk size in "PB" and the rescue figure of 0% that makes me wonder.

retrorec
Posts: 12
Joined: 17 Oct 2019, 16:43

Re: Recovering HFS+. Last step

#9 Post by retrorec »

Not really. With an old Thinkpad from 2008 combined with an USB 3.0 expresscard I get transfer rates of 60-70MB/sec on file level with h2testw.
ok
It's only the huge disk size in "PB" and the rescue figure of 0% that makes me wonder.
As a practice...I have tried before to cloning 4 GiB USB Storage into 16 GiB USB Storage and the process was successful, and the parameters were the same.

Code: Select all

non-tried:    9223 PB
pct rescued:    0.00%, read errors:
So, I want to clon it with ddrescue to have a backup, because after that I want to try to rewrite the partition table (post nr. 1) with Testdisk.
I readed https://www.gnu.org/software/ddrescue/m ... anual.html but I dont understand well what that parameters means in my case.
I hope everithing goes well.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering HFS+. Last step

#10 Post by recuperation »

retrorec wrote: 22 Oct 2019, 20:36 but I dont understand well what that parameters means in my case.
I hope everithing goes well.
I don't understand what you mean by referring to "that parameters".

Locked