Recovering HFS+. Last step

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
retrorec
Posts: 12
Joined: 17 Oct 2019, 16:43

Re: Recovering HFS+. Last step

#11 Post by retrorec »

Sorry...

Code: Select all

non-tried:    9223 PB
pct rescued:    0.00%, read errors:
This ones
Is it important?
Thank you for your replies.

recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering HFS+. Last step

#12 Post by recuperation »

retrorec wrote: 23 Oct 2019, 06:47 Sorry...

Code: Select all

non-tried:    9223 PB
pct rescued:    0.00%, read errors:
This ones
Is it important?
Thank you for your replies.
The non-tried area can not be bigger than your disk size of 2TB.
Your screenshot shows that you already duplicated 600 GB (not 60 GB as you said) out of 2 TB = 2000 GB which is 30%.
Both figures are wrong.
Ignore them and let the copy process finish. You can research these errors or file a bug report afterwards.

retrorec
Posts: 12
Joined: 17 Oct 2019, 16:43

Re: Recovering HFS+. Last step

#13 Post by retrorec »

recuperation wrote: 23 Oct 2019, 08:02
The non-tried area can not be bigger than your disk size of 2TB.
Your screenshot shows that you already duplicated 600 GB (not 60 GB as you said) out of 2 TB = 2000 GB which is 30%.
Both figures are wrong.
Ignore them and let the copy process finish. You can research these errors or file a bug report afterwards.
You are right. It was 600 GiB
Now...1548 GB, 2d 11h 20m, 6,8Mb/s, 85% aprox

Code: Select all

     ipos:    1549 GB, non-trimmed:        0 B,  current rate:   6815 kB/s
     opos:    1549 GB, non-scraped:        0 B,  average rate:   7251 kB/s
non-tried:    9223 PB,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:    1549 GB,   bad areas:        0,        run time:  2d 11h 20m
pct rescued:    0.00%, read errors:        0,  remaining time:         n/a
                              time since last successful read:          0s
Copying non-tried blocks... Pass 1 (forwards)
Ok. I will wait. Thank you.

retrorec
Posts: 12
Joined: 17 Oct 2019, 16:43

Re: Recovering HFS+. Last step

#14 Post by retrorec »

Finished

Code: Select all

     ipos:    2000 GB, non-trimmed:        0 B,  current rate:   5199 kB/s
     opos:    2000 GB, non-scraped:        0 B,  average rate:   7242 kB/s
non-tried:        0 B,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:    2000 GB,   bad areas:        0,        run time:  3d  4h 43m
pct rescued:    0.00%, read errors:        0,  remaining time:         n/a
                              time since last successful read:         n/a
Finished                                     
sh-3.2# 

retrorec
Posts: 12
Joined: 17 Oct 2019, 16:43

Re: Recovering HFS+. Last step

#15 Post by retrorec »

Thank you in davance.
Last two questions before proceed.

Ok. I am ready to proceed with the recovery (please see my first post if you need more information)

General steps:

1- I used Testdisk, with deep search (20 days about) to find lost partitions, and I found it

Code: Select all

>D MS Data                     2048 3867961343 3867959296 [T2_B]
2- I used ddrescue to clon the disk (if something goes wrong with the rcovering with Testdisk)

Code: Select all

     ipos:    2000 GB, non-trimmed:        0 B,  current rate:   5199 kB/s
     opos:    2000 GB, non-scraped:        0 B,  average rate:   7242 kB/s
non-tried:        0 B,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:    2000 GB,   bad areas:        0,        run time:  3d  4h 43m
pct rescued:    0.00%, read errors:        0,  remaining time:         n/a
                              time since last successful read:         n/a
Finished 
Solution offered by cgreiner
cgrenier wrote: 20 Oct 2019, 10:14 When you see

Code: Select all

D MS Data                     2048 3867961343 3867959296 [T2_B]
use the arrow keys to switch this partition to P(rimary)
On next screen, choose Write, confirm, Quit
Remenber that I had four partitions. (please see my first post if you need more information)
Old partition table. I need to recover

It had FOUR partitions. GPT table with
1) EFI 200 MB
2) HFS+ 1844 GB (with data) !!!!!!!! i need to recover it
3) HFS+ 10 GB (not important)
4) HFS+ 10 GB (not important)
Some advice before proceed?

Question 1: Could I ignore the other three partitions and proceed to rewrite partition table as Prymary only for "MS Data" partition?
Question 2: Do you recommend me to act over the cloned disk? I mean, to repeat all steps in the cloned disk: scanning it and trying to repair cloned partition table?
Thanks a lot

recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering HFS+. Last step

#16 Post by recuperation »

retrorec wrote: 25 Oct 2019, 08:38 Question 1: Could I ignore the other three partitions and proceed to rewrite partition table as Prymary only for "MS Data" partition?
You can.
Question 2: Do you recommend me to act over the cloned disk? I mean, to repeat all steps in the cloned disk: scanning it and trying to repair cloned partition table?
Modifications of a partition table in GPT format are not as risky as modifying the old style ones.
Nevertheless, I would recommend everybody to produce a duplicate of a failing drive and to duplicate that again.
You would work on the second copy and you always have the option to restore the original content using your first copy.

retrorec
Posts: 12
Joined: 17 Oct 2019, 16:43

Re: Recovering HFS+. Last step

#17 Post by retrorec »

recuperation wrote: 25 Oct 2019, 09:58
retrorec wrote: 25 Oct 2019, 08:38
Question 2: Do you recommend me to act over the cloned disk? I mean, to repeat all steps in the cloned disk: scanning it and trying to repair cloned partition table?
Modifications of a partition table in GPT format are not as risky as modifying the old style ones.
Nevertheless, I would recommend everybody to produce a duplicate of a failing drive and to duplicate that again.
You would work on the second copy and you always have the option to restore the original content using your first copy.
ok!!! So...

I will reply the process in the cloned disk

Cloned disk 1863 GiB

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/rdisk4 - 2000 GB / 1863 GiB - 3907029168 sectors

     Partition                  Start        End    Size in sectors

 1 P EFI System                    40     409639     409600 [EFI System Partition] [EFI]
 2 P Mac HFS                   409640 3906766983 3906357344



 [  Quit  ]  [ Return ] >[Deeper Search]  [ Write  ]
                          Try to find more partitions
It seems identical.
New partition table and searching on process 00%
See you in two weeks about :)

retrorec
Posts: 12
Joined: 17 Oct 2019, 16:43

Re: Recovering HFS+. Last step

#18 Post by retrorec »

Hello again
After 12 days scanning the cloned 2TB HDD, I was ready to try to rescue the partition table.
Both 2TB HDDs seems identicals. Nice

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/rdisk4 - 2000 GB / 1863 GiB - 3907029168 sectors
     Partition               Start        End    Size in sectors
 D EFI System                    40     409639     409600 [EFI System Partition] [EFI]
 D EFI System                    46     409645     409600 [EFI System Partition] [EFI]
>P MS Data                     2048 3867961343 3867959296 [T2_B]
 D Mac HFS                   409640 3906766983 3906357344
 D Mac HFS                   528920 3906886263 3906357344
 D Mac HFS                   528992 3906886335 3906357344
 Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
NTFS found using backup sector, blocksize=4096, 1980 GB / 1844 GiB
 

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/rdisk4 - 2000 GB / 1863 GiB - 3907029168 sectors

     Partition                  Start        End    Size in sectors

 1 P MS Data                     2048 3867961343 3867959296 [T2_B]

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Write partition table, confirm ? (Y/N)
I select "P" and Write and this is the result

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/rdisk4 - 2000 GB / 1863 GiB - 3907029168 sectors
     Partition                  Start        End    Size in sectors
 1 P MS Data                     2048 3867961343 3867959296 [T2_B]

Boot sector
Status: Bad

Backup boot sector
Warning: number of heads/cylinder mismatches 255 (NTFS) != 1 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 1 (HD)
Status: OK

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.


 [  Quit  ]  [  List  ] >[Backup BS]  [Rebuild BS]  [  Dump  ]
                    Copy backup boot sector over boot sector
Boot sector
Status: Bad

What now?

"Rebuild BS", "Write" and reboot?

retrorec
Posts: 12
Joined: 17 Oct 2019, 16:43

Re: Recovering HFS+. Last step

#19 Post by retrorec »

Please help. I am trying to write a new partición table
(see previous post) but TestDisk says:

Boot sector
Status: Bad
What now?

"Rebuild BS", "Write" and reboot?

Thank you in advance.

Locked