Please help recover Mac OS Extended partition Topic is solved
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Please help recover Mac OS Extended partition
Can you please help me recovering my backup HDD? I don't know how to proceed.
It's a WD Elements 1.5TB, one 1TB exFAT partition that successfully gets mounted and a 0.5TB that doesn't get mounted.
This is what I get when running fsck_hfs /dev/disk2s1:
Executing fsck_hfs (version hfs-366.70.3).
** Checking Journaled HFS Plus volume.
Invalid B-tree node size
(3, 0)
** The volume could not be verified completely.
This is the result of a deep search:
I see two repeated partitions. I think I'm supposed to mark one of them as primary and let the other be deleted, but I don't know which one to choose since I can't see files in HFS partitions.
What should I do?
Thank you!
It's a WD Elements 1.5TB, one 1TB exFAT partition that successfully gets mounted and a 0.5TB that doesn't get mounted.
This is what I get when running fsck_hfs /dev/disk2s1:
Executing fsck_hfs (version hfs-366.70.3).
** Checking Journaled HFS Plus volume.
Invalid B-tree node size
(3, 0)
** The volume could not be verified completely.
This is the result of a deep search:
I see two repeated partitions. I think I'm supposed to mark one of them as primary and let the other be deleted, but I don't know which one to choose since I can't see files in HFS partitions.
What should I do?
Thank you!
-
- Posts: 2729
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Please help recover Mac OS Extended partition
The first partition labeled "Mac HFS" should be the right one because the second partition labeled "Mac HFS" overlaps with your partition that is 1TB big.
Re: Please help recover Mac OS Extended partition
Thank you. I selected the first and thrid as Primary (for some reason Logical doesn't show up as an option for me) and later selected Write.
Restarted my computer but I'm getting the same result (the third gets mounted, the first doesn't).
I ran sudo fsck_hfs -r -d /dev/disk2s1 many times, and I always get:
I have no idea what all this means and I'm completely stuck
Restarted my computer but I'm getting the same result (the third gets mounted, the first doesn't).
I ran sudo fsck_hfs -r -d /dev/disk2s1 many times, and I always get:
Code: Select all
journal_replay(/dev/disk2s1) returned 0
** /dev/rdisk2s1
Using cacheBlockSize=32K cacheTotalBlock=32768 cacheSize=1048576K.
Executing fsck_hfs (version hfs-366.70.3).
** Checking Journaled HFS Plus volume.
Invalid B-tree node size
(3, 0)
** The volume could not be verified completely.
volume check failed with error 7
volume type is pure HFS+
primary MDB is at block 0 0x00
alternate MDB is at block 0 0x00
primary VHB is at block 2 0x02
alternate VHB is at block 894661246 0x3553727e
sector size = 512 0x200
VolumeObject flags = 0x07
total sectors for volume = 894661248 0x35537280
total sectors for embedded volume = 0 0x00
CheckHFS returned -1317, fsmodified = 0
-
- Posts: 2729
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Please help recover Mac OS Extended partition
I don't know either. I am not familiar with HFS+ type partitions!
Run Testdisk and use the p-key to look inside the partitions to see if the content meets your expectations.
If that fails you can try "deep search" as well.
Run Testdisk and use the p-key to look inside the partitions to see if the content meets your expectations.
If that fails you can try "deep search" as well.
Re: Please help recover Mac OS Extended partition
Testdisk is not able to see content inside HFS+ partitions, is it?
Those were the results of a deep search
Those were the results of a deep search
-
- Posts: 2729
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Please help recover Mac OS Extended partition
As for logical partitions, this is a term based on the definitions of the old school nested partition tables (primary partitions, extended partitions, logical partitions)
Youre drive is using the modern and better GPT scheme. There are no "logical" partitions anymore, as far as I know - I use legacy products with old structures.
I don't kow either if Testdisk is able to list directories of HFS+ partitions.
Without knowing this you could set the first MAC HFS partition to primary, save and restart or reconnect to an Apple computer.
Then you will see if an Apple computer lists the partition and content in there.
The next step is to set the first partition back to "deleted" and to set the second partition to "primary", write and restart or reconnect to see if your Apple computer can look into the second partition.
You should not set both of them simultaneously to "primary" because they are overlapping.
What confuses me is that your computer is mounting the 1TB partition although it is marked as deleted!
Youre drive is using the modern and better GPT scheme. There are no "logical" partitions anymore, as far as I know - I use legacy products with old structures.
I don't kow either if Testdisk is able to list directories of HFS+ partitions.
Without knowing this you could set the first MAC HFS partition to primary, save and restart or reconnect to an Apple computer.
Then you will see if an Apple computer lists the partition and content in there.
The next step is to set the first partition back to "deleted" and to set the second partition to "primary", write and restart or reconnect to see if your Apple computer can look into the second partition.
You should not set both of them simultaneously to "primary" because they are overlapping.
What confuses me is that your computer is mounting the 1TB partition although it is marked as deleted!
Re: Please help recover Mac OS Extended partition
I tried to set the first MAC HFS and it didn't work, so will try to set the second as you said.
The problem is it takes days for Testdisk to find these partitions on deep search, is there a way to save a search so I can load and try multiple combinations?
I'm doing a deep search now... should be ready before the weekend.
Meanwhile, another question: I'm selecting "EFI GPT" for the disk type when I start Testdisk. That's the correct type, not "Intel", right? This is an external USB drive with a HFS+ and an ExFat partition, I don't understand what makes a disk be "EFI GPT" or "Intel"...
The problem is it takes days for Testdisk to find these partitions on deep search, is there a way to save a search so I can load and try multiple combinations?
I'm doing a deep search now... should be ready before the weekend.
Meanwhile, another question: I'm selecting "EFI GPT" for the disk type when I start Testdisk. That's the correct type, not "Intel", right? This is an external USB drive with a HFS+ and an ExFat partition, I don't understand what makes a disk be "EFI GPT" or "Intel"...
That's a screenshot from after a deep search. The PDF says chances are partitions will be listed as deleted after a search, so I guess that's what's happening.What confuses me is that your computer is mounting the 1TB partition although it is marked as deleted!
-
- Posts: 2729
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Please help recover Mac OS Extended partition
I don't think so.
Obviously with two partitions on the drive somebody has modified the original partitioning scheme if this had been purchased as a preformatted external drive which usually contains one partition.I'm doing a deep search now... should be ready before the weekend.
Meanwhile, another question: I'm selecting "EFI GPT" for the disk type when I start Testdisk. That's the correct type, not "Intel", right? This is an external USB drive with a HFS+ and an ExFat partition, I don't understand what makes a disk be "EFI GPT" or "Intel"...
Your partitioning program should show this type of information somewhere.
With a total of 1,5TB disk space both schemes are possible.
If EFI GPT has been used, there is a traditional "Intel" scheme as well on disk. It contains one partition spanning the whole disk.
This is to inform dumb programs that only know the "Intel" structure that the disk is already in use.
If you find this information EFI GPT is very likely.
Re: Please help recover Mac OS Extended partition
Hi. Sorry for my long delay.
The partitioning program says the map type is indeed GPT.
I'm completely lost now. I tried PhotoRec and it didn't find any files. Do you have any suggestions?
One thing I've noticed is that each program/disk mode I run has a different idea of where the Mac partition ends (or starts!). Please take a look at this screenshot: https://ibb.co/99sLMhh
The top one is PhotoRec, the middle one is TestDisk when I select Intel before searching and the botton one is Testdisk when I select EFI GPT before a deep search (my computer was turned off in the middle of a deep search, and after that it started displaying those weird results). The all have different End values and PhotoRec also has a different Start value.
The partitioning program says the map type is indeed GPT.
I tried this and it didn't work, nothing shows up.The next step is to set the first partition back to "deleted" and to set the second partition to "primary", write and restart or reconnect to see if your Apple computer can look into the second partition.
I'm completely lost now. I tried PhotoRec and it didn't find any files. Do you have any suggestions?
One thing I've noticed is that each program/disk mode I run has a different idea of where the Mac partition ends (or starts!). Please take a look at this screenshot: https://ibb.co/99sLMhh
The top one is PhotoRec, the middle one is TestDisk when I select Intel before searching and the botton one is Testdisk when I select EFI GPT before a deep search (my computer was turned off in the middle of a deep search, and after that it started displaying those weird results). The all have different End values and PhotoRec also has a different Start value.
-
- Posts: 2729
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Please help recover Mac OS Extended partition
No. The sentence "I tried PhotoRec and it didn't find any files." does not provide any information to work with.
Picture 2 could be the status quo, Picture 3 is the result of the pending analysis.
One thing I've noticed is that each program/disk mode I run has a different idea of where the Mac partition ends (or starts!). Please take a look at this screenshot: https://ibb.co/99sLMhh
The top one is PhotoRec, the middle one is TestDisk when I select Intel before searching and the botton one is Testdisk when I select EFI GPT before a deep search (my computer was turned off in the middle of a deep search, and after that it started displaying those weird results). The all have different End values and PhotoRec also has a different Start value.
Picture 1 could be maybe the result of writing an old school Intel style partition table on a disk that already contained a GPT.