I am a total noob and I tried to search in the forum for an answer, and I found some relating to the same subject but I couldn't understand the instruction. Please help. Thanks in advance for your help
The following parition can't be recovered
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
The following parition can't be recovered
I have accidentally deleted my MS bootcamp partition on my Mac and wish to restore it. I have completed the Analyse function and there is one partition listed and can't be recovered. Unfortunately, this is the partition that I want to recover.
I am a total noob and I tried to search in the forum for an answer, and I found some relating to the same subject but I couldn't understand the instruction. Please help. Thanks in advance for your help
I am a total noob and I tried to search in the forum for an answer, and I found some relating to the same subject but I couldn't understand the instruction. Please help. Thanks in advance for your help
-
cgrenier
- Site Admin
- Posts: 5432
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: The following parition can't be recovered
NTFS partition may be listed twice, once at the correct location, once at a shifted offset.
So continue on next screen, you may find your missing partition.
So continue on next screen, you may find your missing partition.
Re: The following parition can't be recovered
Hi,
Sorry for the long delay. I was waiting for the arrival of my new disk to backup my Mac before proceeding.
My MAC filesystem is APFS (encypted) and I am currently using Mojave. My Mac hdd is 500gb of which 100gb is Bootcamp and 400GB is OSX. After I realised I have deleted the partition via Bootcamp Assistant, there was a pop up message saying the erased partition could not merge into 1 disk. Currently, my Bootcamp space (100GB) is missing.
When I was running TestDisk, there was also a warning that TestDisk would not be able to write on my disk.
I have gone as far as Deep Search and please find the attached log file for your reference. I couldn't list the files for MS Data in both searches because apparently, the filesystem has been damaged.
Your help is very much appreciated as I have important work files in there which I hope I can recover. Thanks very much.
LOG FILE
Screenshots after DeepSearch
Sorry for the long delay. I was waiting for the arrival of my new disk to backup my Mac before proceeding.
My MAC filesystem is APFS (encypted) and I am currently using Mojave. My Mac hdd is 500gb of which 100gb is Bootcamp and 400GB is OSX. After I realised I have deleted the partition via Bootcamp Assistant, there was a pop up message saying the erased partition could not merge into 1 disk. Currently, my Bootcamp space (100GB) is missing.
When I was running TestDisk, there was also a warning that TestDisk would not be able to write on my disk.
I have gone as far as Deep Search and please find the attached log file for your reference. I couldn't list the files for MS Data in both searches because apparently, the filesystem has been damaged.
Your help is very much appreciated as I have important work files in there which I hope I can recover. Thanks very much.
LOG FILE
Code: Select all
Mon Feb 17 16:35:17 2020
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 18.7.0 (Darwin Kernel Version 18.7.0: Tue Aug 20 16:57:14 PDT 2019; root:xnu-4903.271.2~2/RELEASE_X86_64) x86_64
Compiler: GCC 4.0
Compilation date: 2020-01-26T20:59:54
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors (RO), sector size=512
Disk /dev/disk2 - 2000 GB / 1863 GiB - 3907029167 sectors (RO), sector size=512
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO), sector size=512
Disk /dev/rdisk1 - 400 GB / 372 GiB - 97656315 sectors (RO), sector size=4096
Disk /dev/rdisk2 - 2000 GB / 1863 GiB - 3907029167 sectors (RO), sector size=512
Partition table type (auto): EFI GPT
Media is opened in read-only.
Disk /dev/rdisk0 - 500 GB / 465 GiB (RO)
Partition table type: EFI GPT
Analyse Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=977105059 (expected 977105059)
hdr_lba_start=34
hdr_lba_end=977105026
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 40 409639 409600 [EFI System Partition]
2 P Apple APFS 409640 781660159 781250520 [Customer]
search_part()
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
check_FAT: Bad number of sectors per cluster
NTFS at 977104895/0/1
heads/cylinder 0 (NTFS) != 1 (HD)
sect/track 0 (NTFS) != 1 (HD)
filesystem size 195444736
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 12215295
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 781660160 977104895 195444736
NTFS found using backup sector, blocksize=4096, 100 GB / 93 GiB
NTFS at 977104895/0/1
heads/cylinder 0 (NTFS) != 1 (HD)
sect/track 0 (NTFS) != 1 (HD)
filesystem size 195444736
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 12215295
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 977104895 1172549630 195444736
NTFS, blocksize=4096, 100 GB / 93 GiB
This partition ends after the disk limits. (start=977104895, size=195444736, end=1172549630, disk end=977105060)
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 600 GB / 559 GiB)
The following partition can't be recovered:
MS Data 977104895 1172549630 195444736
NTFS, blocksize=4096, 100 GB / 93 GiB
Results
P EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
P MS Data 781660160 977104895 195444736
NTFS found using backup sector, blocksize=4096, 100 GB / 93 GiB
ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
P MS Data 781660160 977104895 195444736
NTFS found using backup sector, blocksize=4096, 100 GB / 93 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 P EFI System 40 409639 409600 [EFI System Partition] [EFI]
2 P MS Data 781660160 977104895 195444736
search_part()
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
FAT32 at 46/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
set_FAT_info: name from BS used
FAT32 at 46/0/1
EFI System 46 409645 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
check_FAT: Bad number of sectors per cluster
NTFS at 977104895/0/1
heads/cylinder 0 (NTFS) != 1 (HD)
sect/track 0 (NTFS) != 1 (HD)
filesystem size 195444736
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 12215295
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 781660160 977104895 195444736
NTFS found using backup sector, blocksize=4096, 100 GB / 93 GiB
NTFS at 977104895/0/1
heads/cylinder 0 (NTFS) != 1 (HD)
sect/track 0 (NTFS) != 1 (HD)
filesystem size 195444736
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 12215295
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 977104895 1172549630 195444736
NTFS, blocksize=4096, 100 GB / 93 GiB
This partition ends after the disk limits. (start=977104895, size=195444736, end=1172549630, disk end=977105060)
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 600 GB / 559 GiB)
The following partition can't be recovered:
MS Data 977104895 1172549630 195444736
NTFS, blocksize=4096, 100 GB / 93 GiB
Results
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
EFI System 46 409645 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
P MS Data 781660160 977104895 195444736
NTFS found using backup sector, blocksize=4096, 100 GB / 93 GiB
ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
Code: Select all
TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)
The harddisk (500 GB / 465 GiB) seems too small! (< 600 GB / 559 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...
The following partition can't be recovered:
Partition Start End Size in sectors
> MS Data 977104895 1172549630 195444736
[ Continue ]
NTFS, blocksize=4096, 100 GB / 93 GiB
-----------------------------------------------------------------------------
TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)
Partition Start End Size in sectors
D EFI System 40 409639 409600 [EFI System Partition]
D EFI System 46 409645 409600 [EFI System Partition]
>P MS Data 781660160 977104895 195444736
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
NTFS found using backup sector, blocksize=4096, 100 GB / 93 GiB
--------------------------------------------------------------------------------
TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
P MS Data 781660160 977104895 195444736
Can't open filesystem. Filesystem seems damaged.
>[ Quit ]
Quit this section
Re: The following parition can't be recovered
Not sure if it will help, when i list the files on the 1st D EFI Partition, it brings me to P MS Data again. For the 2nd partition, there were a whole bunch of funny character files which were created not at the times when i had the Bootcamp.
Should i try again with the cloned external hard disk? Cos i duno how to unmount the Mac when im still using it to recover my files...
Should i try again with the cloned external hard disk? Cos i duno how to unmount the Mac when im still using it to recover my files...