Seems GPT is now confused and corrupt - how do I recover my data?

[briandu2]

Hi,
I am using a 2014 Mac Mini with Ubuntu 20.04 (default install) on a USB connection (1 TB SSD)
This has been working fine for approx a week. Just when I am ready to consider a backup of the drive it somehow will not boot up.
Actually previously the Mac would boot into a small OSX drive - pressing the Mac alt button (on start up) allows one to boot into other drives. This has been working fine and then became erratic.

I booted from a USB boot stick and used gparted which reflects /dev/sdb1 and /dev/sdb3 as filesystem unknown.

Using a small spare drive I installed Ubuntu again and it erratically worked until I re-installed it again with the following partitions using gdisk
/dev/sb1 as EFI +512M
/dev/sdb2 as fs_boot +512M
/dev/sdb3 as fs_root (the rest of the drive)

new install Ubuntu with other (manual partitions) and formatting sdb1 as EFI, sdb2 as /boot and sdb3 as /root.
Once installed and rebooted then went

Code: Select all

 cd /boot/efi/EFI/ubuntu 

and executed

Code: Select all

 mv shimx64.efi shimx64.efi_old 

and

Code: Select all

 cp grubx64.efi shimx64.efi 

This seems quite robust and consistently boots up directly or using the Mac alt key choices. Point is it works properly and no problems.

HOWEVER, I have the problem with my 1TB drive:
Booting up from the small drive gparted still states the partitions are unknown.
Using gdisk

Code: Select all

 sudo gdisk -l /dev/sdb 

GPT fdisk (gdisk) version 1.0.5

Partition table scan:
MBR: hybrid
BSD: not present
APM: not present
GPT: present

Found valid GPT with hybrid MBR; using GPT.
Disk /dev/sdb: 2000409264 sectors, 953.9 GiB
Model: Name
Sector size (logical/physical): 512/512 bytes
Disk identifier (GUID): A0D13BCD-15E6-4EA3-A70F-554583C1CC7D
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 2000409230
Partitions will be aligned on 2048-sector boundaries
Total free space is 2669 sectors (1.3 MiB)

Number Start (sector) End (sector) Size Code Name
1 2048 1050623 512.0 MiB EF00 EFI System Partition
2 1050624 2000408575 953.4 GiB

it seems fine but if I use

Code: Select all

 sudo gdisk /dev/sdb1 

[sudo] password for xxxxx:
GPT fdisk (gdisk) version 1.0.5

Partition table scan:
MBR: hybrid
BSD: not present
APM: not present
GPT: not present


***************************************************************
Found invalid GPT and valid MBR; converting MBR to GPT format
in memory. THIS OPERATION IS POTENTIALLY DESTRUCTIVE! Exit by
typing 'q' if you don't want to convert your MBR partitions
to GPT format!
***************************************************************


Warning! Secondary partition table overlaps the last partition by
1999360033 blocks!
You will need to delete this partition or resize it in another utility.

and

Code: Select all

 Command (? for help): p 

Disk /dev/sdb1: 1048576 sectors, 512.0 MiB
Sector size (logical/physical): 512/512 bytes
Disk identifier (GUID): CD527C6A-F72B-48BE-88F0-A7C45C98A77A
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 1048542
Partitions will be aligned on 2048-sector boundaries
Total free space is 1048509 sectors (512.0 MiB)

Number Start (sector) End (sector) Size Code Name
2 1050624 2000408575 953.4 GiB 8300 Linux filesystem

as can be seen it reports number 2 and not 1!

using option p results in -

Code: Select all

Command (? for help): p

Disk /dev/sdb1: 1048576 sectors, 512.0 MiB
Sector size (logical/physical): 512/512 bytes
Disk identifier (GUID): CD527C6A-F72B-48BE-88F0-A7C45C98A77A
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 1048542
Partitions will be aligned on 2048-sector boundaries
Total free space is 1048509 sectors (512.0 MiB)

Number Start (sector) End (sector) Size Code Name
2 1050624 2000408575 953.4 GiB 8300 Linux filesystem

still number 2 followed by v

Code: Select all

Command (? for help): v

Problem: partition 2 is too big for the disk.

Warning! Secondary partition table overlaps the last partition by
1999360033 blocks!
You will need to delete this partition or resize it in another utility.

Identified 2 problems!

it is a mess and if I follow through with /dev/sdb2 then

Code: Select all

 sudo gdisk /dev/sdb2 

GPT fdisk (gdisk) version 1.0.5

Partition table scan:
MBR: hybrid
BSD: not present
APM: not present
GPT: not present


***************************************************************
Found invalid GPT and valid MBR; converting MBR to GPT format
in memory. THIS OPERATION IS POTENTIALLY DESTRUCTIVE! Exit by
typing 'q' if you don't want to convert your MBR partitions
to GPT format!
***************************************************************


Warning! Secondary partition table overlaps the last partition by
1050657 blocks!
You will need to delete this partition or resize it in another utility.

and selecting p results in:

Code: Select all

 Disk /dev/sdb2: 1999357952 sectors, 953.4 GiB
Sector size (logical/physical): 512/512 bytes
Disk identifier (GUID): F35C490F-3BAC-40B6-A2F1-C42BB23B0EF5
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 1999357918
Partitions will be aligned on 2048-sector boundaries
Total free space is 1050590 sectors (513.0 MiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   2         1050624      2000408575   953.4 GiB   8300  Linux filesystem

and selecting v results in -

Code: Select all

Problem: partition 2 is too big for the disk.

Warning! Secondary partition table overlaps the last partition by
1050657 blocks!
You will need to delete this partition or resize it in another utility.

Identified 2 problems!

As such I cannot afford to lose the sdb2 partition; although it is 900GB it is only using approx 200GB and I planned to shrisk the partition and the dd it over to a spare drive. It is the only copy now and I cannot recreate it.

My question is what are my options?
Since I think the Mac Mini 2014 is EUFI and the Ubuntu disk was USB based then probably the Ubuntu 1TB disk was BIOS and not GPT?
As can be seen the filesystems are there but the overlap is causing the GParted status to read unknowns.
How do I get the second partition to be recognised at an ext4?
Reading through the testdisk pdf I am stumped as to what approach to take. - I have tried quite a numbe rof options and have had to dd the 1TB disk several time now and is quite frustrating.
Any guidance?

[recuperation]

As such I cannot afford to lose the sdb2 partition; although it is 900GB it is only using approx 200GB and I planned to shrisk the partition and the dd it over to a spare drive. It is the only copy now and I cannot recreate it.

My question is what are my options?
Since I think the Mac Mini 2014 is EUFI and the Ubuntu disk was USB based then probably the Ubuntu 1TB disk was BIOS and not GPT?
As can be seen the filesystems are there but the overlap is causing the GParted status to read unknowns.
How do I get the second partition to be recognised at an ext4?
Reading through the testdisk pdf I am stumped as to what approach to take. - I have tried quite a numbe rof options and have had to dd the 1TB disk several time now and is quite frustrating.
Any guidance?

Do not boot from your defective drive.
Run Testdisk from CD or USB stick and let Testdisk analyse the disk. Use the "p" key to list files within a partition after selecting it.
If Testdisk shows you the content you expected copy that content to another healthy drive.

If the result does not meet your expectations continue with Deep search and retry to list the content.
If that fails try Photorec or commercial software.

When running Testdisk enable logging and post the log file here.

[briandu2]

After 3 days of nonstop trying to figure out what has gone wrong and having to learn some new tools I screwed up the above posting (exhausted). Please ignore!

The problem is a 1TB Macos drive, it has two partitions and was created leveraging the bios internet facility on a Mac Mini.

I installed an external 256GB drive with Ubuntu and copied the data from the Macos to Ubuntu.. IT booted up fine several times and when I was near ready the drives "failed" Both the external 256GB and the 1TB.

Using GParted the Macos shows unknown which does not help.

I have employed varous strategies to recover the partitions but to no avail - I mirrored the 1TB and attempted many paths (to keep the original safe!

Nevertheless the testdisk file is below. I do note the testdisk states that HFS is not supported? Is this correct?

https://pastebin.com/Rmj9gwRm


BTW I did a deep analysis and the result was a 29MB log file which pastebin will not accept

[recuperation]

Nevertheless the testdisk file is below. I do note the testdisk states that HFS is not supported? Is this correct?

Yes.
If you don't believe it, read here:

https://www.cgsecurity.org/wiki/TestDisk

Furthermore your own report told you so.

Have you found a secret HFS support switch?
Please let me know!

[briandu2]

So it seems that I cannot get my data back!!! Grrr!!

[recuperation]

Search for commercial recovery software that supports HFS, pay a professional lab.