File Recovery Mac OSX 10.5

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
HomelyPoet
Posts: 8
Joined: 17 Mar 2012, 15:56

File Recovery Mac OSX 10.5

#1 Post by HomelyPoet »

2TB Seagate Barracuda Green 3.5".
Used as an external drive for a MacBook 4,1.
Have approximately 370GB (according to DiscDrill) of mostly video files (mp4, flv, m4a, Et Cetera).
Plugged it in with a USB to IDE/SATA adaptor, it mounted, appeared on the desktop for about 25-30 seconds, then when I plugged in an external hard-drive (WD5000H1U-00 500GB), the Barracuda un-mounted and a window appeared, and I accidentally initialised the drive.

First run with TestDisk:

Fri Feb 3 19:30:04 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 9.8.0 (Darwin Kernel Version 9.8.0: Wed Jul 15 16:55:01 PDT 2009; root:xnu-1228.15.
Compiler: GCC 4.0
Compilation date: 2011-11-15T08:36:43
ext2fs lib: 1.41.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
User is not root!
Hard disk list
Disk /dev/disk2 - 2000 GB / 1863 GiB - CHS 3907029168 1 1, sector size=512
Disk /dev/rdisk2 - 2000 GB / 1863 GiB - CHS 3907029168 1 1, sector size=512

Partition table type (auto): Mac
Disk /dev/rdisk2 - 2000 GB / 1863 GiB
Partition table type: Mac

Analyse Disk /dev/rdisk2 - 2000 GB / 1863 GiB - CHS 3907029168 1 1

HFS+ magic value at 262208/0/1
Current partition structure:
1 P partition_map 1 63 63
2 P Free 64 262207 262144
3 P HFS 262208 3907029151 3906766944
4 P Free 3907029152 3907029167 16

search_part()
Disk /dev/rdisk2 - 2000 GB / 1863 GiB - CHS 3907029168 1 1

HFS+ magic value at 262208/0/1
part_size 3906766944
HFS 262208 3907029151 3906766944
HFS+, 2000 GB / 1862 GiB

Results
P HFS 262208 3907029151 3906766944
HFS+, 2000 GB / 1862 GiB

interface_write()
P HFS 262208 3907029151 3906766944

search_part()
Disk /dev/rdisk2 - 2000 GB / 1863 GiB - CHS 3907029168 1 1

HFS+ magic value at 262208/0/1
part_size 3906766944
HFS 262208 3907029151 3906766944
HFS+, 2000 GB / 1862 GiB

HFS+ magic value at 381504/0/1
part_size 3906766944
HFS 381504 3907148447 3906766944
HFS+, 2000 GB / 1862 GiB
This partition ends after the disk limits. (start=381504, size=3906766944, end=3907148447, disk end=3907029168)

HFS+ magic value at 381584/0/1
part_size 3906766944
HFS 381584 3907148527 3906766944
HFS+, 2000 GB / 1862 GiB
This partition ends after the disk limits. (start=381584, size=3906766944, end=3907148527, disk end=3907029168)

HFS+ magic value at 535008/0/1
part_size 3906766944
HFS 535008 3907301951 3906766944
HFS+, 2000 GB / 1862 GiB
This partition ends after the disk limits. (start=535008, size=3906766944, end=3907301951, disk end=3907029168)
file_pread(5,16,buffer,721416(721416/0/1)) read err: Input/output error
file_pread(5,16,buffer,721424(721424/0/1)) read err: Input/output error
file_pread(5,1,buffer,721424(721424/0/1)) read err: Input/output error
file_pread(5,16,buffer,721414(721414/0/1)) read err: Input/output error
file_pread(5,16,buffer,721417(721417/0/1)) read err: Input/output error
file_pread(5,1,buffer,721424(721424/0/1)) read err: Input/output error
file_pread(5,16,buffer,721425(721425/0/1)) read err: Input/output error
file_pread(5,1,buffer,721425(721425/0/1)) read err: Input/output error
file_pread(5,16,buffer,721430(721430/0/1)) read err: Input/output error
file_pread(5,1,buffer,721430(721430/0/1)) read err: Input/output error
file_pread(5,16,buffer,721415(721415/0/1)) read err: Input/output error
file_pread(5,16,buffer,721423(721423/0/1)) read err: Input/output error
file_pread(5,1,buffer,721424(721424/0/1)) read err: Input/output error
file_pread(5,16,buffer,721431(721431/0/1)) read err: Input/output error
file_pread(5,1,buffer,721431(721431/0/1)) read err: Input/output error
file_pread(5,16,buffer,721425(721425/0/1)) read err: Input/output error
file_pread(5,1,buffer,721425(721425/0/1)) read err: Input/output error
file_pread(5,16,buffer,721424(721424/0/1)) read err: Input/output error
file_pread(5,1,buffer,721424(721424/0/1)) read err: Input/output error
file_pread(5,16,buffer,721425(721425/0/1)) read err: Input/output error
file_pread(5,1,buffer,721425(721425/0/1)) read err: Input/output error
file_pread(5,16,buffer,721426(721426/0/1)) read err: Input/output error
file_pread(5,1,buffer,721426(721426/0/1)) read err: Input/output error
file_pread(5,16,buffer,721430(721430/0/1)) read err: Input/output error
file_pread(5,1,buffer,721430(721430/0/1)) read err: Input/output error
file_pread(5,1,buffer,721431(721431/0/1)) read err: Input/output error
Search for partition aborted
Disk /dev/disk1 - 2000 GB / 1863 GiB - CHS 3907029168 1 1 (RO)
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partitions can't be recovered:
HFS 381504 3907148447 3906766944
HFS+, 2000 GB / 1862 GiB
HFS 381584 3907148527 3906766944

Results
P HFS 262208 3907029151 3906766944
HFS+, 2000 GB / 1862 GiB

interface_write()
P HFS 262208 3907029151 3906766944
simulate write!
Partition table type (auto): Mac
Media is opened in read-only.
Partition table type (auto): Mac
Media is opened in read-only.

[img]/Users/xxxxxx/Downloads/Recover/Testdisk-advanced.tiff[/img]

DiskUtility says:
Verifying volume “disk1s3”
Checking Journaled HFS Plus volume.
Invalid B-tree node size
Volume check failed.
Error: Filesystem verify or repair failed.

Any assistance wouldst be most appreciated.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: File Recovery Mac OSX 10.5

#2 Post by Fiona »

Do you have an Intel-MAC?
TestDisk used Apple partition map which is intended for older Apple Power PC.

In case you have an Intel-MAC and partitionned your disk using an intel mac, you should use partition table type EFI GPT in TestDisk and repeat your diagnose.

HomelyPoet
Posts: 8
Joined: 17 Mar 2012, 15:56

Re: File Recovery Mac OSX 10.5

#3 Post by HomelyPoet »

Analyse: Bad GPT partition, invalid signature.
[Quick Search]
>P Mac HFS (Start)262208 (End)3907029151 (Size in sectors)3906766944
Structure: Ok

I can find nothing HFS related in the TestDisk-wiki.
Is there, mayhaps, a similar process involving a different file system, though close to, about what further course I couldst take?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File Recovery Mac OSX 10.5

#4 Post by cgrenier »

TestDisk has found the HFS partition already listed in the partition table. You can try PhotoRec to recover your data but recovered files won't have their original filenames. Be carefull to store the files on another disk and to have enough disk space.

HomelyPoet
Posts: 8
Joined: 17 Mar 2012, 15:56

Re: File Recovery Mac OSX 10.5

#5 Post by HomelyPoet »

Is it possible to make/remake the drive mountable under the OS X, without losing the files?
I am trying PhotoRec, recovered quite a few files, though some are apparently fragmented.
As to the aspect of nameless files, I really don't mind.
I do have another disk which can hold all the written files (3 906 766 944 - 512 byte sectors), just not an image of the entire 2TB disk.

HomelyPoet
Posts: 8
Joined: 17 Mar 2012, 15:56

Re: File Recovery Mac OSX 10.5

#6 Post by HomelyPoet »

Actually, Not.
[In reference to the erroneous observation that data loss is "quite normal" and "a very common situation", especially to a *nix-based system.]
[Also that a *nix-based system is "Like any other PC OS"]
I have been utilising this current OS X since 10.5.2, and not ever had a problem with data loss, even whilst swapping hard-drives betwixt 10.5.2 and 10.5.8.
And TestDisk/PhotoRec ARE "automatic data recovery tools", and, I am quite sure, both employ a "powerful scanning algorithm".
Referring to the signature, an overt advisory as it is, No Thanks.
But yours was an informative comment, erroneous withal.

robertpicassa
Posts: 2
Joined: 30 May 2012, 05:42

Re: File Recovery Mac OSX 10.5

#7 Post by robertpicassa »

We Usually save all our photos, videos and audio on our Mac hard drive. There are chances to loose our data due to the corruption of hard drive. Some of the reasons for loosing data from hard drive are:

1. Virus attack on hard drive.
2. Directly swtiching off the PC from main plug,
3. Physical damage to hard drive.
4. improper handling of hard drive.

This is the stituation where we need mac photo recovery software by using it we can recover our lost, deleted or formatted data from hard drive. Its better to use any good mac recovery software rather than choosing only free softwares.

Ragu
Posts: 1
Joined: 27 Aug 2012, 07:07

Re: File Recovery Mac OSX 10.5

#8 Post by Ragu »

I am using Mounatin Lion and testdisk doesn't work on Mountain lion. It keeps giving an error message saying that it doesn't have write permissions. Even after starting it with sudo priviledges
i am using the latest version of testdisk.
is any one else facing a similar problem or is it just me.
Any help would be appreciated!!!
Regards

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File Recovery Mac OSX 10.5

#9 Post by cgrenier »

Mac OS X prevent write access to a disk if a partition from this disk is mounted. You have to umount the partition first or boot in single user mode:
1. Shut down your Mac if it is on.
2. Press the power button to start the computer.
3. Immediately press and hold the Command (Apple) key and the "s" key for single-user mode. (Command-S)

Locked