HDD recovery after accidental Time Machine format

[fandart]

Hello,

a friend of mine accidentaly formatted his external hard-drive after plugging it to the Macbook and confirming "use for backup" option which Time Machine gave him. He unplugged the drive immediately after he found out, there is no data on the drive. He asked me for help and I was able to recover probably all the files using Disk Drill but those files is a mess. File structure dissappeared and there are no folders like before.

I read that TestDisk should be able to recover deleted file partition after such "reformating" or "initializing".

I tried Test Disk but with no luck. Here are the steps I followed:

1/ ran the Test Disk and found the correct drive
2/ used the HFS partition type (defaulted)
3/ clicked Analyze
4/ started Quick Search
This process starts normally and gives me two warnings:

Warning: number of heads/cylinder mismatches 16 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 63 (HD)

It seems to freeze on this status:

Analyse cylinder 243201/243200: 99%

The cursor is blinking, but the "Stop" button does not work any more and nothing helps but killing the process, unplugging the disk and starting over.

What am I doing wrong? Do you guys have any tips how to recover the file structure. I think I have nothing to lost, the data are already backed-up on other drive as mentioned above.

Thank you so much for any help.

I ran the TestDisk on Windows 10.

[recuperation]

Please post your log file.

[fandart]

Oh, sure! This is all I got after the freeze and force-quiting the process:

Code: Select all

Sat Mar 11 09:38:17 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239379415040
Hard disk list
Disk \\.\PhysicalDrive0 - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - SanDisk SDSSDXPS240G, S/N:153762402887, FW:X21200RL
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Samsung SSD 970 EVO 500GB, S/N:0025_3858_91B5_C0E0., FW:2B2QEXE7
Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ADATA HV620S, S/N:130422370984

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - ADATA HV620S
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - CHS 243201 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029167 (expected 3907029167)
hdr_lba_start=34
hdr_lba_end=3907029134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P EFI System                    40     409639     409600 [EFI System Partition]
 2 P Mac HFS                   409640 3906766983 3906357344

[recuperation]

I read that TestDisk should be able to recover deleted file partition after such "reformating" or "initializing".

Where did you read that? Please provide the source.

If you format a partition, only the content of the partition is partly or completely written.
If you are formating with a different file system, the partition table has to changed as well to reflect the different type of file system.

Your problem is that by formating you lost metadata information pointing to the data which may not have been overwritten.

The best choice is to use any third party program that is analysing the remains of your file system to hopefully restore folder structure, file names and correct file content.

[fandart]

It was here:
https://www.handyrecovery.com/recover-d ... e-by-name/

I checked it again and it says recovery from damaged/deleted partition. Not sure, if this is the same as reformated or initialized to different File system.

I used the DiskDrill to save the data but in rather messy structure.

I guess thats it. There is probably no way I can restore the file structure.