Very first use of testdisk... and a bit lost

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
lob75
Posts: 10
Joined: 29 Jul 2013, 09:08

Very first use of testdisk... and a bit lost

#1 Post by lob75 »

Hi,

I am trying to recover access to a LaCie hardrive with two partitions on it.
- one mounts, yet with some files lost, with the error 'Mac OS X can't repair the disk'
- the other, does not mount.

My testdisk logfile reads as follows. I am quite lost. What should I do?
In particular, I noticed the following lines:
- check_FAT: Unusual media descriptor (0xf0!=0xf8)
- heads/cylinder 16 (FAT) != 1 (HD)
- sect/track 32 (FAT) != 1 (HD)

Thanks to all in advance,

LoB

Code: Select all

Mon Jul 29 09:45:54 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 12.4.0 (Darwin Kernel Version 12.4.0: Wed May  1 17:57:12 PDT 2013; root:xnu-2050.2
Compiler: GCC 4.0
Compilation date: 2013-07-12T21:06:21
ext2fs lib: 1.41.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
Hard disk list
Disk /dev/disk0 - 512 GB / 476 GiB - 1000215216 sectors (RO), sector size=512
Disk /dev/disk1 - 3000 GB / 2794 GiB - 1565565872 sectors, sector size=512
Disk /dev/rdisk0 - 512 GB / 476 GiB - 1000215216 sectors (RO), sector size=512
Disk /dev/rdisk1 - 3000 GB / 2794 GiB - 1565565872 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/disk1 - 3000 GB / 2794 GiB
Partition table type: EFI GPT

Analyse Disk /dev/disk1 - 3000 GB / 2794 GiB - 1565565872 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P EFI System                    40     409639     409600
 2 P Mac HFS                   409640 2930676223 2930266584
 3 P Mac HFS               2930938368 5860270983 2929332616

search_part()
Disk /dev/disk1 - 3000 GB / 2794 GiB - 1565565872 sectors
[b]check_FAT: Unusual media descriptor (0xf0!=0xf8)[/b]
FAT32 at 40/0/1
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
[b]heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)[/b]

FAT32 at 40/0/1
     EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 409640/0/1
part_size 2930266584
     Mac HFS                   409640 2930676223 2930266584
     HFS+ blocksize=4096, 1500 GB / 1397 GiB

HFS+ magic value at 2930938368/0/1
part_size 2929332616
     Mac HFS               2930938368 5860270983 2929332616
     HFS+ blocksize=4096, 1499 GB / 1396 GiB

Results
   P EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
   P Mac HFS                   409640 2930676223 2930266584
     HFS+ blocksize=4096, 1500 GB / 1397 GiB
   P Mac HFS               2930938368 5860270983 2929332616
     HFS+ blocksize=4096, 1499 GB / 1396 GiB

interface_write()
 1 P EFI System                    40     409639     409600 [EFI]
 2 P Mac HFS                   409640 2930676223 2930266584
 3 P Mac HFS               2930938368 5860270983 2929332616
write!
No extended partition
You will have to reboot for the change to take effect.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Very first use of testdisk... and a bit lost

#2 Post by Fiona »

Your FAT-Partition is system specific and normal.
So until yet I didn't find anything wrong with your partition table (GPT->GUID partition table):
If your partitions are available and you can't mount it, indicates that your file system of your second partition is probably damaged.
If your partitions got changed, then it's possible that you must run Deeper Search in TestDisk to have a try to find your partition containing your data!
Other wise datarecovery software would be recommended.
PhotoRec would be appropriate but it doesn't keep directories, folders and file names.
Might be easily depend on, waht kind of file types you'd like to recover?

Fiona

lob75
Posts: 10
Joined: 29 Jul 2013, 09:08

Re: Very first use of testdisk... and a bit lost

#3 Post by lob75 »

Thank you very much.

Could you indicate to me what this relates to:
- check_FAT: Unusual media descriptor (0xf0!=0xf8)
- heads/cylinder 16 (FAT) != 1 (HD)
- sect/track 32 (FAT) != 1 (HD)

Should I disregard these warnings?

I was not doing anything to the partitions at the time of the failure. Scanning the whole 3 TB disk is very long. Is there a way to check that the indicated partition looks ok from within testdisk and to start checking the file system status.

Last but not least, from what you can see, does it look as if the disk was mechanically damaged?

Many thanks for your time and help,

LB

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Very first use of testdisk... and a bit lost

#4 Post by Fiona »

Could you indicate to me what this relates to:
- check_FAT: Unusual media descriptor (0xf0!=0xf8)
- heads/cylinder 16 (FAT) != 1 (HD)
- sect/track 32 (FAT) != 1 (HD)
Computer-manufacturer often using another partition type.
For example, if you have a normal FAT-partition, the partition code is 01 for FAT-12, 0b for FAT32, 0C for FAT32 LBA and 0E for FAT16 LBA:
Now computer manufacturer going to change an partition type to ef is for fat-12-16-32-partitions as EFI.
ee means it's an EFI GPT-partition.
Reason is, your partition is not accessable under windows, because windows only recognizes FAT (exFAT) and NTFS.
So windows users can't change any system-partition.
Scanning the whole 3 TB disk is very long.
If a boot sector or file system is damaged, there will be a need to scan for partitions.
Doesn't a matter if you use TestDisk, PhotoRec or another commercial software!

In TestDisk you can speed up scanning, if TestDisk finds a partition you can press F (upper case) to jump to the end of the parttion and scanning for the next one.
But only jump to the end of a partition if the found partition is a partition conaining valuable data and you know this, determining through recognition of the label etc...
Hopefully it helps?

Fiona

lob75
Posts: 10
Joined: 29 Jul 2013, 09:08

Re: Very first use of testdisk... and a bit lost

#5 Post by lob75 »

Dear Fiona,

Knowing that my lost files are on one of the partitions, I used photorec with the following result:


Disk /dev/disk3 - 3000 GB / 2794 GiB (RO)
Partition Start End Size in sectors
2 P Mac HFS 409640 0 1 2930676223 0 1 2930266584


1454 files saved in /Volumes/SVG-RAID/DocsDisqueLaCieHS/SVG-Photos-photorec/recup_dir directory.
Recovery completed.

The 1454 files are:
- 1178 .txt files (small bits from a PDF file)
- 2 .ini files (ok, from the LaCie backup suite)
- 10 .java files (ok)
- 1 .zip file (maybe from a .docx file)
- and 263 .dat files (false positives ?)

No trace of the expected (jpg, png) images...

What would you advice? Should I rerun Photorec? Could this be a problem of HFS+ compression? If so, what could I do?

Many many thanks?

Locked