Deleted Partions

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
davegreb
Posts: 4
Joined: 03 Jan 2022, 17:27

Deleted Partions

#1 Post by davegreb »

Hi,

I had 2 external HD's attached to my Mac. I thought I was working on the new blank one, but deleted the partitions via disk utility of the original 3TB seagate drive.

I've tried to follow the instructions, but the deep search brought up a lot of entires which I don't know what I'm meant to do with. I chose the EFI option.

The drive had multiple partitions, mostly fat32, exFAT. I also had a couple of super duper backups, so they might have been apple format (but the newest type).

The deep scan took 2-3 days to complete. I clicked into some of the partitions HFS, but there were no files.

I managed to exit out of that session and I'm running a deep scan again.

I'm trying to retrieve all my videos and pictures as that's all that matters.

Some help on what the deep scan returned and why so many entries were found. Also, what steps would you take to find the partitions I deleted? Should I be using the Intel or EFI options?

Code: Select all


Thu Dec 30 23:59:18 2021
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 21.2.0 (Darwin Kernel Version 21.2.0: Sun Nov 28 20:29:10 PST 2021; root:xnu-8019.61.5~1/RELEASE_ARM64_T8101) arm64
Compiler: GCC 4.2
ext2fs lib: none, ntfs lib: none, reiserfs lib: none, ewf lib: none, curses lib: ncurses 5.7
Hard disk list
Disk /dev/disk4 - 3000 GB / 2794 GiB - 732566645 sectors (RO), sector size=4096
Disk /dev/disk7 - 14 TB / 12 TiB - 27344764928 sectors (RO), sector size=512
Disk /dev/rdisk1 - 524 MB / 500 MiB - 128000 sectors (RO), sector size=4096
Disk /dev/rdisk4 - 3000 GB / 2794 GiB - 732566645 sectors (RO), sector size=4096
Disk /dev/rdisk5 - 3000 GB / 2794 GiB - 732489834 sectors (RO), sector size=4096
Disk /dev/rdisk6 - 3000 GB / 2793 GiB - 732421875 sectors (RO), sector size=4096
Disk /dev/rdisk7 - 14 TB / 12 TiB - 27344764928 sectors (RO), sector size=512
Disk /dev/rdisk8 - 1598 GB / 1488 GiB - 390262469 sectors (RO), sector size=4096
Disk /dev/rdisk9 - 5400 GB / 5029 GiB - 1318404869 sectors (RO), sector size=4096

Partition table type (auto): EFI GPT
Media is opened in read-only.
Disk /dev/disk4 - 3000 GB / 2794 GiB (RO)
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=732566644 (expected 732566644)
hdr_lba_start=6
hdr_lba_end=732566639
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
 1 P EFI System                     6      76805      76800 [EFI System Partition]
 2 P Apple APFS                 76806  732566639  732489834
Can't create file /dev/image.dd.
Can't create file!
Can't create file /dev/image.dd.
Can't create file!
Incomplete image created.

Analyse Disk /dev/disk4 - 3000 GB / 2794 GiB - 732566645 sectors (RO)
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=732566644 (expected 732566644)
hdr_lba_start=6
hdr_lba_end=732566639
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P EFI System                     6      76805      76800 [EFI System Partition]
 2 P Apple APFS                 76806  732566639  732489834

search_part()
Disk /dev/disk4 - 3000 GB / 2794 GiB - 732566645 sectors (RO)
FAT32 at 6/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 6/0/1
     EFI System                     6      76805      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB

HFS+ magic value at 87996/0/1
part_size 732457066
     Mac HFS                    87996  732545061  732457066
     HFS+ blocksize=8192, 3000 GB / 2794 GiB

Results
   P EFI System                     6      76805      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB
   P Mac HFS                    87996  732545061  732457066
     HFS+ blocksize=8192, 3000 GB / 2794 GiB

interface_write()
 1 P EFI System                     6      76805      76800 [EFI System Partition] [EFI]
 2 P Mac HFS                    87996  732545061  732457066
simulate write!

Analyse Disk /dev/disk4 - 3000 GB / 2794 GiB - 732566645 sectors (RO)
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=732566644 (expected 732566644)
hdr_lba_start=6
hdr_lba_end=732566639
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P EFI System                     6      76805      76800 [EFI System Partition]
 2 P Apple APFS                 76806  732566639  732489834

search_part()
Disk /dev/disk4 - 3000 GB / 2794 GiB - 732566645 sectors (RO)
FAT32 at 6/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 6/0/1
     EFI System                     6      76805      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB

HFS+ magic value at 87996/0/1
part_size 732457066
     Mac HFS                    87996  732545061  732457066
     HFS+ blocksize=8192, 3000 GB / 2794 GiB

Results
   P EFI System                     6      76805      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB
   P Mac HFS                    87996  732545061  732457066
     HFS+ blocksize=8192, 3000 GB / 2794 GiB

interface_write()
 1 P EFI System                     6      76805      76800 [EFI System Partition] [EFI]
 2 P Mac HFS                    87996  732545061  732457066
simulate write!
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Analyse Disk /dev/disk4 - 3000 GB / 2794 GiB - 732566645 sectors (RO)
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=732566644 (expected 732566644)
hdr_lba_start=6
hdr_lba_end=732566639
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P EFI System                     6      76805      76800 [EFI System Partition]
 2 P Apple APFS                 76806  732566639  732489834

search_part()
Disk /dev/disk4 - 3000 GB / 2794 GiB - 732566645 sectors (RO)
FAT32 at 6/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 6/0/1
     EFI System                     6      76805      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB

HFS+ magic value at 87996/0/1
part_size 732457066
     Mac HFS                    87996  732545061  732457066
     HFS+ blocksize=8192, 3000 GB / 2794 GiB

Results
   P EFI System                     6      76805      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB
   P Mac HFS                    87996  732545061  732457066
     HFS+ blocksize=8192, 3000 GB / 2794 GiB

interface_write()
 1 P EFI System                     6      76805      76800 [EFI System Partition] [EFI]
 2 P Mac HFS                    87996  732545061  732457066

search_part()
Disk /dev/disk4 - 3000 GB / 2794 GiB - 732566645 sectors (RO)
FAT32 at 6/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 6/0/1
     EFI System                     6      76805      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB
FAT32 at 12/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-106
FAT2 : 107-181
start_rootdir : 182 root cluster : 2
Data : 182-76799
sectors : 76800
cluster_size : 1
no_of_cluster : 76618 (2 - 76619)
fat_length 75 calculated 75
FAT differs, FAT sectors=64-75/75
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 12/0/1
     EFI System                    12      76811      76800 [EFI System Partition] [EFI]
     FAT32, blocksize=4096, 314 MB / 300 MiB

HFS+ magic value at 2048/0/1

HFS+ magic value at 2048/0/1
part_size 732563456
     Mac HFS                     2048  732565503  732563456
     HFS+ blocksize=8192 + Backup, 3000 GB / 2794 GiB

HFS+ magic value at 13238/0/1
part_size 732563456
     Mac HFS                    13238  732576693  732563456
     HFS+ blocksize=8192, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=13238, size=732563456, end=732576693, disk end=732566645)

HFS+ magic value at 13248/0/1
part_size 732563456
     Mac HFS                    13248  732576703  732563456
     HFS+ blocksize=8192, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=13248, size=732563456, end=732576703, disk end=732566645)

HFS+ magic value at 13260/0/1
part_size 732563456
     Mac HFS                    13260  732576715  732563456
     HFS+ blocksize=8192, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=13260, size=732563456, end=732576715, disk end=732566645)

HFS+ magic value at 13276/0/1
part_size 732563456
     Mac HFS                    13276  732576731  732563456
     HFS+ blocksize=8192, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=13276, size=732563456, end=732576731, disk end=732566645)

HFS+ magic value at 13282/0/1
part_size 732563456
     Mac HFS                    13282  732576737  732563456
     HFS+ blocksize=8192, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=13282, size=732563456, end=732576737, disk end=732566645)

HFS+ magic value at 13304/0/1
part_size 732563456
     Mac HFS                    13304  732576759  732563456
     HFS+ blocksize=8192, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=13304, size=732563456, end=732576759, disk end=732566645)

HFS+ magic value at 13317/0/1
part_size 732563456
     Mac HFS                    13317  732576772  732563456
     HFS+ blocksize=8192, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=13317, size=732563456, end=732576772, disk end=732566645)

HFS+ magic value at 13329/0/1
part_size 732563456
     Mac HFS                    13329  732576784  732563456
     HFS+ blocksize=8192, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=13329, size=732563456, end=732576784, disk end=732566645)

HFS+ magic value at 13335/0/1
part_size 732563456
     Mac HFS                    13335  732576790  732563456
     HFS+ blocksize=8192, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=13335, size=732563456, end=732576790, disk end=732566645)

HFS+ magic value at 13346/0/1
part_size 732563456
     Mac HFS                    13346  732576801  732563456
     HFS+ blocksize=8192, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=13346, size=732563456, end=732576801, disk end=732566645)

HFS+ magic value at 13362/0/1
part_size 732563456
     Mac HFS                    13362  732576817  732563456
     HFS+ blocksize=8192, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=13362, size=732563456, end=732576817, disk end=732566645)

HFS+ magic value at 13381/0/1
part_size 732563456
     Mac HFS                    13381  732576836  732563456
     HFS+ blocksize=8192, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=13381, size=732563456, end=732576836, disk end=732566645)

HFS+ magic value at 13385/0/1
part_size 732563456
     Mac HFS                    13385  732576840  732563456
     HFS+ blocksize=8192, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=13385, size=732563456, end=732576840, disk end=732566645)

HFS+ magic value at 55323/0/1
part_size 113723256
     Mac HFS                    55323  113778578  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55343/0/1
part_size 113723256
     Mac HFS                    55343  113778598  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55419/0/1
part_size 113723256
     Mac HFS                    55419  113778674  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55506/0/1
part_size 113723256
     Mac HFS                    55506  113778761  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55519/0/1
part_size 113723256
     Mac HFS                    55519  113778774  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55550/0/1
part_size 113723256
     Mac HFS                    55550  113778805  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55570/0/1
part_size 113723256
     Mac HFS                    55570  113778825  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55582/0/1
part_size 113723256
     Mac HFS                    55582  113778837  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55606/0/1
part_size 113723256
     Mac HFS                    55606  113778861  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55610/0/1
part_size 113723256
     Mac HFS                    55610  113778865  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55666/0/1
part_size 113723256
     Mac HFS                    55666  113778921  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55679/0/1
part_size 113723256
     Mac HFS                    55679  113778934  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55698/0/1
part_size 113723256
     Mac HFS                    55698  113778953  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55710/0/1
part_size 113723256
     Mac HFS                    55710  113778965  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55716/0/1
part_size 113723256
     Mac HFS                    55716  113778971  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55773/0/1
part_size 113723256
     Mac HFS                    55773  113779028  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55785/0/1
part_size 113723256
     Mac HFS                    55785  113779040  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55799/0/1
part_size 113723256
     Mac HFS                    55799  113779054  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55820/0/1
part_size 113723256
     Mac HFS                    55820  113779075  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB

HFS+ magic value at 55842/0/1
part_size 113723256
     Mac HFS                    55842  113779097  113723256
     HFS+ blocksize=4096, 465 GB / 433 GiB
Top
davegreb
Posts: 4
Joined: 03 Jan 2022, 17:27

Re: Deleted Partions

#2 Post by davegreb »

link to log file
https://1drv.ms/u/s!Ag-nndwmZdwIhYgFVn8Plxeezk73wg
Top
recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Deleted Partions

#3 Post by recuperation »

8. What is the maker of your failed drive?
9. What is the model?
10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?

Who partitioned the drive?
Top
davegreb
Posts: 4
Joined: 03 Jan 2022, 17:27

Re: Deleted Partions

#4 Post by davegreb »

The HD is a seagate expansion desktop drive. model srd00f2.
I partitioned the drive.

I've never had any issues with the drive, so I don't think there is anything physically wrong with it.
Top
davegreb
Posts: 4
Joined: 03 Jan 2022, 17:27

Re: Deleted Partions

#5 Post by davegreb »

Should I change the blocksize (is that even possible?). The HFS+ partition is bigger than the others, right?
Should I format the drive to exFAT which is what most likely I had originally?
Top
recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Deleted Partions

#6 Post by recuperation »

davegreb wrote: ↑05 Jan 2022, 14:56 Should I change the blocksize (is that even possible?).
???
The HFS+ partition is bigger than the others, right?
I currently see only one Apple partition apart from the two EFI system partitions.
Should I format the drive to exFAT which is what most likely I had originally?
Formating is a destructive operation and not suitable for recovery.

I am not familiar with Apple computers.
Testdisk can find Apple type partitions but I doubt that it can read the stuff inside.
You can check that out with another healthy drive containing Apple partitions and using the p-key "list files").

Your first EFI partition starts within the space that is reserved for a GPT partition table.

If that partition does not contain data to be recovered and might be deleted you could rewrite the partition table.
That might overwrite the beginning of your first EFI system partition.
But this gives you a chance when connecting that modified drive to an Apple to see if you are able to look into the appearing partitions.
Top
Locked

Return to “Partition Recovery”