NTFS wiped out Mac Filesystem

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
MrTibbs
Posts: 2
Joined: 28 Feb 2022, 23:25

NTFS wiped out Mac Filesystem

#1 Post by MrTibbs »

Greetings,

I have a friend who had an external hard drive which he used for his old Mac which had MAC OS X Yosemite installed. He had a lot of family photos on there which he put on there through simple drag and drop.

The external hard drive stopped working on his mac so he took it to a low grade computer repair shop. The computer repair shop removed his drive from the enclosure to try to access the files. They said they could not access his files and gave him the drive back.

My friend asked me if I could take a look as a last resort. I was able to take the drive out of the enclosure and notice that the drive was newly formatted to NTFS. The format time coincides with the date/time when it was at the repair shop. It seems like the repair shop formatted his Mac hard drive to NTFS.

I have tried photorec and it was able to recover some old files that seem to be Western Digital files that came with the drive when the drive was purchased. But only a handful of files and nothing that seems useful.

When running photorec I did the following:

sudo photorec
selected the drive /dev/rdisk5
Chose the Whole Disk option (there are two partitions called MS Reserved and MS Data that I could have selected instead)
For file system I selected "Other" (this seems to include both NTFS and HFS+). I assume the drive was originally formatted as HFS+. I am also not sure if there's a way to specify HFS+ only and not NTFS.

Is it possible it's seeing the NTFS partition and therefore not looking for HFS+ specific files?

Thank you,

Tibbs

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: NTFS wiped out Mac Filesystem

#2 Post by cgrenier »

Can you run PhotoRec, enable the Expert mode in the Option menu, start the recovery.
When asked, choose a blocksize of 512 bytes, use the default options otherwise (no need to create an image.dd file or to try to unformat a FAT filesystem).
Does it recover more files ?

Locked