cgsecurity.org

Hello,

I am wanting to use testdisk to recover files from an external hard drive (1TB WD Elements) that is no longer mounting its volume on my macbook air (2014, OS Big Sur)

I am getting as far as the screen asking me to select partition table type. The hint/recommended selection is for "Intel/PC"

In the mac disk utility gui it shows the drive partition map as "Master Boot Record" and, when it is showing the partition (sometimes doesn't as faulty) this file type is listed as exFAT. The only thing that I am even fairly certain about is the fact that the hard drive is formatted as exFAT.

When I type diskutil list into the command line it is listed as:
/dev/disk2 (external,physical):
#: TYPE NAME SIZE IDENTIFIER
0: FDisk_partition_scheme *1.0TB disk2
1: Windows_NFTS 1.0TB disk2s1

When I try to verify the volume using diskutil on the command line it tells me it is unable to verify. The name of the hard drive is no longer visible.

I have no idea what I am doing and terrified of selecting the wrong partition table and causing further damage. Am I ok to go ahead and select Intel as suggested in the Hint?

Many thanks in advance,
Emily

Yes.

Ok thank you!:)

Oh no! This has gone very badly

At first on Analyse I got a warning about CAD and MBR (cant remember exactly because its now stuck on another screen) I went ahead and did a quick search anyway as I'd seen from various online tutorials and forum posts.

My drive has one partition. It came up with a D next to it so I moved the left and right arrows to see the other options and left it on * BUT DEFINITELY DID NOT PRESS THE LETTER INDICATED TO CHANGE TYPE. THE ONLY LETTER I PRESSED WAS P to list the files.

No files showed up. I went back moved the arrows so original D was there and tried again. No files. Previously the partition was visible and had the correct data size (nearly 1TB)
Then it was saying no partition is visible.

I tried to get out of test disk with q, somehow got offered an advanced or deep search which I am doing now. It currently has output 2 identical lines:
HPFS - NTFS 2 1953458175 1953458174
HPFS - NTFS 2 1953458175 1953458174

I think the numbers are something about sectors since it says above that:
Disk /dev/disk2 - 1000 GB / 931 GiB - 1953458176 sectors

Should I stop the operation and try something else like ddrecovery? Is it better to just let it run its course at this point? Any idea how long that will take?
Any advice you could offer me would be greatly appreciated!

See what smartmontools says about your drive:
viewtopic.php?f=5&t=10910

Duplicating the drive using ddrescue as decribed in the manual might be necessary depending on the outcome of smartmontools.