cgsecurity.org

Hi,

I have an external HDD hard disk that has been operated on a MAC with two partitions. (Format: Mac OS Extended (Journaled))
Now MacOS no longer recognizes the second partition with important data.
Unfortunately, I cannot currently see the HDD on the macOS terminal with Testdisk. (Despite the fact that I have given the terminal full folder access in the security settings)
I have therefore connected the HDD to my Windows laptop. Here Testdisk finds the hard disk and also two partitions.
The HDD is 1 TB in size. Both partitions have 500GB each. The broken partition has about 450~ utilization.
I would now like to restore / make the data on this partition accessible. I have decided to make an image of the broken partition before I do something I have no idea about. In the hope that the data can be read out with it.

Unfortunately, the creation of the image did not work completely, because there were "read errors": As a result, a DeepSearch on the image unfortunately gave an error:

Again, please upload your pictures to this site and post your Testdisk log file.
Thank you!

I do not understand the result of the DeepSearch from the Image.dd: It says that the hard disk is too small. But I am analyzing the ~490GB image on a hard disk with 1.2TB free space. That should be enough space to unpack the image once, right?

recuperation wrote: 13 Feb 2024, 19:10 Again, please upload your pictures to this site and post your Testdisk log file.
Thank you!

Sorry! all photos are now uploaded and i'll search for the log file

this is the result of the deep search on the hdd itself (and not the image): I assume that the second Partition is the one which has all the data.
When i try to change the characteristic in any way, i always have to delete the other. Otherwise the "structur" is bad. Is it because there is not enough space to restructure?
For me it would be fine to delete the one partition to keep the other.
Unfortunately i cannot find a log file at the moment in my Folder. (I was actually sure that I pressed "create" at the beginning.)
Will the log be written on the fly or only after finishing a process?

My Question is: What should i do next? Which characteristic should i use for the damaged partition.
(In the default tutorial, there was nothing with "bad relative sector" or that one partition of the two have to be marked as deleted.)
that made me wonder..

Thanks!

The read errors you noticed suggests that your disk has unreadable sectors. To learn about the currently known state of health of your disk run smartmontools and post your log file:
viewtopic.php?f=5&t=10910

Depending on the result it might be necessary to clone your disk twice using ddrescue as described in the manual.
Using TestDisk to clone a partition is not a good idea when the disk might be already dammaged as rescuing the content of such a disk or partition is stressing the disk as well and ddrescue rescues content in a smarter and less stressing way.
Furthermore the entry in your partition table to your second partition might point to a wrong location suggesting to always duplicate the whole disk (using ddrescrecue of course!).

The first clone creates a disk target without any physical errors. Unreadable sectors on your defective source will result in readable sectors on your target but with logically faulty content.

The second clone is supposed to be your playing area. If you do something wrong you can always duplicate the first clone again.
Duplicating your assumably defective source again might yield less results as additional sectors may become unreadable.

Is the content of your first partition readable? Its starting address 0/0/3 seems to be wrong even on a Mac as that does not fit well to a physical sector size of possibly 4096 bytes of your disk - you did not post your TestDisk log file leaving me in the dark. The log file is located in the TestDisk folder.

Having two partitions on a disk is not the state in which you bought that disk meaning that I suppose that you partitioned it.

Partitions may not overlap. Look at the figures on your screen, that is why you got the "structure is bad" message.
Depending on the age of your Apple operating system it should understand the GPT partition table scheme as well.
If you run TestDisk in GPT mode you will see an easier to read table format without the splitted cylinder/head/sector data.

TestDisk does not support the "list files" feature for HFS partitions. After writing the new partition table you would need to try out to read the content of your partition using your Mac. If the Mac supports mounting the partition in "read only" mode that would be nice.

If everything fails use Photorec or some commercial software.

Hi,

thanks for your detailed answer!
To avoid confusion, do I understand you correctly that there are two(three) procedures?

A: Create a double image with ddrescue and work on it

B: Change partition structure (write new table) with TestDisk in GPT mode (only on macos) and try to read the content there.
-> Is there a way to do it on windows?

or of course
C: Photorec or some commercial software.

Do I understand this correctly, or have I mixed things up?


Now to your Questions:

recuperation wrote: 14 Feb 2024, 11:26 Is the content of your first partition readable?

Yes it is! After a while macos recognizes the first partition and I can navigate normally with the Finder.

recuperation wrote: 14 Feb 2024, 11:26 Having two partitions on a disk is not the state in which you bought that disk meaning that I suppose that you partitioned it.

Unfortunately, the hard disk was partitioned like this by someone else.
I have no idea exactly what was done, when and why.

Requested SMART Log

tomstar22 wrote: 14 Feb 2024, 17:15 Hi,

thanks for your detailed answer!
To avoid confusion, do I understand you correctly that there are two(three) procedures?

A: Create a double image with ddrescue and work on it

B: Change partition structure (write new table) with TestDisk in GPT mode (only on macos) and try to read the content there.
-> Is there a way to do it on windows?

Read the manual, it came with your download. Read the online documentation on cgsecurity.org, for instance:
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
Thank you!

Does this ring a bell?
https://www.cgsecurity.org/wiki/TestDisk_Download

or of course
C: Photorec or some commercial software.

Do I understand this correctly, or have I mixed things up?

There is no "or". Please look up what a conditional clause containing the keywords "IF" and "THEN means. If you don't read my posting carefully I can't help you anyway. Please understand that I really don't like repeating everything again.

Your disk was handled roughly, overheated and has hundreds of unreadable or already replaced sectors. It is about to die.