The disk is 1TB in size and HFS+ formatted. I managed with photorec to recover probably most of the data, but it will of course be a mess to sort everything out. Not a huge problem but I am wondering if there's an easier/testdisk way which I may have missed to just recover the partition with directories etc.
With testdisk I can see the following disk (using an image file)
I then write the updated partition table
And finally try to mount the image
(the number 134250496 comes from 262208x512 (cylinder x size))
Code: Select all
# mount -t hfsplus -o ro,loop,offset=134250496 image.dd /mnt/testmount
# cd /mnt/testmount
# ls -ltrha
total 81M
---------- 1 root root 4.0K Oct 5 2011 .journal_info_block
dr-xr-xr-t 1 root root 2 Oct 5 2011 .HFS+ Private Directory Data?
---------- 1 root root 80M Oct 5 2011 .journal
drwx------ 1 99 99 3 Oct 5 2011 .Spotlight-V100
drwxrwxr-x 1 99 99 9 Oct 5 2011 .
d-wx-wx-wt 1 99 99 2 Oct 5 2011 .Trashes
drwx------ 1 99 99 6 Oct 5 2011 .fseventsd
drwxr-xr-x 5 root root 4.0K Jan 11 18:04 ..
Upon deeper search testdisk also seems to show a load of other disks.. I'm not sure what they all are.
So my questions are
1) Is my method correct? Would it have shown the data if the parition/journal was not corrupted?
2) Would those other partitions offer any hope? Personally I don't see much point in going trough all of them, they seem more like a sign of some scattered/broken partition table.
Finally, just a note that someone else has been messing with the disk before me so (s)he might've (re)written partition tables possibly causing this long list of partition tables.
Thanks for any suggestions/comments !
