hfs+ image partition rewrite linux

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Posts: 2
Joined: 11 Jan 2013, 17:54

hfs+ image partition rewrite linux

#1 Post by kikker »

Hi, I'm trying to help a friend recover her data.
The disk is 1TB in size and HFS+ formatted. I managed with photorec to recover probably most of the data, but it will of course be a mess to sort everything out. Not a huge problem but I am wondering if there's an easier/testdisk way which I may have missed to just recover the partition with directories etc.

With testdisk I can see the following disk (using an image file)


I then write the updated partition table


And finally try to mount the image

(the number 134250496 comes from 262208x512 (cylinder x size))

Code: Select all

# mount -t hfsplus -o ro,loop,offset=134250496  image.dd  /mnt/testmount
# cd /mnt/testmount
# ls -ltrha
total 81M
---------- 1 root root 4.0K Oct  5  2011 .journal_info_block
dr-xr-xr-t 1 root root    2 Oct  5  2011 .HFS+ Private Directory Data?
---------- 1 root root  80M Oct  5  2011 .journal
drwx------ 1   99   99    3 Oct  5  2011 .Spotlight-V100
drwxrwxr-x 1   99   99    9 Oct  5  2011 .
d-wx-wx-wt 1   99   99    2 Oct  5  2011 .Trashes
drwx------ 1   99   99    6 Oct  5  2011 .fseventsd
drwxr-xr-x 5 root root 4.0K Jan 11 18:04 ..
However, unfortunately it seems there is nothing there.
Upon deeper search testdisk also seems to show a load of other disks.. I'm not sure what they all are.
So my questions are
1) Is my method correct? Would it have shown the data if the parition/journal was not corrupted?
2) Would those other partitions offer any hope? Personally I don't see much point in going trough all of them, they seem more like a sign of some scattered/broken partition table.
Finally, just a note that someone else has been messing with the disk before me so (s)he might've (re)written partition tables possibly causing this long list of partition tables.

Thanks for any suggestions/comments !


Sponsored links