Macbook HD (HFS+), partitions seem to detect okay

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read
Posts: 6
Joined: 28 Jun 2015, 18:16

Macbook HD (HFS+), partitions seem to detect okay

#1 Post by kathbot »

I have a 500 GB 2.5" Hitachi drive from my family member's 2011 Macbook Pro. I have run TestDisk before over the years on FAT and NTFS with no difficulty, but I am kind of at a loss what to try next with this one.

First, the partitions show and appear to be correct in TestDisk. There is a 200MB EFI sector, the main sector is HFS, then there is a small OS backup partition, also HFS at the end. I have written this to the partition table via TestDisk under Windows, but it didn't change the bootability. The options are all different (which is to be expected with a different filesystem, but I haven't been able to find any docs that are HFS specific). If I run a deeper search it correctly shows HFS areas but it also shows FAT32 areas with [DIAG] denotations and gives the warning "check_FAT: Unusual media descriptor (0xf0!=0xf8) Warning: number of sectors per track mismatches 32 (FAT) != 63 (HD)". I can't see any options to access the areas that correctly show as HFS.

There does appear to be a backup superblock, but whereas there are only the options to write A to B or B to A (no option to back up off drive), I am hesitant to try this. Is the superblock some sort of filesystem repository? I am only familiar with FAT and NTFS as far as what's going on under the hood.

Is there a way from testdisk to create a dd image of the entire drive and not just a partition? I would like to try the backup superblock not on the actual drive. If not, what would be a possible alternate way to image? I tried dd in the command line but it gave me errors when I put "of=image.dd" and said it was an invalid argument.

I have spent the last 2-3 days trying to read up on and learn about all this, but the information online is so fragmented I still don't have a clear picture of what to try next or what the options I've tried actually entail. One site mentions multiple alternate superblocks for instance. I am hesitant to make possibly irreversible changes.

Edited to add there is a sector about 1/3 through the drive that PhotoRec hangs on, but I would think that less likely to affect bootability/mountability.