APT reformatted as GUID. Testdisk can't find old part info.

[logician]

2TB 2.5" USB https://en.wikipedia.org/wiki/Apple_Partition_Map-formatted drive erroneously reformatted as GUID (details below). Testdisk can't find old partition info. I thought it would be able to. Does testdisk not know about the "Alternate Master Directory Block" mentioned at https://en.wikipedia.org/wiki/Hierarchi ... tem#Design? I wonder which of the five structures that make up an HFS volume mentioned there have been destroyed. I'm hoping I don't have to resort to photorec.

Original format was standard-a single large HFS(Mac OS Extended (Journaled) partition on an APM (Mac) partition scheme. New format was 4 partitions: 1GB+1/2GB+1/4GB+1/4GB.

UI shows:

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015 / Christophe GRENIER <grenier@cgsecurity.org> / http://www.cgsecurity.org

Disk /dev/rdisk1 - 2000 GB / 1862 GiB - 3906963456 sectors (RO)
     Partition               Start        End    Size in sectors
 P DOS_FAT_32                    40     409639     409600 [EFI]
 P HFS                       409640 1953891367 1953481728
 P HFS                   1954153512 2930894375  976740864
>P HFS                   2931156520 3419526951  488370432

Log shows:

Code: Select all

Sun Aug 23 10:56:58 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 14.4.0 (Darwin Kernel Version 14.4.0: Thu May 28 11:35:04 PDT 2015; root:xnu-2782.3
Compiler: GCC 4.0
Compilation date: 2015-04-18T13:01:34
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO), sector size=512
Disk /dev/disk1 - 2000 GB / 1862 GiB - 3906963456 sectors (RO), sector size=512
Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO), sector size=512
Disk /dev/rdisk1 - 2000 GB / 1862 GiB - 3906963456 sectors (RO), sector size=512

Partition table type (auto): EFI GPT
Media is opened in read-only.
Disk /dev/rdisk1 - 2000 GB / 1862 GiB (RO)
Partition table type: Mac

Analyse Disk /dev/rdisk1 - 2000 GB / 1862 GiB - 3906963456 sectors (RO)
Current partition structure:
Bad MAC partition, invalid block0 signature
read_part_mac: bad DPME signature

I imaged the reformatted drive using DD to a 3.5" 2TB drive (not shown above) so I can run tests.

What should I be trying?

(PS: No normal files have been written to the new partitions, but Spotlight probably did some writing and I have excluded the partitions from Spotlight.)

UPDATE: Hmm. No replies yet... I ran some trialware (Wondershare) and it seems to have found the original partition info!
It found 6 partitions, including one that looks right.
It found ones like the 4 above, but the ending sector number is 1 more than in the table above. Plus it found:

Code: Select all

Partition #  Validity	File System 	Start		  End
2		      0%	      HFS+		    262208		  3906963448
6		      100%	    ExFAT		   3419789312	 3906961408

So, how do I as nondestructively as possible reformat it back to have an APM with a partition like #2, above? Anyone?

[Fiona]

I'm not as much an Apple tech savvy and know probably some basics.
Apple partition map requires a different procedure:
http://www.cgsecurity.org/wiki/OS_Notes ... PowerPC.29
If your disk appears as EFI GPT, can you revert it back to apple partition map?
If it's possible, formatting should be avoided and you can use TestDisk to search for partitions.
If you'd like to use pdisk and your disk appears as not initialzed, you shouldn't use pdisk to initialize but disk utilities instead of.
It's already a long time ago, I've read that initializing a disk using pdisk can cause trouble.

Fiona

[logician]

Thanks.
/usr/sbin/pdisk -v reports:
version 0.9a2 (16 May 2004)
It has no "c" command (as seen at http://www.cgsecurity.org/wiki/OS_Notes ... PowerPC.29)!?
Am I missing the normal version of pdisk? Perhaps...

Seems like something like

Code: Select all

sudo pdisk -c -d -f

e /dev/rdisk2
...

may work. Will be trying that. The disk appears as EFI GPT. Can I revert it back to apple partition map? That's the big question.

[logician]

SUCCESS! It took a bunch of work, educated guess work, and trial and error, but with the help of pdisk and DiskWarrior, I got the data back - filenames, folders and all. Of some help was http://perrohunter.com/repair-a-mac-os- ... ion-table/ (including comments)