Mac formatted drive (HFS) overwritten by Windows partition

How to use TestDisk to recover lost partition
Post Reply
Message
Author
MyRoSec
Posts: 1
Joined: 21 Dec 2015, 08:31

Mac formatted drive (HFS) overwritten by Windows partition

#1 Post by MyRoSec » 21 Dec 2015, 08:52

Dear,

An external drive used on a OSX system has been connected to a Windows OS. The partition seems to be overwritten.
The analyses of testDisk you find below and fully in the attached file. I am not quite sure what to do.
Could it be easily recovered?
If so, may should the P Mac HFS partition of 499/165 Gib be written to disk?

Thank you for your help.

Geert.



Sat Dec 19 10:48:04 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 13.4.0 (Darwin Kernel Version 13.4.0: Sun Aug 17 19:50:11 PDT 2014; root:xnu-2422.1
Compiler: GCC 4.0
Compilation date: 2015-04-18T13:01:34
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 640 GB / 596 GiB - 1250263728 sectors (RO), sector size=512
Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors, sector size=512
Disk /dev/rdisk0 - 640 GB / 596 GiB - 1250263728 sectors (RO), sector size=512
Disk /dev/rdisk1 - 8107 MB / 7731 MiB - 3958760 sectors (RO), sector size=2048
Disk /dev/rdisk2 - 500 GB / 465 GiB - 976773168 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/disk2 - 500 GB / 465 GiB
Partition table type: EFI GPT

Analyse Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976773167 (expected 976773167)
hdr_lba_start=34
hdr_lba_end=976773134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]

search_part()
Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors

HFS+ magic value at 10561/0/1

HFS+ magic value at 10561/0/1
part_size 61440
Mac HFS 10561 72000 61440
HFS+ blocksize=4096 + Backup, 31 MB / 30 MiB

HFS+ magic value at 262208/0/1
part_size 976510944
Mac HFS 262208 976773151 976510944
HFS+ blocksize=4096, 499 GB / 465 GiB

Results
P Mac HFS 10561 72000 61440
HFS+ blocksize=4096 + Backup, 31 MB / 30 MiB
P Mac HFS 262208 976773151 976510944
HFS+ blocksize=4096, 499 GB / 465 GiB

interface_write()
1 P Mac HFS 10561 72000 61440
2 P Mac HFS 262208 976773151 976510944
Attachments
testdisk.log.gz
(8.13 KiB) Downloaded 29 times

Sponsored links

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Mac formatted drive (HFS) overwritten by Windows partiti

#2 Post by Fiona » 21 Dec 2015, 11:07

Did you already try to write both HFS+-partitions into your GUID partition table?

Your current partition table contain only a MS Reserved partition, The size should be approximately 100 MB and the file system is probably NTFS?
There are no HFS+-partitions in your partition table, but TestDisk found some after Quick Search.
Results
P Mac HFS 10561 72000 61440
HFS+ blocksize=4096 + Backup, 31 MB / 30 MiB
P Mac HFS 262208 976773151 976510944
HFS+ blocksize=4096, 499 GB / 465 GiB

interface_write()
1 P Mac HFS 10561 72000 61440
2 P Mac HFS 262208 976773151 976510944
At the Interface Write, you can try to use the menu Write to write it into your GUID partition table and test it.

Fiona

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests