cgsecurity.org

2 hard drives in an enclosure got their partition tables corrupted, I'm guessing due to some error with the RAID controller (set on JBOD, never changed it or triggered any RAID initialization).

Both drives have a single HFS+ partition. One is non-essential, a 1 TB drive. I am testing some recovery methods on it. The following is what I've done.

I ran testdisk, which detected EFI GPT, but instructions said to use the Mac option. So, I ran the testdisk analyze tool in Mac mode, and got this:

partition: DOS_FAT_32
start: 40
end: 409639
size: 409600 [EFI]

partition: HFS
start: 578880
end: 1953432223
size: 1952853344

I then followed https://perrohunter.com/repair-a-mac-os ... ion-table/, and used pdisk to initialize a partition table, and attempted to create the partitions using the info above. It would not let me create the first one, said the base and length were not available empty space. I did create the second partition, and wrote the partition table. The drive is still not readable though.

I went back to testdisk and this time ran analyze in EFI GPT mode. The second result from above now looked like this:

partition: Mac HFS
start: 495388
end: 1953348731
size: 195283344

Running analyze in Mac mode still shows the result from earlier.

Which is the correct mode? What is the proper way to recreate the partition table, as the Mac partition table write is not supported?

The correct partition table type is EFI:
- TestDisk has detected it as EFI
- An EFI partition is present.
- Mac OS X is using EFI partition table for more than 10 years

Try fsck on the partition and next Disk Utility
http://osxdaily.com/2013/08/07/how-to-r ... user-mode/

cgrenier wrote: Try fsck on the partition and next Disk Utility
http://osxdaily.com/2013/08/07/how-to-r ... user-mode/

Thanks for the reply. This seems to be for a bootable drive. The two drives I am working on are not bootable, just external storage drives. I'm looking for information now on how to pass what drive fsck should work on, but haven't found anything yet.

Ok, found where you can pass the identifier for the drive to fsck.

I got error "Invalid B-tree node size (3,0) The volume could not be verified completely" from running fsck.

You can try PhotoRec to recover your data but it will not recover the original filenames.