cgsecurity.org

Hi there,

I have been reading a lot of cases of lost partitions and attempted recoveries on testdisk and searching for explanations, but keep getting lost, and I'm pretty sure I haven't found what I need anywhere.

I have a 2TB external drive. I had it working well in 2 partitions: 1 NTFS and 1 Mac OS extended journaled (I'm pretty sure was the format). I think I had near 1 TB data on the NTFS and 550-600 GB data on the Mac OSext. partition.
I used a windows computer program to create a 3rd partition to store a mac time machine image. My intention was to not use it for long this way and return to 2 partitions as before. But I have not gotten there. My Mac OS extended partition seemed to be gone. It won't mount on any computer, and is not visible in diskutility or other programs.

I believe my problem was caused by the program I used to take the empty space from the original 2 partitions. However, I'm not totally sure. It is possible to have happened while using the 3rd partition (~240GB) to save and restore a time machine image onto an iMac.

Either way I have spent a few solid days now trying to figure out how to use testdisk to get my macos extended partition back. It seems to still be there. The instructions I find and follow always seem to differ at some point from what I'm seeing/getting on testdisk. At one point I did about a 4 day deep search scan of the drive on one computer. I have done a 1 day scan on another computer.
This was result in terminal, and I had no idea what to do and could not find answer anywhere:
I feel like this was a waste of time if I want to recover partition table though? I'm not sure what that means, I am pretty scared by many of the possible commands I can select in testdisk. I feel like I am only understanding fragments of the problem or solution at a time and thus could easily make a detrimental mistake.

When I open testdisk this is what I see following what I understand to be the basic process I am supposed to be going through:

Here are some links to screenshots from what I get going through typical process in testdisk:

https://drive.google.com/open?id=0B269l ... ERvc01qenc
https://drive.google.com/open?id=0B269l ... 2dNM2w3eFk
https://drive.google.com/open?id=0B269l ... 0xtOHQzLUU



Here are the links to the log files:

1st computer I used to deep search (4 days, full disk) log:
https://drive.google.com/open?id=0B269l ... klwWGNXOVk

2nd computer I used to deep search (28hrs ish, only the partition I suspect is the one I want (~600 GB) log:



I have a feeling I can restore the partition as a whole, if I can understand how. If not, I am confident I could get the files and save them, but again, haven't understood the instructions I have managed to find to do this. I'm at wit's end.
At one point I followed a guide to use photorec, and it didn't get me anywhere. I am pretty sure I have to in order to do file recovery since I read that testdisk is not the tool for it on a mac os extended? Photorec doesn't seem to run with root though and none of the disks show up. Unlike testdisk it does not give me option to run sudo.



Can anyone explain to me what is going on, please?

It seems the device disconnects after the deeper search. It may be caused by bad sectors.
You should clone the disk to a new empty one using ddrescue. Once it's done, remove the original disk and try to recover your data from the clone.

cgrenier wrote:It seems the device disconnects after the deeper search. It may be caused by bad sectors.
You should clone the disk to a new empty one using ddrescue. Once it's done, remove the original disk and try to recover your data from the clone.

Why do you say it disconnects after the deeper search? Was this by looking at the log files? I believe it did disconnect by being bumped while I was running the 4 day test (i got notifications on the desktop saying it was ejected), but the test seemed to continue anyways and I did not think it was a problem. If you are saying it was, maybe I am better running the full deeper search again. I'd rather do that than go through buying another drive, clone AND then continue trying this...

It's strange because the first time, using my macbook, I was able to run a deeper search on full drive... but following typical process now on the imac does not give me that option. I check now, and I AM able to see the full disk and deeper search it while on macbook after the quick search analysis:

on imac on macbook The highlighted partition is the one I am trying to recover... its the most important one actually. I care so much less about the other two, and the smallest, the 3rd one I made, is worthless.