Page 1 of 1
Deep Search shows tons of deleted partitions
Posted: 15 Aug 2016, 17:25
by manuyavuz
Hi all,
I've accidentally repartitioned my external drive, and trying to recover using testdisk.
I've run "Quick Search", and it showed only currently active partitions, there were no deleted partitions.
Then I've run "Deep Search", this time it found thousands of deleted partitions whose sector sizes are the same but start/end values are shifted by some margin.
And because the partition that I want to save is an HFS partition, I can't try using "list" option and detecting which of the listed partitions will show the file list.
How can I detect which of the partitions is the true one?
- Result of "Quick Search"
- quicksearch.jpg (168.24 KiB) Viewed 8721 times
- Warning after "Deep Search" completion
- deepsearcherror.jpg (145.01 KiB) Viewed 8721 times
- Result of "Deep Search"
- deepsearch.jpg (177.2 KiB) Viewed 8721 times
Re: Deep Search shows tons of deleted partitions
Posted: 15 Aug 2016, 21:27
by cgrenier
To find the correct HFS+ partition, you should try the partition where "+ Backup" is listed on the last line of the screen when highlighted.
Re: Deep Search shows tons of deleted partitions
Posted: 15 Aug 2016, 22:01
by manuyavuz
Thanks for the fast response!
So I'll move with the following partitions:
Code: Select all
>P EFI System 40 409639 409600 [EFI] (Which can list files via "p" button)
>P Mac HFS 411648 488692895 488281248 (HFS+ blocksize=4096 + Backup, 249 GB / 232 GiB)
>P Mac HFS 488955040 1465517535 976562496 (HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB)
>P Mac HFS 1465779680 1758486527 292706848 (HFS+ blocksize=4096 + Backup, 149 GB / 139 GiB)
>P MS Data 1758748672 1953523711 194775040 (exFAT, blocksize=131072, 99 GB / 92 GiB) (Which can list files via "p" button)
Changing these from Deleted to Primary and then continuing would be enough right?
Re: Deep Search shows tons of deleted partitions
Posted: 15 Aug 2016, 22:18
by manuyavuz
I've tried to write new partition table but write failed with "write error" message.
By the way, I see that the above partition table which I selected from deleted partitions seems to be exactly the same with current partition structure, which is the folowing:
Code: Select all
1 P EFI System 40 409639 409600 [EFI System Partition]
2 P Mac HFS 411648 488692895 488281248 [Apple_HFSX_Untitled_2]
3 P Mac HFS 488955040 1465517535 976562496 [TimeMachine]
4 P Mac HFS 1465779680 1758486527 292706848 [MacMini]
5 P MS Data 1758748672 1953523711 194775040 [windows]
What should I do to be able to correctly write deleted partition and reach the files?
Re: Deep Search shows tons of deleted partitions
Posted: 22 Aug 2016, 11:20
by manuyavuz
Hi again,
I had to run a Deeper Search from scratch. Here is the full log file :
Is it possible to switch only one partition from deleted to primary? I really need to save only one partition, namely the following (most probably):
Code: Select all
HFS+ magic value at 1465517534/0/1
part_size 976562496
Mac HFS 488955040 1465517535 976562496
HFS+ found using backup sector!, 499 GB / 465 GiB
which has the same Start/End sectors with the current partition table:
Code: Select all
Results
P EFI System 40 409639 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
P Mac HFS 411648 488692895 488281248
HFS+ blocksize=4096 + Backup, 249 GB / 232 GiB
P Mac HFS 488955040 1465517535 976562496
HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB
P Mac HFS 1465779680 1758486527 292706848
HFS+ blocksize=4096 + Backup, 149 GB / 139 GiB
P MS Data 1758748672 1953523711 194775040
exFAT, blocksize=131072, 99 GB / 92 GiB
How should I continue now? Would switching only the above partition work without switching EFI System to primary?