cgsecurity.org

Posted: **16 Sep 2016, 21:22**

Hello everyone

few days ago I wanted to split partition but obviously I can't read and I chose "partitionDisk" option, basically I did:

Code: Select all

diskutil partitionDisk /dev/disk1 GPT JHFS+ New 100g

That was a mistake. It didn't ask me anything about erasing data, but still its terminal so I don't blame it. Now I've got an empty partition, but I want to recover the old one.

Is there any way to to such thing? I tried with testdisk, but it's kinda hard to use this soft, tried also deeper search, I saw there about 100 of rows with multiple partitions, but couldn't preview any because of HFS+ I guess.

However I believe the last option would be to use Photorec and recover files one by one...

Is someone could help I would be grateful.

Disk is 1TB WD Red, formatted to HFS+, earlier (a few months ago) was NTFS filesystem, using OSX.

Attaching testdisk log file.

testdisk.log.zip: (27.39 KiB) Downloaded 469 times

Posted: **17 Sep 2016, 13:26**

Try TestDisk, select the disk, Advanced, select the partition, Superblock. It may be able to fix the HFS+ superblock.
If it doesn't work, you can use PhotoRec to recover your data but it will not recover the original filenames or the directory structure.

Posted: **17 Sep 2016, 14:08**

Hi

thanks for your reply. Will try this in a few moments.
I started recovering within photorec and it's amazing, but filenames are missing as you said. But it's fair enough

EDIT: which option should I use?
Org. BS / Backup BS / Dump

Posted: **20 Sep 2016, 05:39**

If fsck has failed previously, you can try BackupBS and try again a fsck to repair the partition, ie.

Code: Select all

fsck_hfs -fy /dev/rdisk1s1

Posted: **20 Sep 2016, 20:09**

I guess it doesn't work either before and after overwriting superblock

what the command returns is

Code: Select all

** /dev/rdisk0s1
   Executing fsck_hfs (version hfs-305.10.1).
volumeType is 0
0000:  eb58 9042 5344 2020 342e 3400 0201 2000       |.X.BSD..4.4.....|
0010:  0200 0000 00f0 0000 2000 1000 0000 0000       |................|
0020:  0040 0600 4f0c 0000 0000 0000 0200 0000       |....O...........|
0030:  0100 0600 0000 0000 0000 0000 0000 0000       |................|
0040:  0000 29ed 17e3 6745 4649 2020 2020 2020       |......gEFI......|
0050:  2020 4641 5433 3220 2020 fa31 c08e d0bc       |..FAT32....1....|
0060:  007c fb8e d8e8 0000 5e83 c619 bb07 00fc       |................|
0070:  ac84 c074 06b4 0ecd 10eb f530 e4cd 16cd       |...t.......0....|
0080:  190d 0a4e 6f6e 2d73 7973 7465 6d20 6469       |...Non.system.di|
0090:  736b 0d0a 5072 6573 7320 616e 7920 6b65       |sk..Press.any.ke|
00a0:  7920 746f 2072 6562 6f6f 740d 0a00 0000       |y.to.reboot.....|
00b0:  0000 0000 0000 0000 0000 0000 0000 0000       |................|
. . .
01f0:  0000 0000 0000 0000 0000 0000 0000 55aa       |..............U.|

So I need to use photorec now?

cgsecurity.org

Formatted HFS+ partition

Formatted HFS+ partition

Re: Formatted HFS+ partition

Re: Formatted HFS+ partition

Re: Formatted HFS+ partition

Re: Formatted HFS+ partition