Need help recovering HFS+ from exFAT formatted drive Topic is solved

How to use TestDisk to recover lost partition
Post Reply
Message
Author
DrSteak
Posts: 5
Joined: 21 Nov 2016, 20:09

Need help recovering HFS+ from exFAT formatted drive

#1 Post by DrSteak » 21 Nov 2016, 20:16

I accidentally formatted my whole OS X storage drive to exFAT in windows and then copied a 100mb file in there. I've tried using other recovery tools and they can find most of my stuff, but they would require paying before getting the actual files back.
I tried using TestDisk on osx but the instructions on the documentation (http://www.cgsecurity.org/wiki/Data_Rec ... _partition) cannot be followed, since there is no "boot" option.
Instead I tried changing the type of the exFat volume to HFS+ and then creating an image, but that only recovered the file I had put in there AFTER reformatting. Any help is appreciated!

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3757
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Need help recovering HFS+ from exFAT formatted drive

#2 Post by cgrenier » 22 Nov 2016, 07:04

You can try TestDisk, Advanced, set the type to HFS+, Superblock
If it doesn't work, try fsck (see https://www.cgsecurity.org/testdisk.pdf for details)
If you have no success, it also possible to use PhotoRec to recover your files but it will not recover the original file structure and original filenames.

DrSteak
Posts: 5
Joined: 21 Nov 2016, 20:09

Re: Need help recovering HFS+ from exFAT formatted drive

#3 Post by DrSteak » 22 Nov 2016, 07:57

cgrenier wrote:You can try TestDisk, Advanced, set the type to HFS+, Superblock
If it doesn't work, try fsck (see https://www.cgsecurity.org/testdisk.pdf for details)
If you have no success, it also possible to use PhotoRec to recover your files but it will not recover the original file structure and original filenames.
Thanks for the reply! Should I buy another drive and duplicate the disk before attempting that? Is there a risk that the other recovery programs won't be able to find the files anymore after doing that?

User avatar
cgrenier
Site Admin
Posts: 3757
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Need help recovering HFS+ from exFAT formatted drive

#4 Post by cgrenier » 23 Nov 2016, 14:09

testdisk and fsck are usually safe to use but it's always better to have a sector by sector copy of the original disk (see ddrescue example in the documentation).

DrSteak
Posts: 5
Joined: 21 Nov 2016, 20:09

Re: Need help recovering HFS+ from exFAT formatted drive

#5 Post by DrSteak » 23 Nov 2016, 21:20

cgrenier wrote:testdisk and fsck are usually safe to use but it's always better to have a sector by sector copy of the original disk (see ddrescue example in the documentation).
Ok so I tried doing the superblock method but the problem is I can only see two partitions,
Screen Shot 2016-11-23 at 22.15.50.png
Screen Shot 2016-11-23 at 22.15.50.png (28.33 KiB) Viewed 642 times
and if I do superblock to the MS data (type changed to hfs+) it says that volume header is bad. Also I think that I should not do it to this partition, since quick search with the [analyze] shows a third partition, which is much larger and probably has all thats left of my files
Screen Shot 2016-11-23 at 22.18.47.png
Screen Shot 2016-11-23 at 22.18.47.png (21.03 KiB) Viewed 642 times
In this screen I chose [write] and rebooted.
Now I can see the volume that I had before format but only in disk utility. The volume has the original name but it isn't mountable.
I tried doing super block to this new partition and it says the volume header is ok and also the backup is ok but that they mismatch.
So i tried overwriting the header with the backup, but it says write error. I am now stuck

DrSteak
Posts: 5
Joined: 21 Nov 2016, 20:09

Re: Need help recovering HFS+ from exFAT formatted drive

#6 Post by DrSteak » 24 Nov 2016, 19:07

Screen Shot 2016-11-24 at 20.02.49.png
Screen Shot 2016-11-24 at 20.02.49.png (51.9 KiB) Viewed 616 times
It now looks like this. Before disk utility could not see any volumes but writing the partition table made those two appear. Only problem is I cannot mount the "Storage" (the volume that has my files) and fsck says it is read-only, so I cannot repair the filesystem. I cannot figure out how to make it writable, since all the methods I've found require you to mount the volume first.

DrSteak
Posts: 5
Joined: 21 Nov 2016, 20:09

Re: Need help recovering HFS+ from exFAT formatted drive  Topic is solved

#7 Post by DrSteak » 26 Nov 2016, 19:35

I managed to recover the files I need. Solution was to analyze the drive, write the partition table, then I used EaseUs data recovery trial software to get the files. The program was not able to recover the files before, but writing the partition table apparently affected it.

Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest