cgsecurity.org

I have a mac with a 500gb hard drive. I stupidly decided to run Windows via bootcamp and then half way through decided I didn't need to do it. So I deleted the bootcamp partition via disk utility (yes I now know I should not have done that) and i'm 3 days into trying to figure out how to get my mac to boot again - or at the very least to figure out a way to extract my data so I can rebuild.

I am running OS X on an external drive now, and I've run test disk a million times. At this point I don't know if I'm supposed to scan it as "intel, EFI, or Apple". I've posted the scan results from EFI, the disk I'm trying to recover is /dev/disk0.

Please advise. I'm lost. I know that the data I"m trying to retrieve is on a partition that is somewhere around 460+ Gb.

Thanks in advance!


Fri Oct 27 09:54:29 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, October 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 15.6.0 (Darwin Kernel Version 15.6.0: Thu Jun 23 18:25:34 PDT 2016; root:xnu-3248.6
Compiler: GCC 4.0
Compilation date: 2017-10-19T18:43:11
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors, sector size=512
Disk /dev/disk1 - 160 GB / 149 GiB - 312576000 sectors (RO), sector size=512
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors, sector size=512
Disk /dev/rdisk1 - 160 GB / 149 GiB - 312576000 sectors (RO), sector size=512

Partition table type (auto): EFI GPT
Disk /dev/disk0 - 500 GB / 465 GiB
Partition table type: EFI GPT

Analyse Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors
hdr_size=92
hdr_lba_self=977105059
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=977105026
hdr_lba_table=977105027
hdr_entries=128
hdr_entsz=128
Bad GPT partition, invalid signature.
Trying alternate GPT
1 P EFI System 40 409639 409600
2 P Unknown 409640 897571039 897161400
3 P Mac Boot 897571040 898840575 1269536
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
1 P EFI System 40 409639 409600
2 P Unknown 409640 897571039 897161400
3 P Mac Boot 897571040 898840575 1269536

search_part()
Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
Unknown 171354053 2079162662 1907808610
FATX, 976 GB / 909 GiB
Partition not added.
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition

SYSV4 Marker at 472160279/0/1

recover_sysv4
Unknown 472160279 98651048342 98178888064 [¶]È«
]
SysV4, 50 TB / 45 TiB
Partition not added.

HFS+ magic value at 883214692/0/1
part_size 1269536
Mac HFS 883214692 884484227 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB

HFS+ magic value at 898840572/0/1
part_size 1269536
Mac HFS 898840572 900110107 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB

HFS+ magic value at 977105020/0/1
part_size 1269536
Mac HFS 977105020 978374555 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB
This partition ends after the disk limits. (start=977105020, size=1269536, end=978374555, disk end=977105060)

HFS+ magic value at 977105022/0/1
part_size 1269536
Mac HFS 975835488 977105023 1269536
HFS+ found using backup sector!, 650 MB / 619 MiB
Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 500 GB / 466 GiB)
The following partition can't be recovered:
Mac HFS 977105020 978374555 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB

Results
P EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
P Mac HFS 883214692 884484227 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB
P Mac HFS 898840572 900110107 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB
P Mac HFS 975835488 977105023 1269536
HFS+ found using backup sector!, 650 MB / 619 MiB

interface_write()
1 P EFI System 40 409639 409600 [EFI System Partition] [EFI]
2 P Mac HFS 883214692 884484227 1269536
3 P Mac HFS 898840572 900110107 1269536
4 P Mac HFS 975835488 977105023 1269536

search_part()
Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
FAT32 at 46/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 46/0/1
FAT: Directory entry is marked as free.
FAT: cluster=2(0x2), pos=6380
MS Data 46 409645 409600 [ Not Found.]
FAT32, blocksize=512, 209 MB / 200 MiB
Unknown 171354053 2079162662 1907808610
FATX, 976 GB / 909 GiB
Partition not added.
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition

SYSV4 Marker at 472160279/0/1

recover_sysv4
Unknown 472160279 98651048342 98178888064 [¶]È«
]
SysV4, 50 TB / 45 TiB
Partition not added.

HFS+ magic value at 883214692/0/1
part_size 1269536
Mac HFS 883214692 884484227 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB

HFS+ magic value at 883214694/0/1
part_size 1269536
Mac HFS 881945160 883214695 1269536
HFS+ found using backup sector!, 650 MB / 619 MiB

HFS+ magic value at 898840572/0/1
part_size 1269536
Mac HFS 898840572 900110107 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB

HFS+ magic value at 898840574/0/1
part_size 1269536
Mac HFS 897571040 898840575 1269536
HFS+ found using backup sector!, 650 MB / 619 MiB

HFS+ magic value at 977105020/0/1
part_size 1269536
Mac HFS 977105020 978374555 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB
This partition ends after the disk limits. (start=977105020, size=1269536, end=978374555, disk end=977105060)

HFS+ magic value at 977105022/0/1
part_size 1269536
Mac HFS 975835488 977105023 1269536
HFS+ found using backup sector!, 650 MB / 619 MiB
Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 500 GB / 466 GiB)
The following partition can't be recovered:
Mac HFS 977105020 978374555 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB

Results
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
MS Data 46 409645 409600 [ Not Found.]
FAT32, blocksize=512, 209 MB / 200 MiB
Mac HFS 881945160 883214695 1269536
HFS+ found using backup sector!, 650 MB / 619 MiB
Mac HFS 883214692 884484227 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB
Mac HFS 897571040 898840575 1269536
HFS+ found using backup sector!, 650 MB / 619 MiB
Mac HFS 898840572 900110107 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB
P Mac HFS 975835488 977105023 1269536
HFS+ found using backup sector!, 650 MB / 619 MiB


dir_partition inode=0
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
FAT: cluster=2(0x2), pos=6374
Directory /
3 drwxr-xr-x 0 0 0 25-Oct-2017 16:30 EFI
77835 drwxr-xr-x 0 0 0 20-Oct-2017 10:02 .Trashes
6 -rwxr-xr-x 0 0 40278 25-Oct-2017 16:30 BOOTLOG

dir_partition inode=3
EFI System

CHoose EFI GPT, Analyse, Backup, Quick Search, use 'L' to load the backup, set the partition type of the partition to get
P EFI System 40 409639 409600
P Mac HFS 409640 897571039 897161400
P Mac Boot 897571040 898840575 1269536
Use the arrow keys to switch the other partitions to D(eleted).
Once it's ok, go on next screen, choose to write the 3 partitions, confirm, Quit and restart.
You should be able at least to copy your files.

Truly appreciate your response. I did what you said and my HD still shows as one big 500gb unformatted disk. When I try and list files in test disk it says this OS isn’t supported.

Can you post the new testdisk.log ?

<code>


Sun Oct 29 09:42:20 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, October 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 15.6.0 (Darwin Kernel Version 15.6.0: Thu Jun 23 18:25:34 PDT 2016; root:xnu-3248.6
Compiler: GCC 4.0
Compilation date: 2017-10-19T18:43:11
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors, sector size=512
Disk /dev/disk1 - 160 GB / 149 GiB - 312576000 sectors (RO), sector size=512
Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors, sector size=512
Disk /dev/rdisk1 - 160 GB / 149 GiB - 312576000 sectors (RO), sector size=512

Partition table type (auto): EFI GPT
Disk /dev/disk0 - 500 GB / 465 GiB
Partition table type: EFI GPT

Analyse Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=977105059 (expected 977105059)
hdr_lba_start=34
hdr_lba_end=977105026
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P EFI System 40 409639 409600 [EFI System Partition]

search_part()
Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
Unknown 171354053 2079162662 1907808610
FATX, 976 GB / 909 GiB
Partition not added.
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition

SYSV4 Marker at 472160279/0/1

recover_sysv4
Unknown 472160279 98651048342 98178888064 [¶]È«
]
SysV4, 50 TB / 45 TiB
Partition not added.

HFS+ magic value at 883214692/0/1
part_size 1269536
Mac HFS 883214692 884484227 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB

HFS+ magic value at 898840572/0/1
part_size 1269536
Mac HFS 898840572 900110107 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB

HFS+ magic value at 977105020/0/1
part_size 1269536
Mac HFS 977105020 978374555 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB
This partition ends after the disk limits. (start=977105020, size=1269536, end=978374555, disk end=977105060)

HFS+ magic value at 977105022/0/1
part_size 1269536
Mac HFS 975835488 977105023 1269536
HFS+ found using backup sector!, 650 MB / 619 MiB
Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 500 GB / 466 GiB)
The following partition can't be recovered:
Mac HFS 977105020 978374555 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB

Results
P EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
P Mac HFS 883214692 884484227 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB
P Mac HFS 898840572 900110107 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB
P Mac HFS 975835488 977105023 1269536
HFS+ found using backup sector!, 650 MB / 619 MiB

P Mac HFS 883214692 884484227 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB
Support for this filesystem hasn't been implemented.

interface_write()
1 P EFI System 40 409639 409600 [EFI System Partition] [EFI]
2 P Mac HFS 883214692 884484227 1269536
3 P Mac HFS 898840572 900110107 1269536
4 P Mac HFS 975835488 977105023 1269536

search_part()
Disk /dev/disk0 - 500 GB / 465 GiB - 977105060 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI System Partition] [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB
FAT32 at 46/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 46/0/1
FAT: cluster=2(0x2), pos=6380
FAT: cluster=771(0x303), pos=7149
FAT: cluster=1540(0x604), pos=7918
FAT: cluster=2309(0x905), pos=8687
FAT: cluster=3078(0xc06), pos=9456
FAT: cluster=3847(0xf07), pos=10225
FAT: cluster=4616(0x1208), pos=10994
FAT: cluster=5385(0x1509), pos=11763
FAT: cluster=6154(0x180a), pos=12532
FAT: cluster=6923(0x1b0b), pos=13301
FAT: cluster=7692(0x1e0c), pos=14070
FAT: cluster=8461(0x210d), pos=14839
FAT: cluster=9230(0x240e), pos=15608
FAT: cluster=9999(0x270f), pos=16377
FAT: cluster=10768(0x2a10), pos=17146
FAT: cluster=11537(0x2d11), pos=17915
FAT: cluster=12306(0x3012), pos=18684
FAT: cluster=13075(0x3313), pos=19453
FAT: cluster=13844(0x3614), pos=20222
FAT: cluster=14613(0x3915), pos=20991
FAT: cluster=15382(0x3c16), pos=21760
FAT: cluster=16151(0x3f17), pos=22529
FAT: cluster=16920(0x4218), pos=23298
FAT: cluster=17689(0x4519), pos=24067
FAT: cluster=18458(0x481a), pos=24836
FAT: cluster=19227(0x4b1b), pos=25605
FAT: cluster=19996(0x4e1c), pos=26374
FAT: cluster=20765(0x511d), pos=27143
FAT: cluster=21534(0x541e), pos=27912
FAT: cluster=22303(0x571f), pos=28681
FAT: cluster=23072(0x5a20), pos=29450
FAT: cluster=23841(0x5d21), pos=30219
FAT: cluster=24610(0x6022), pos=30988
FAT: cluster=25379(0x6323), pos=31757
FAT: cluster=26148(0x6624), pos=32526
FAT: cluster=26917(0x6925), pos=33295
FAT: cluster=27686(0x6c26), pos=34064
FAT: cluster=28455(0x6f27), pos=34833
FAT: cluster=29224(0x7228), pos=35602
FAT: cluster=29993(0x7529), pos=36371
FAT: cluster=30762(0x782a), pos=37140
FAT: cluster=31531(0x7b2b), pos=37909
FAT: cluster=32300(0x7e2c), pos=38678
FAT: cluster=33069(0x812d), pos=39447
FAT: cluster=33838(0x842e), pos=40216
FAT: cluster=34607(0x872f), pos=40985
FAT: cluster=35376(0x8a30), pos=41754
FAT: cluster=36145(0x8d31), pos=42523
FAT: cluster=36914(0x9032), pos=43292
FAT: cluster=37683(0x9333), pos=44061
FAT: cluster=38452(0x9634), pos=44830
FAT: cluster=39221(0x9935), pos=45599
FAT: cluster=39990(0x9c36), pos=46368
FAT: cluster=40759(0x9f37), pos=47137
FAT: cluster=41528(0xa238), pos=47906
FAT: cluster=42297(0xa539), pos=48675
FAT: cluster=43066(0xa83a), pos=49444
FAT: cluster=43835(0xab3b), pos=50213
FAT: cluster=44604(0xae3c), pos=50982
FAT: cluster=45373(0xb13d), pos=51751
FAT: cluster=46142(0xb43e), pos=52520
FAT: cluster=46911(0xb73f), pos=53289
MS Data 46 409645 409600 [ Not Found.]
FAT32, blocksize=512, 209 MB / 200 MiB
Unknown 171354053 2079162662 1907808610
FATX, 976 GB / 909 GiB
Partition not added.
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition

SYSV4 Marker at 472160279/0/1

recover_sysv4
Unknown 472160279 98651048342 98178888064 [¶]È«
]
SysV4, 50 TB / 45 TiB
Partition not added.

HFS+ magic value at 883214692/0/1
part_size 1269536
Mac HFS 883214692 884484227 1269536
HFS+ blocksize=4096, 650 MB / 619 MiB

HFS+ magic value at 883214694/0/1
part_size 1269536
Mac HFS 881945160 883214695 1269536
HFS+ found using backup sector!, 650 MB / 619 MiB

HFS+ magic value at 898840572/0/1
part_size 1269536
Mac HFS 898840572 900110107
</code>

Currently, the partition table is near empty, there is only the EFI Systsem partition.
As written previously, choose EFI GPT, Analyse, Quick Search, use 'L' to load the backup, set the partition type of the partition to get
P EFI System 40 409639 409600
P Mac HFS 409640 897571039 897161400
P Mac Boot 897571040 898840575 1269536
You may have to use 'a' to manually add the missing partitions.
Use the arrow keys to switch the other partitions to D(eleted).
Once it's ok, go on next screen, choose to write the 3 partitions, confirm, Quit and restart.