cgsecurity.org

Hi everybody,
I dropped an external drive while it was running, after which I could mount the disk in mac os but it was only possible to open or copy single files and the disk stopped working causing Finder to freeze more than often. So I decided to clone the disk with ddrescue. This great tool wasn't able to recover all the data, but after a couple of days it had recovered/cloned 900GB of a 2TB drive. Of course the cloned drive doesn't mount because it's incomplete. When I run Photorec on the cloned drive, it will find lots of my data but this will take forever and it's completely unstructured. In Testdisk I can see the one partition but I don't know how to make it mountable.
1. If I can see the partition directly when I go to 'Analyse', do I even have to run 'Quick Search'?
2. I used 'Advanced' > repair Superblock but that didn't help.

What are my next steps? Is there a way to try and make this disk mount in Mac OS or any other way to display the files in the original file-structure?

It's useless to search for a partition using Analyse/Quick Search when the partition isn't missing.
The screenshot shows a 4TB filesystem but you wrote about a 2TB disk cloned using ddrescue. Did you create an image.dd file or do you cloned the disk to another one that yo have overwritten ?
If fsck failed to repair the clone, you can use PhotoRec.

thanks for your reply!

Yes, I cloned a 2TB drive to a 4TB drive using ddrescue. Is that a problem? I thought a larger drive would be fine...

When I try to run fsck (I used /sbin/fsck_hfs -f /dev/disk1) I get a "hfs_ValidateHFSPlusVolumeHeader: unknown Volume Signature" message.

I still don't understand how you get a 4TB partition from the clone of a 2 TB disk.
Normally if you had a 2TB partition on a 2TB disk and cloned the disk to a 4TB disk, you should get a 2TB partition on 4 TB disk but you have a 4TB partition on the 4 TB disk.

kamikade wrote: 04 Jun 2018, 13:49 When I try to run fsck (I used /sbin/fsck_hfs -f /dev/disk1) I get a "hfs_ValidateHFSPlusVolumeHeader: unknown Volume Signature" message.

You must not use fsck on the whole disk but on the partition itself: try "/sbin/fsck_hfs -f /dev/disk1s1" instead.