Recovering 2 HFS+ formatted partitions, unsure how to proceed after recovering 1st

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
rsfalkirk
Posts: 5
Joined: 03 Jun 2018, 12:46

Recovering 2 HFS+ formatted partitions, unsure how to proceed after recovering 1st

#1 Post by rsfalkirk » 03 Jun 2018, 14:05

Background

The drive I am trying to fix is a 3TB 3.5" HDD retrieved from a Toshiba external drive I have been using for a couple of years. Recently the drive stopped working with no warning signs or explanation.

The drive had been partitioned into 2 1.5TB HFS+ partitions, named "Backups" (for my Mac's Time Machine backups) and "Storage" (to offload files which were taking up too much space on my Mac's internal SSD).

The enclosure was not designed to be user-opened so I have had to break open the plastic enclosure to remove the hard drive inside. The drive itself is a standard SATA HDD, and was connected via its SATA port to a circuit board which then had the USB 3.0 and power connectors. There is what looks like some visible damage on this circuit board, which I believe may be the reason why the drive stopped working. I do not believe that the drive itself has been physically damaged, and the way in which it stopped working without warning makes me believe that the fault is with the enclosure and not the drive itself. However, whatever happened resulted in the drive becoming unreadable.


Steps taken so far

(the following is from memory, apologies as I wasn't documenting these steps at the time and this has taken place over the past week)

I initially bought an enclosure to connect the drive to my Mac via USB, however while the drive appeared in Disk Utility, the drive's contents were not recognised and it could not be mounted. Running First Aid didn't help.

At first I couldn't find any Mac software which could help, so I connected the drive to my Windows 10 PC directly through the motherboard via SATA cable. The drive was detected and appeared to run normally, however again the contents were not recognised. After trying a couple of Windows programs which also didn't work, I came across TestDisk.

TestDisk recognised the drive and recommend it was an Intel/PC partitioned drive. After running Analyse it detected 2 HFS partitions, which both appeared to be the same size. I wrote this partition information, restarted, and Windows' Disk Management now detected 4 partitions on the drive - 2 very small partitions, and 2 large partitions. As Windows cannot natively read HFS format, I then removed the drive from the PC and reconnected it via enclosure to my Mac.

My Mac initially saw 4 partitions, but as before it could not read or mount any of the 4 partitions. I then downloaded the Mac version of TestDisk, and ran the Analyse function again, and could now see 3 partitions instead of 4. After writing this partition information and restarting, I then had some success:

https://i.imgur.com/D8yE3V2.png

TestDisk has successfully recovered one of the two partitions! The "Backups" partition in the screenshot is readable, and I have verified that the contents of the drive (Time Machine backups) are present. TestDisk even recovered the partition's original name, which I didn't expect it to do! (I have disabled Time Machine for the time being to avoid it trying to reuse the drive before I am finished fixing it.)

Unfortunately, I still have the problem that the second partition ("Storage") has not been recovered, and I am now going round in circles trying to work out what the issue might be. As you can see from the Disk Utility screenshot, the drive currently sees 3 partitions - the successfully recovered Backups partition and 2 unmountable partitions, "disk2s2" and "disk2s3".


Current status

When I run Analyse on the drive, TestDisk is currently giving me the following warnings:

Code: Select all

TestDisk 7.1-WIP, Data Recovery Utility, April 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 * HFS                       614448 2930302975 2929688528

Warning: Bad starting head (CHS and LBA don't match)
 2 P HFS                   2930306128 2930568271     262144

Warning: Bad starting head (CHS and LBA don't match)
 3 P HFS                   2930657736 5860363599 2929705864

Warning: Bad starting head (CHS and LBA don't match)




*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
>[Quick Search]  [ Backup ]
Continuing with the Quick Search gives me the following:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors

The harddisk (3000 GB / 2794 GiB) seems too small! (< 3000 GB / 2794 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
   HFS                        91568 5860619695 5860528128
   HFS                        91680 5860619807 5860528128
   HFS                        91744 5860619871 5860528128
   HFS                        91776 5860619903 5860528128
   HFS                        91824 5860619951 5860528128
   HFS                        91880 5860620007 5860528128
   HFS                        92024 5860620151 5860528128
   HFS                        92088 5860620215 5860528128
   HFS                        92208 5860620335 5860528128
   HFS                        92320 5860620447 5860528128
   HFS                        92384 5860620511 5860528128
   HFS                        92448 5860620575 5860528128
   HFS                        92496 5860620623 5860528128
   HFS                        92624 5860620751 5860528128
   HFS                        92696 5860620823 5860528128
   HFS                        92808 5860620935 5860528128
   HFS                        92856 5860620983 5860528128
   HFS                        92976 5860621103 5860528128
   HFS                        93040 5860621167 5860528128
   HFS                        93120 5860621247 5860528128
   HFS                        93184 5860621311 5860528128
   HFS                        93248 5860621375 5860528128
   HFS                        93320 5860621447 5860528128
   HFS                        93432 5860621559 5860528128
   HFS                        93544 5860621671 5860528128
   HFS                        93576 5860621703 5860528128
[ Continue ]
HFS+ blocksize=8192, 3000 GB / 2794 GiB
Selecting Continue then shows:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors

Warning: the current number of heads per cylinder is 1
but the correct value may be 8.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlap.


[ Continue ]
After continuing:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
     Partition               Start        End    Size in sectors
>* HFS                       614448 2930302975 2929688528
 P HFS                   2930306128 2930568271     262144
 P HFS                   2930657736 5860363599 2929705864


Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type,
     Enter: to continue
HFS+ blocksize=4096 + Backup, 1500 GB / 1396 GiB
As these partitions are HFS/HFS+ formatted, I'm unable to use the p key to check the file contents as suggested in the Step by Step guide.

Writing this partition structure doesn't yield any changes - after restarting I still have the Backups partition and the two unmountable disk2s2/disk2s3 partitions. I haven't yet completed a Deeper Search to see if this yields results, as when I've tried to run this it has taken an extremely long time to scan through the disk, even after leaving it running overnight it was only about 1/5 done.

As TestDisk has suggested trying to alter the heads per cylinder, I have tried to do so via the Geometry menu by changing the value from 1 to 8, as so:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors, sector size=512

Because these numbers change the way that TestDisk looks for partitions
and calculates their sizes, it's important to have the correct disk geometry.
PC partitioning programs often make partitions end on cylinder boundaries.

A partition's CHS values are based on disk translations which make them
different than its physical geometry. The most common CHS head values
are: 255, 240 and sometimes 16.


Enter the number of heads (1-255): 8
After doing this, running Analyse shows:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - CHS 732566646 8 1
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 * HFS                  76806   0  1 366287871   7  1 2929688528
 2 P HFS                  366288266   0  1 366321033   7  1     262144
 3 P HFS                  366332217   0  1 732545449   7  1 2929705864
Quick Search then shows:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - CHS 732566646 8 1

The harddisk (3000 GB / 2794 GiB) seems too small! (< 3000 GB / 2794 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
   HFS                  11446   0  1 732577461   7  1 5860528128
   HFS                  11460   0  1 732577475   7  1 5860528128
   HFS                  11468   0  1 732577483   7  1 5860528128
   HFS                  11472   0  1 732577487   7  1 5860528128
   HFS                  11478   0  1 732577493   7  1 5860528128
   HFS                  11485   0  1 732577500   7  1 5860528128
   HFS                  11503   0  1 732577518   7  1 5860528128
   HFS                  11511   0  1 732577526   7  1 5860528128
   HFS                  11526   0  1 732577541   7  1 5860528128
   HFS                  11540   0  1 732577555   7  1 5860528128
   HFS                  11548   0  1 732577563   7  1 5860528128
   HFS                  11556   0  1 732577571   7  1 5860528128
   HFS                  11562   0  1 732577577   7  1 5860528128
   HFS                  11578   0  1 732577593   7  1 5860528128
   HFS                  11587   0  1 732577602   7  1 5860528128
   HFS                  11601   0  1 732577616   7  1 5860528128
   HFS                  11607   0  1 732577622   7  1 5860528128
   HFS                  11622   0  1 732577637   7  1 5860528128
   HFS                  11630   0  1 732577645   7  1 5860528128
   HFS                  11640   0  1 732577655   7  1 5860528128
   HFS                  11648   0  1 732577663   7  1 5860528128
   HFS                  11656   0  1 732577671   7  1 5860528128
   HFS                  11665   0  1 732577680   7  1 5860528128
   HFS                  11679   0  1 732577694   7  1 5860528128
   HFS                  11693   0  1 732577708   7  1 5860528128
   HFS                  11697   0  1 732577712   7  1 5860528128
   

[ Continue ]
HFS+ blocksize=8192, 3000 GB / 2794 GiB
Continue:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - CHS 732566646 8 1
     Partition               Start        End    Size in sectors
>* HFS                  76806   0  1 366287871   7  1 2929688528
 P HFS                  366288266   0  1 366321033   7  1     262144
 P HFS                  366332217   0  1 732545449   7  1 2929705864
Writing this partition information does not seem to change anything - Backups remains as a working partition and disk2s2/disk2s3 remain unmountable.

I should also note that after restarting and re-running TestDisk, the head number is reset to 1 again. I do not know if that is significant or intended behaviour of TestDisk.


Where I'm at now

As TestDisk was able to recover the "Backups" partition, I feel confident that the "Storage" partition is also recoverable. However, the steps which recovered Backups are not working in recovering Storage, and I'm not sure why.

I believe the 2 unreadable partitions are actually the Storage partition, and somehow are being misread as two separate partitions instead of one single partition. However, I know very little about hard drives beyond basic partitioning, so this is just a guess based on how TestDisk initially saw 4 partitions, and then after Backups was recovered 3 partitions remained, with the extra two being one very small partition and the other being the full 1.5TB.

I think that the key to fixing the remaining partition is in one of the two error messages I've received in this process:
  • Warning: Bad starting head (CHS and LBA don't match)
    Warning: the current number of heads per cylinder is 1 but the correct value may be 8.
But I do not know how to proceed. Can someone advise me on the next steps I should take?

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 4244
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering 2 HFS+ formatted partitions, unsure how to proceed after recovering 1st

#2 Post by cgrenier » 04 Jun 2018, 20:50

I don't think it will work but try try something...
Using TestDisk, Analyze, Quick Search, Stop, use 'a' to manually add
HFS 366288266 0 1 732545449 7 1
Set this partition as P(rimary). If there are overlapping partitions, set them as D(eleted).
On next screen, check that the Backups" partition is still here. choose Write, confirm, Quit and restart your computer.
Try to fix the second partition.

If it doesn't work, you can always use PhotoRec on this partition. You may have to force the blocksize to 512 bytes after enabling the expert mode in Options.
Use the default options otherwise.

rsfalkirk
Posts: 5
Joined: 03 Jun 2018, 12:46

Re: Recovering 2 HFS+ formatted partitions, unsure how to proceed after recovering 1st

#3 Post by rsfalkirk » 04 Jun 2018, 23:08

Hi cgrenier, thank you for your response.
cgrenier wrote:
04 Jun 2018, 20:50
I don't think it will work but try try something...
Using TestDisk, Analyze, Quick Search, Stop, use 'a' to manually add
HFS 366288266 0 1 732545449 7 1
I'm trying to do this, however I have two queries before I proceed.

Here is the menu I am seeing when I use 'a' to manually add:

Code: Select all

Disk /dev/rdisk3 - 3000 GB / 2794 GiB - 5860533168 sectors





  No partition                   1     614447     614447







>[Cylinder]  [  Head  ]  [ Sector ]  [Cylinder]  [  Head  ]  [ Sector ]
 [  Type  ]  [  Done  ]
 
First query is: I'm not 100% sure which numbers correspond to this menu - I am assuming that they are entered in the same order you have typed as they appear in the menu, e.g.:
  • Cylinder: 366288266 (starting cylinder)
  • Head: 0 (starting head)
  • Sector: 1 (starting sector)
  • Cylinder: 732545449 (ending cylinder)
  • Head: 7 (ending head)
  • Sector: 1 (ending sector)
Can I confirm that is the correct way to enter these numbers?

Second query is: I cannot find where in these options to set HFS. I assume this may be the [Type] option, but in this menu I see the following list to choose from:

Code: Select all

>List of partition type                                                         
 01 FAT12                50 OnTrack DM RO        a9 NetBSD
 02 XENIX root           51 OnTrack DM RW-NOVEL  ab Darwin boot
 03 XENIX /usr           52 CP/M-Microport V/386 af HFS
 04 FAT16 <32M           53 OnTrack DM WO ???    b7 BSDI
 06 FAT16 >32M           54 OnTrack DM DDO       b8 BSDI swap
 07 HPFS - NTFS          55 EZ-Drive             bc Acronis
 09 AIX data             56 GoldenBow VFeature   be Solaris boot
 0a OS/2 Boot Manager    61 SpeedStor            bf Solaris
 0b FAT32                63 Unixware, HURD, SCO  c1 secured FAT12
 0c FAT32 LBA            64 NetWare 286          c4 secured FAT16
 0e FAT16 LBA            65 NetWare 3.11+        c6 sec. Huge-bad FAT16
 10 OPUS                 67 Novell               c7 Syrinx Boot-bad NTFS
 11 hid. FAT12           68 Novell               d8 CP/M-86
 12 Compaq Diagnostics   69 Novell               db CP/M
 14 hid. FAT16 <32M      70 DiskSecure MB        de Dell Utility
 16 hid. FAT16 >32M      75 PC/IX                e1 SpeedStor FAT12 ext
 17 hid. HPFS/NTFS       80 Minix v1.1-1.4a      e3 DOS RO
 18 AST swap             81 Minix / old Linux    e4 SpeedStor FAT16 ext
 19 Willowtech Photon    82 Linux Swap           eb BeFS
 1b hid. FAT32           83 Linux                ee EFI GPT
 1c hid. FAT32 LBA       86 NT FAT16 V/S set     ef EFI (FAT-12/16/32)
 1e hid. FAT16 LBA       87 HPFS FT mirror-V/S set f0 Linux/PA-RISC boot
 20 Willowsoft OFS1      8e Linux LVM            f1 Storage Dimensions
 24 NEC MS-DOS 3.x       93 Amoeba               f2 DOS secondary
 27 Windows RE(store)    94 Amoeba bad block     f4 SpeedStor
 38 Theos                a0 NoteBIOS save2disk   fb VMFS
 3c PMagic recovery      a5 FreeBSD              fd Linux RAID
 40 VENIX 80286          a6 OpenBSD              fe LANstep
 41 PPC PReP Boot        a8 Darwin UFS           ff Xenix bad block
 42 W2K Dynamic/SFS                                                             
 
 >[Proceed ]
                           Go set the partition type
None of these options appear to be HFS, and I can't find a way to manually set HFS in this menu. Should I leave this option as "no partition" (the default) and proceed, or is there an option on this list I should select?

Thank you for your help so far.

rsfalkirk
Posts: 5
Joined: 03 Jun 2018, 12:46

Re: Recovering 2 HFS+ formatted partitions, unsure how to proceed after recovering 1st

#4 Post by rsfalkirk » 09 Jun 2018, 20:59

OK, I've done a bit more digging and figured out how to set the drive to HFS (didn't realise the [Type] menu was laid out in 3 columns and I needed to type the 'af' code found in the third column of the list!).

After doing a Quick Search, then using 'a' to manually add a partition, I've set the following as per my last post:
  • Cylinder: 366288266 (starting cylinder)
  • Head: 0 (starting head)
  • Sector: 1 (starting sector)
  • Cylinder: 732545449 (ending cylinder)
  • Head: 7 (ending head)
  • Sector: 1 (ending sector)
  • Type: af (HFS)
This gives me the following settings:

Code: Select all

  HFS                    366288266  732545456  366257191







 [Cylinder]  [  Head  ]  [ Sector ]  [Cylinder]  [  Head  ]  [ Sector ]
 [  Type  ] >[  Done  ]
Applying this, I now have the following:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
     Partition               Start        End    Size in sectors
 * HFS                       614448 2930302975 2929688528
>P HFS                    366288266  732545456  366257191
 D HFS                   2930306128 2930568271     262144
 D HFS                   2930657736 5860363599 2929705864








Structure: Bad. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type,
     Enter: to continue
187 GB / 174 GiB
I've set the manually added drive to P(rimary), but once I do this Testdisk reports "Structure: Bad" and will not write this information to the disk, regardless of if the overlapping partitions are set to D(eleted). This happens regardless of if I let Quick Search find all partitions or stop it early so that it only finds the first (*) partition.

The error seems to be when the first two partitions in the list are set to bootable - any other setting of the listed partitions is valid, even this one, which seems odd:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
     Partition               Start        End    Size in sectors
 D HFS                       614448 2930302975 2929688528
>P HFS                    366288266  732545456  366257191
 P HFS                   2930306128 2930568271     262144
 P HFS                   2930657736 5860363599 2929705864








Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type,
     Enter: to continue
187 GB / 174 GiB
I'm now unsure what to do. I have the following queries:
  • Why is having both partitions set to bootable causing a "Structure: Bad" error message?
  • It seems odd that the manually added drive is being reported as "187 GB / 174 GiB" in size - surely this should be "1500 GB / 1396 GiB" if it is meant to be the other half of the drive?
  • Have I input the settings correctly when manually adding the partition?
  • Is there any other settings within TestDisk I should try changing that may be causing this process to fail?

User avatar
cgrenier
Site Admin
Posts: 4244
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering 2 HFS+ formatted partitions, unsure how to proceed after recovering 1st

#5 Post by cgrenier » 10 Jun 2018, 16:44

Looks like you are using EFI GPT partition table now.
Manually add the partition HFS 2930306128 5860363599
and use the arrow keys to recover

Code: Select all

 P HFS                       614448 2930302975 2929688528
 D HFS                    366288266  732545456  366257191
 D HFS                   2930306128 2930568271     262144
 P HFS                   2930306128  5860363599 
 D HFS                   2930657736 5860363599 2929705864

rsfalkirk
Posts: 5
Joined: 03 Jun 2018, 12:46

Re: Recovering 2 HFS+ formatted partitions, unsure how to proceed after recovering 1st

#6 Post by rsfalkirk » 10 Jun 2018, 19:55

Analysing the drive in EFI GPT mode and then manually adding partition as suggested:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
     Partition               Start        End    Size in sectors
 P Mac HFS                   614448 2930302975 2929688528
 D Mac HFS               2930306128 2930568271     262144
>P Mac HFS               2930306128 5860363599 2930057472
 D Mac HFS               2930657736 5860363599 2929705864


Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type,
     Enter: to continue
1500 GB / 1397 GiB
After writing this and restarting, I now have two partitions: "Backups" and "disk2s2", both 1.5TB. Backups is mountable and the files on it remain accessible, while disk2s2 is unmountable. The drive is now formatted via "GUID Partition Map" according to Disk Utility when it was previously "Master Boot Record" (see screenshot in OP).

https://i.imgur.com/HvFg9oz.png

Running TestDisk again and analysing gives me:

Code: Select all

>P Mac HFS                   614448 2930302975 2929688528
 P Mac HFS               2930306128 2930568271     262144
 P Mac HFS               2930657736 5860363599 2929705864


Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type,
     Enter: to continue
HFS+ blocksize=4096 + Backup, 1500 GB / 1396 GiB
TestDisk seems adamant that there should be 3 partitions on this drive! It's very strange. Running this returns the drive to its previous state - Backups, disk2s2 and disk2s3, still formatted with "GUID Partition Map".

https://i.imgur.com/TsWQxtV.png

Just to check, I have run photorec on the small partition (disk2s2, size 262144 / 134.2MB) and it contains 21 files, mostly .plist and .exe files (which are files I would expect to be on this drive). I also have been running photorec today for a few hours on the larger drive (disk2s3), and the bulk of the files that were stored on this partition before this started seem to be present.

--

What can you suggest I try next? The drive is currently formatted as:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P Mac HFS                   614448 2930302975 2929688528
 2 P Mac HFS               2930306128 5860363599 2930057472

rsfalkirk
Posts: 5
Joined: 03 Jun 2018, 12:46

Re: Recovering 2 HFS+ formatted partitions, unsure how to proceed after recovering 1st

#7 Post by rsfalkirk » 17 Jun 2018, 21:19

Been doing some more experimenting, thought I would post an update in case it can help point to a solution.

edit to add: in addition to the below, running photorec on the partition did recover some files - I didn't recover the complete drive as at the time I didn't have a hard drive with enough space to fully recover the entire partition, and I've since recovered RAW files using other software (see below).

Starting with the manually added partition as in previous post:
rsfalkirk wrote:
10 Jun 2018, 19:55

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P Mac HFS                   614448 2930302975 2929688528
 2 P Mac HFS               2930306128 5860363599 2930057472
I've tried using EaseUS data recovery Mac tool to search the drive and recover files. To my surprise it was able to do so, and when analysing found the complete directory and file structure of the partition as I remember it from prior to the original fault. However when trying to recover these files, none of the files are readable - I only get error messages about corrupt files when trying to open anything recovered this way. EaseUS does also recover RAW files it finds on the partition, and these files are readable for me, but without the original directories/filenames they're of limited use.

So with this in mind I now have a limited backup of the contents of the drive, which is better than nothing, but I'm still hoping to retrieve the files in a more useful state with the directory structure and filenames intact. So back to Testdisk to do some more sleuthing.

I've ran Testdisk again to return the drive to the previous 3-partition state for the below testing, so the current config is as so:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P Mac HFS                   614448 2930302975 2929688528
 2 P Mac HFS               2930306128 2930568271     262144
 3 P Mac HFS               2930657736 5860363599 2929705864
First, here are the results of using Advanced > Superblock on each partition.

Backups:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
     Partition                  Start        End    Size in sectors
 1 P Mac HFS                   614448 2930302975 2929688528

Volume header
HFS+ OK

Backup volume header
HFS+ OK

Sectors are not identical.
disk2s2:

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
     Partition                  Start        End    Size in sectors
 2 P Mac HFS               2930306128 2930568271     262144

Volume header
HFS+ OK

Backup volume header
Bad

Sectors are not identical.

Code: Select all

Disk /dev/rdisk2 - 3000 GB / 2794 GiB - 5860533168 sectors
     Partition                  Start        End    Size in sectors
 3 P Mac HFS               2930657736 5860363599 2929705864

Volume header
HFS+ OK

Backup volume header
Bad

Sectors are not identical.
Immediately I think it's interesting that all three drives return the same "sectors are not identical" message, and also that Backups has an OK Backup volume header, but disk2s2 and disk2s3 both do not. Googling is not turning up anything helpful about HFS+ backup volume headers, but I do wonder if this is significant?

Second, I did a quick test and ran EaseUS on disk2s2 as it was a quick scan, and I was able to pull a few readable files out - not much, but maybe it's of some significance? (Doing the same thing on disk2s3 only returned unreadable files as before.)

Code: Select all

disk2s2
---Backups.backupdb
------RecoverySets
---------1
------------usr
---------------standalone
------------------i386
---------------------EfiLoginUI
------------------------appleLogo.efires
------------------------battery.efires
------------------------disk_passwordUI.efires
------------------------flag_picker.efires
------------------------guest_userUI.efires
------------------------loginui.efires
------------------------Lucida13.efires
------------------------Lucida13White.efires
------------------------recovery_user.efires
------------------------recoveryUI.efires
------------------------sound.efires
------------------------unknown_userUI.efires
---------------boot.efi
---------------EncryptedRoot.plist.wipekey
---------------com.apple.Boot.plist
---------------PlatformSupport.plist
---------------SystemVersion.plist
---------------kernelcache
---Spotlight-V100
------Store-V1
---------VolumeConfig.plist
------VolumeConfiguration.plist
---tmbootpicker.efi
Edit - a quick Google search suggests that tmbootpicker.efi is a file generated by Time Machine. I’m not sure, but looking at the directories recovered by EaseUS I’m wondering if I’d stored an old Time Machine backup on this drive and that’s somehow interfering with TestDisk? Perhaps that’s why TestDisk sees an extra partition?

Edit: I have managed to recover the data from the partition using R-Studio for Mac. I'm still unsure as to what caused the partition to not work, however I am grateful that Testdisk could recover the first partition. Definitely a tool to keep in mind for the future.

Post Reply

Who is online

Users browsing this forum: Google [Bot] and 1 guest