cgsecurity.org

Posted: **01 Mar 2020, 01:47**

I have an iMac with a Fusion Drive that has failed. The SSD burnt out, as far as the iMac is concerned, the SSD doesn't exist anymore. But, before I take it in for service or replacement, I would like to rescue as much data from the HD portion of the Fusion Drive.

I used DDRescue-GUI to image the entire 2 TB HD (disk0) to a 5 TB USB external drive.

Using diskutil list , this is what is on disk3, the clone of disk0:

Code: Select all

icemo:~ icemo$ diskutil list
/dev/disk3 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *5.0 TB     disk3
   1:                        EFI EFI                     209.7 MB   disk3s1
   2:                 Apple_APFS                         2.0 TB     disk3s2

I began analysis of the image with TestDisk and was presented with this message as it started:

Code: Select all

check_FAT: Unusual media descriptor (0xf0!=0xf8)
Warning: number of heads/cylinder mismatches 16 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD)

Is this going to be a problem down the line? Since analysing the drive is going to take several days, I'd rather know now if it's going to work or if I need to start over and try something different. I understand the EFI slice is FAT32 and the data slice is APFS, is that the source of this error? If so, then am I able to use TestDisk at all to salvage my data off of this drive?

Thanks for your time and efforts on this matter.

Posted: **01 Mar 2020, 09:31**

Try fsck on the clone to check and repair the filesystem.
If it doesn't work, you can always try photorec but it will not recover the original filenames and will only work if the filesystem wasn't encrypted.

Posted: **01 Mar 2020, 21:22**

Thanks again for your reply. In the time since I've posted, the analysis has finished. Much faster that I would have thought.

So, this is the result:

Code: Select all

Disk /dev/rdisk3 - 5000 GB / 4657 GiB - 9767475200 sectors
     Partition               Start        End    Size in sectors
>P EFI System                    40     409639     409600 [EFI System Partition] [EFI]
 P Mac HFS                 92361409   92381888      20480
 P Mac HFS                107007273 1486880687 1379873415 [Dd?2~ET?^B]
 P Mac HFS               2176001102 2176021581      20480
 P Mac HFS               2222257268 2297758582   75501315
 P Mac HFS               2324214693 2525741483  201526791
 P Mac HFS               2530119675 2538509313    8389639 [^A^O~D^T^A]
 P Mac HFS               3141306504 3518793863  377487360
 P Mac HFS               3518793864 3906766983  387973120
 P Mac HFS               3940321844 4328294963  387973120
 P Mac HFS               4883558904 9767287639 4883728736


Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
FAT32, blocksize=512, 209 MB / 200 MiB

All partitions listed are shown in green.

Since the last bottom in that window has different information depending on which partition is highlighted, here are the various other bottom lines:

Code: Select all

HFS+ blocksize=4096, 10 MB / 10 MiB
HFS blocksize=33554432, 706 GB / 657 GiB
HFS+ blocksize=4096, 10 MB / 10 MiB
HFS blocksize=16777216, 38 GB / 36 GiB
HFS blocksize=16777216, 103 GB / 96 GiB
HFS blocksize=65536, 4295 MB / 4096 MiB
HFS+ blocksize=4096 + Backup, 193 GB / 180 GiB
HFS+ blocksize=4096 + Backup, 198 GB / 185 GiB
HFS+ blocksize=4096, 198 GB / 185 GiB
HFS+ blocksize=8192, 2500 GB / 2328 GiB

I should note that for every partition, it states "Structure: Ok."

Only the EFI partition has the option to list files (because it's FAT32?), all of the others say, "Support for this filesystem hasn't been implemented."

I don't really know how to interpret these results. I've read the documentation (TestDisk.pdf) but most it deals with Windows and Linux.

What do these results mean? What is my next move? Will the "load backup" option be of any use? Any help on this matter is greatly appreciated.

Thanks again for your time and efforts in this matter.

cgsecurity.org

Warnings when running analysis with TestDisk

Warnings when running analysis with TestDisk

Re: Warnings when running analysis with TestDisk

Re: Warnings when running analysis with TestDisk