Overwrote HFS partition with incorrect partition table
Posted: 19 Mar 2020, 01:25
I have a 2TB external hard drive with a 1TB ext4 partition, an EFI partition, and a 1 TB HFS partition (Mac OS extended, case sensitive, journaled). The ext4 partition was corrupted when the hard drive fell on floor and was disconnected from my laptop while files were being copied from it to another disk. The HFS partition was fine.
Using testdisk, I managed to get the most important data from that partition, but then my laptop died when testdisk was recovering the rest of the data, and testdisk will no longer list the files on that corrupted partition. The remaining data is not as important, and is mostly backups of my Linux systems.
I decided to keep trying to recover the data, and I made a stupid noob decision. In testdisk, all of my partitions were showing up correctly, but it warned that the HFS partition was not recoverable. No big deal because the HFS partition was perfectly fine. But I chose to write the partition structure to the disk, and the HFS partition is deleted now. It shows up under testdisk as deleted and testdisk says the HFS partition is not recoverable and that it is an unsupported file type.
The files on the HFS partition are much more important than those on the ext4 partition. Is there anything I can do to reverse the partition structure and recover the files?
I appreciate any help, thank you.
This is what the current partition structure looks like through testdisk:
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
Partition Start End Size in sectors
P EFI System 40 409639 409600 [EFI]
D Mac HFS 409640 1953263023 1952853384
>D Mac HFS 409640 1953891367 1953481728
P MS Data 1954154496 3906961407 1952806912 [LINUX]
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type,
Enter: to continue
HFS+ found using backup sector!, 1000 GB / 931 GiB
Using testdisk, I managed to get the most important data from that partition, but then my laptop died when testdisk was recovering the rest of the data, and testdisk will no longer list the files on that corrupted partition. The remaining data is not as important, and is mostly backups of my Linux systems.
I decided to keep trying to recover the data, and I made a stupid noob decision. In testdisk, all of my partitions were showing up correctly, but it warned that the HFS partition was not recoverable. No big deal because the HFS partition was perfectly fine. But I chose to write the partition structure to the disk, and the HFS partition is deleted now. It shows up under testdisk as deleted and testdisk says the HFS partition is not recoverable and that it is an unsupported file type.
The files on the HFS partition are much more important than those on the ext4 partition. Is there anything I can do to reverse the partition structure and recover the files?
I appreciate any help, thank you.
This is what the current partition structure looks like through testdisk:
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
Partition Start End Size in sectors
P EFI System 40 409639 409600 [EFI]
D Mac HFS 409640 1953263023 1952853384
>D Mac HFS 409640 1953891367 1953481728
P MS Data 1954154496 3906961407 1952806912 [LINUX]
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type,
Enter: to continue
HFS+ found using backup sector!, 1000 GB / 931 GiB