1

I’m in a state of emergency right now…

So Saturday night, I brought an external HD over to my friends place to transfer some photos instead of tying up my internet and uploading 21GB worth of pictures.

Anyway, I normally run on a MAC OSX system, so I believe that my HD was Mac OS Journaled.

When I plugged it into my friends Windows 10 laptop, it wouldn’t recognize the drive, so we thought maybe it was a driver issue of some sort or something. We installed drivers onto his machine, and it didn’t change.

Went into Disk Management and a pop up appeared and just OK’d it. I couldn’t tell you what the pop-up said, but I am positive it didn’t mention formatting it.

Now, we went in and saw the drive was connected, but it showed Unallocated. 4TB of space.

Confused, so we decided to disconnect it. Then, I try to plug it into my Mac and it is unreadable!!

Now I got some recovery software, Stellar Phoenix, and ran the find Lost Partitions option. And it found my partition HFS, and it also found an NTFS partition which was 134mb.

I stopped the scan early, and went to look at the HFS partition, and there I found all of my files that I needed. File sizes seemed correct and all the folders were there.

But, as I am saving these files onto a new HD, I noticed that some of them don’t open, and some do.

Could this be a result of stopping the scan early? I figured that only 2 ‘blocks’ would show up on the disk to represent the partitions.

Is there any way to fix these corrupted files? Maybe I should run the partition scan again and see if it’ll pull any more file information from other sectors of the HD?

It’s just odd to me that the files are correctly named & the sizes are correct. It’s just same open and some don’t

1 Spice up
2

Welcome to spiceworks!

First of all, are you an IT Professional?

1 Spice up
3

Thank you.

Yes I work as a computer operator at a Credit Union.

This issue I am having is for an external HD I have at home.

4

Don’t assume that the files are corrupted. Use another recovery software to pull off the files. Obviously, pull off one that is good from your first recovery and then the others that aren’t good. This way you know that you will be pulling off good files. There should be no reason that your data is truly corrupted at all. Worst case scenario, take the drive back to a Mac and use a Mac Recovery software to pull off the data.

We can do these types of recoveries, but I don’t think you will need to in this type of scenario.

1 Spice up
5

Thanks for the quick reply.

Currently, I am transferring three large folders that have most of my important video files & final cut projects. As they’re saving, I am noticing that some are saving, and some aren’t.

Now, as much as I want to just cancel this operation, I think I will let it keep going so I have these three folders saved at least.

Now, would it be wise to create a full image of the volume or drive? That way if for some reason, another issue occurs, I can restore all the data back on this external and start again?

I came across a piece of software called Test Disk to re-create the partition table. Is that something I could try?

As much as I want to think that my files are corrupt, at the same time I don’t think they are because all the files show up and the correct file sizes appear. But who knows, I have never been in this position so I am just going off of what I see.

Any type of help is appreciated!

And honestly, paying for a service would be something I would consider if all else fails. I don’t want to lose all this footage.

If anything, I will have no problem losing project files, but as long as I can keep the original media, I’ll be able to re-create the projects.

6

Oh! And also, I saw you mentioned to take the drive to a Mac.

Well, I originally used a Mac for the HD, then tried to get it working on a Windows 10 machine, failed. Then when I brought it back to my MacBook, it was unreadable.

Now I brought my HD back to my home computer which is a MacPro.

So long story short, I am back to where it originally was. I just want to get the volume to be able to mount. Or if that is not possible, at least take these files off and get them working on my new HD I just bought.

7

First off, making an image of the disk where you have no backup is the right thing to do. Also, testdisk might be able to help you in this case since it seems that the partition was blown away when you took it to the PC and testdisk is perfect for that operation.

If you find that it’s not something where you want to learn with valuable data on it, then call DriveSavers 24/7 at 800-440-1904. Be sure to give them code DS98006 for a SpiceWorks discount. There is no charge for an evaluation or shipping the drive to us.

From what you wrote, there is a good chance for getting a GREAT recovery.

8

Thank you. I will create an image of the disk and place it on my new HD to keep it safe. Does it matter if I have some files already on the new HD? My ‘bad’ drive is currently transferring the rest of these files I had started recovering from last night.

Or, will it be better to just remove these recovered files, and just create an image and just place that on the new HD with nothing else on it?

Second question… when I run TestDisk, am I doing it to the ‘bad’ drive? or am I going to be using the image? I would assume that the image is just used incase the ‘bad’ drive decides to get worse or if I accidentally do something that I shouldn’t.

By the way, the TestDisk walk through that I found is this, can you provide some insight if this is a correct way to go about this? →

https://perrohunter.com/repair-a-mac-os-x-hfs-partition-table/

9

Update on my situation…

I am still transferring recoverable files via Stellar Phoenix Mac Data Recovery. Although it shows all of my files can be recoverable, not all of them open.

Interesting though… I also have Disk Drill 3, and I can see all of my files listed, and some open and some don’t. Now, what’s interesting is, some of the files that DO open, don’t open from the ones that are getting recovered from Stellar. And the ones that don’t open, have been transferred over to my new HD already.

Could there be a reason why two different pieces of software produce different results?

10

To do “data recovery” from a disk properly you always want more disks to work with when you are going to be “changing” anything on the source disk to try and get it to function. If you have backups, then being so cautious isn’t as needed as you can get back to square one with the backup. In this case you are trying to create a valid backup, in a sense.

Disk1: “Source” - the disk you want recovered.

Disk2: “Image disk” - the disk you will image to either as a straight up image from sector zero or as a formatted disk where you will create an image file of your source disk, (a .dd or .img or .dmg, etc.). This allows you to put multiple images of source disks onto one disk to maximize space.

Disk3: “Target Disk” - the disk that will hold the recovered files. In your example you are pulling files out using Stellar and copying them to a different disk than the source.

You, “Could there be a reason why two different pieces of software produce different results?” - YUP!!! That is the fun of recovery and each failure can be attacked in a different manner. Fun.

For Macintosh, I find that the cleanest way to recover files is traditionally to fix the volume. Yes, using TestDisk as described should give you the proper volume back. Then it might actually mount, as described. You can run DiskDrill again or Stellar to see if the bad files are now good. Otherwise, you can then run Disk First Aid or DiskWarrior. If the volume wasn’t too corrupted, you should have access to all of your files. There are a lot of options here, but these traditionally work.

11

Unfortunately when I tried creating an image, I don’t have enough space. Well, I guess I could transfer the final cut libraries that I recovered onto another drive and just clear my new drive out to place the image on? Since it’s a 4TB drive (about 2.5TB was on it at the time of error), I was under the impression that only the files in the drive would go in not the entire drive size.

Anyway, I am looking into running Testdisk but I keep getting a Bad GPT Partition error, I’ll post a screenshot later. Not sure why, and I am sure it’s the exact HFS partition that went bad because I ejected all of my other externals to make sure it’s not interfering and I’m not selecting the wrong one.

As far as DiskWarrior, I can’t seem to get it to run on that external because it’s showing as a Windows/PC format. In Disk Utility, it’s showing as a Microsoft Reserved Partition. That’s probably what got created when I connected it to the laptop.

12

Yes, getting the right size “image drive” is critical to image to. Having extra drives is key for this type of operation so you don’t compound the problem by “shortcutting” and making the problem worse. Yes, the front end of the disk was corrupted due to Windows error. The GPT might need to be blown away and then create the proper partition.

Having fun?

13

Lol…

I wish it was fun :(. But yea, I do see what you mean as the “front end” of the disk was corrupted. Kind of makes sense now because I remember when Stellar Phoenix scanned for “lost partitions”, it scanned my HFS+ partition at the very beginning, then about 6-10 blocks later on the same line, it found an NTFS partition, which I guess would be the Microsoft Reserved.

Not sure if you can answer this one, but I’m following the walkthrough on repairing the HFS+ partition by using TestDisk & pdisk… well, I seem to be getting a “map is not big enough” error in pdisk when I enter the /dev/disk and it gives me information. From the guidelines, it mentions to change the GEOMETRY before the analyze step in TestDisk. And by changing the block size, this would resolve the issue.

Now, my drive is a 4TB drive, and it was all one partition, so I would think the volume size is 4TB. But what would be the block size? According to this small chart that was provided, here’s their information.

Volume size: <=256 MB | Block Size: 512

Volume size: 256MB <= 512MB | Block Size: 1024

Volume size: 512MB - 1GB | Block Size: 4096

When I look in TestDisk, it gives me various options, and I think the highest is 8092. I did try setting it to that but I got the same error. Any ideas?

14

A better way to do this with testdisk:

command: sudo ~path/testdisk

  • It asks to create a log - go ahead and create it.

  • Select your drive

  • Select EFI/GPT

  • Select Analyse

  • quicksearch

  • It should find your HFS+ 4 TB volume at sector 409640, 262210 or possibly 614448

  • Select the one that looks like your entire volume and hit enter.

  • click “enter” which will write the changes.

  • You might need to reboot, but just quit testdisk and then unplug the drive and then reinsert.

15

Hmm interesting. So I won’t need pdisk? I think the first time I did run it, it listed out the start of the drive at 262272. But I’m not positive, I’ll have to give it another run in a few hours and try it again.

I’ll grab some screenshots too.

16

Alright…

So I’ve tried the entire week to get stuff that seems to be corrupted. But, I think I might have to give in and send the external HD off for a professional to take a look and see if the files can be recovered…