3

I have a TB external HDD divided in 2 partition:

First partition: 280 GB
Second partition: 1720 GB

Initially, both partitions were NTFS.

Then, I formatted the first partition to macOS Extended FS, and then to FAT32, and the second partition vanished. I can't see it in Disk Utilities nor in Paragon NTFS 15.

I tried to revert first partition to NTFS, but the second one is still not showing... What should I do?

here is the result of diskutil list

~ diskutil list
  /dev/disk0 (internal, physical):
     #:                       TYPE NAME                    SIZE       IDENTIFIER
     0:      GUID_partition_scheme                        *250.1 GB   disk0
     1:                        EFI EFI                     209.7 MB   disk0s1
     2:                 Apple_APFS Container disk1         249.8 GB   disk0s2

  /dev/disk1 (synthesized):
     #:                       TYPE NAME                    SIZE       IDENTIFIER
     0:      APFS Container Scheme -                      +249.8 GB   disk1
                                   Physical Store disk0s2
     1:                APFS Volume Macintosh HD            119.9 GB   disk1s1
     2:                APFS Volume Preboot                 20.5 MB    disk1s2
     3:                APFS Volume Recovery                503.9 MB   disk1s3
     4:                APFS Volume VM                      5.4 GB     disk1s4

  /dev/disk2 (external, physical):
     #:                       TYPE NAME                    SIZE       IDENTIFIER
     0:     FDisk_partition_scheme                        *2.0 TB     disk2
     1:               Windows_NTFS HDD1                    228.4 GB   disk2s1

Here is the result of sudo fdisk /dev/disk2

~ sudo fdisk /dev/disk2
    Disk: /dev/disk2    geometry: 243201/255/63 [3907029167 sectors]
    Signature: 0xAA55
             Starting       Ending
     #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
    ------------------------------------------------------------------------
    *1: 07 1023 254  63 - 1023 254  63 [    206848 -  446126158] HPFS/QNX/AUX
     2: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
     3: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
     4: 00    0   0   0 -    0   0   0 [         0 -          0] unused      

EDIT:

$ sudo dd if=/dev/disk2 bs=512 skip=446333006 count=150000000 | grep -o -a -b "BOOTMGR"

71010552671:BOOTMGR
71010552692:BOOTMGR
150000000+0 records in
150000000+0 records out
76800000000 bytes transferred in 11355.441546 secs (6763277 bytes/sec)
  • Post the output from the command diskutil list. – David Anderson Dec 22 '17 at 18:41
  • done! I can see it as FDisk_partition_scheme – Juliatzin del Toro Dec 22 '17 at 18:47
  • Well, you could also post the output from sudo fdisk /dev/disk2, but I doubt it will change my answer. Worth a try anyway. – David Anderson Dec 22 '17 at 19:01
  • done. Is it that bad ? – Juliatzin del Toro Dec 22 '17 at 19:05
  • Try running the command sudo dd if=/dev/disk2 bs=512 skip=446333006 count=50000000 | fgrep -o -a -b "BOOTMGR is compressed" – David Anderson Dec 22 '17 at 19:36
2

There is only one partition on your external drive. I suspect that instead of erasing the first partition, you erased the entire drive. But if this were true, then the new partition would span the entire drive. So at this point, it would be best to try and find the missing partition.

The correct function to find the header of a missing NTFS partitions is given below. To use this function, you will need to first copy this function and then paste as a command in a Terminal application window.

findntfs() { sudo bash -c "for i in {$1..$2};do xxd -a -s \$[\$i*1000000] -l 1000000 $3|fgrep -a -b 'NTFS    ';echo -en '\r'\$i:;done";echo done;}

Below is a example of its use. I have a 4 GB NTFS formatted flash drive. The output from sudo fdisk /dev/disk1 is given below.

Disk: /dev/disk1    geometry: 968/128/63 [7811072 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: 07    1   0   1 -  967  81  18 [      8064 -    7803008] HPFS/QNX/AUX
 2: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 3: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 4: 00    0   0   0 -    0   0   0 [         0 -          0] unused      

Since the flash drive contains 7811072 sectors and the sector size is 512 bytes, the drive size is exactly 3999268864 bytes, which is the product of the two numbers. If wanted to search the entire flash drive for a NTFS partition, I would need to search from 0 MB to 3999 MB of data. An example of using findntfs to do this is shown below.

Marlin:~ davidanderson$ findntfs 0 3999 /dev/disk1
Password:
3:70:003f0000: eb52 904e 5446 5320 2020 2000 0208 0000  .R.NTFS    .....
3998:1125334:ee5ffe00: eb52 904e 5446 5320 2020 2000 0208 0000  .R.NTFS    .....
3999:done
Marlin:~ davidanderson$ 

Note: While this function is executing, you will see values being updated. This is current megabyte being searched. From these values, you can determine the progress of the search.

The important information to extract from this output are the hexadecimal values 003f0000 and ee5ffe00. These values are the offset in bytes for the first and last sectors of the NTFS partition.

Below is the compute value of the byte location of the first sector based on the value shown from the output of fdisk.

8064 * 512 = 4128768 = 0x3F0000

Below is the compute value of the byte location of the last sector based on the value shown from the output of fdisk.

(8064 + 7803008 - 1) * 512 =  3999268352  = 0xEE5FFE00

Both of these values match the output from findntfs.

In your case, I would suggest looking for the beginning of your missing partition somewhere around 270 GB to 290 GB. For this, the command would be as shown below.

findntfs 270000 290000 /dev/disk2

Of course, this may take a while. If you feel lucky, you can try narrowing your search.

I would suggest looking for the ending of your missing partition somewhere around 1980398 GB to 2000398 GB. For this, the command would be as shown below.

findntfs 1980398 2000398 /dev/disk2

The function below looks into the found sector and prints out the number of sectors occupied by the candidate NTFS partition. The input is the offset of the partition in bytes and the drive name.

ntfssectors() {(n=$(sudo hexdump -e '1/8 "%u"' -s $((0x$1+40)) -n 8 $2); echo $(($n+1)))}

Below is an example where this function is used.

Note: The input is assumed to be hexadecimal.

Marlin:~ davidanderson$ ntfssectors2 003F0000 /dev/disk1
7803008
Marlin:~ davidanderson$ ntfssectors2 ee5ffe00 /dev/disk1
7803008
Marlin:~ davidanderson$ 

The output from both functions is the same as from fdisk.

  • OMG. I couldn't tell, modals are very close. Is there a way of recovering ? I have my whole life in this HDD :( – Juliatzin del Toro Dec 22 '17 at 19:17
  • Well, if you had erased the entire disk, then the new partition would be the size of the entire disk. This is not true in this case. So, now it is a matter of determining if the missing partition can be recovered. There is nothing in the partition tables that will tell us where the missing partition was. – David Anderson Dec 22 '17 at 19:20
  • result of second command: hexdump: 25600000000: bad length value – Juliatzin del Toro Dec 22 '17 at 20:59
  • I updated the command to fix my error. Try running the command again. – David Anderson Dec 22 '17 at 21:59
  • ➜ ~ sudo dd if=/dev/disk2 bs=512 skip=446333006 count=50000000 | fgrep -o -a -b "BOOTMGR is compressed" 50000000+0 records in 50000000+0 records out 25600000000 bytes transferred in 3583.679655 secs (7143496 bytes/sec) – Juliatzin del Toro Dec 22 '17 at 22:17
3

David's answer already explains what probably happened to your drive. You accidentally partitioned the drive instead of erasing just a volume.

According to your statement your drive contained two partitions previously:

  • First partition: 280 GB
  • Second partition: 1720 GB

After repartitioning the drive only one partition is left:

  • First and only partition: 228.4 GB

This probably means that the second partition wasn't affected - only the entry in the MBR was removed.

You should be able to recover the partition by simply adding a second partition in the MBR.

To detect the former boundaries of the lost partition you have to search for specific strings on the disk which determine the first and last block of a (former) NTFS volume.

The specific strings are either NTFS or BOOTMGR/bootmgr.

The content of the block depends on your locale, so searching for "BOOTMGR is compressed" (found in an English NTFS Partition Boot Sector) is not necessarily successful. "BOOTMGR" (English/German) or "bootmgr" (Spanish/French?) should work though. I haven't tested non-latin Windows systems.

Examples

First block of a German NTFS volume:

enter image description here

Last block of a German NTFS volume:

enter image description here

This can be done by dd'ing the device to grep.

Example:

$ sudo dd if=/dev/disk2 bs=512 skip=2048 count=512 | grep -o -a -b "BOOTMGR"    
421:BOOTMGR
512+0 records in
512+0 records out
262144 bytes transferred in 0.010566 secs (24810155 bytes/sec)

The explanation of the command:

Copy /dev/disk2 with a block size of 512 Byte to stdout, but skip the first 2048 blocks of disk2 and stop after (another) 512 blocks, pipe it to grep, treat the output as text, search for "BOOTMGR" and finally show the byte offset(s) of the matched pattern in front of the respective matched line.

In your case the result 71010552671:BOOTMGR of sudo dd if=/dev/disk2 bs=512 skip=446333006 count=150000000 | grep -o -a -b "BOOTMGR"means:

The byte offset is 71010552671 Byte after the last block (block 446333006) of the currently existing HDD1 volume on disk1. In blocks that's the relative block 138692486 or the absolute block (446333006 + 138692486) = 585025492.

This means two things:

  1. Your previous partition 1 probably had a size of ~ 299 GB (= ~278 GiB) instead of 280 GB
  2. Your partitions aren't aligned properly to 4k blocks because neither 446333006 nor 585025492 are divisible by 8

The last block of the vanished NTFS volume can be expected in the last 10,000 blocks of disk2. The appropriate command to search for it is then

sudo dd if=/dev/disk2 bs=512 skip=3907019167 count=10000 | grep -o -a -b "BOOTMGR"

With the result of the command you can determine the last block of the vanished partition 2.

With the first block and the last block you can add the lost partition with fdisk to the MBR.

To crosscheck the size you can extract the partition size in sectors in the partition boot sector at offset 0x028 and field length of 8 Bytes and the sector size at offset 0x0B and field length of 2 Bytes.

In the example screenshots above that's FF E7 DF E8 00 00 00 00 (= 3906988031+1) and 00 02 (= 512 Byte).

The diskutil info output for the example volume (visible in the screenshots) is:

...
Disk Size:                2.0 TB (2000377872384 Bytes) (exactly 3906988032 512-Byte-Units)
Device Block Size:        512 Bytes
...
  • 10000+0 records in 10000+0 records out 5120000 bytes transferred in 0.777240 secs (6587414 bytes/sec) – Juliatzin del Toro Dec 23 '17 at 16:07
  • You can post your answer here: apple.stackexchange.com/questions/309938/… – Juliatzin del Toro Dec 23 '17 at 16:10
  • I created a new thread a @David Anderson answered my first question, and this is another question, so both of you deserves to have accepted answer :) – Juliatzin del Toro Dec 23 '17 at 16:11
  • 1
    I does not matter to me which answer you except. Pick the one you think best answers your question. This is the best way to help others with the same question. – David Anderson Dec 23 '17 at 16:17
  • There is no requirement that the sector, you are searching for, contains boot code. Or, that the boot code be from Microsoft. Therefore, searching for the string BOOTMGR may cause one to miss this sector. The better string to search for is NTFS , since this string must occur. This is why I asked how the partition became NTFS formatted. Using the combination dd and grep commands will not find the string NTFS . You need to convert the binary to text, then search. This is what thexxd and fgrep commands do. Also, a for loop removes the limitation on the size of a search. – David Anderson Dec 23 '17 at 17:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .