Can't see external HDD partition in Disk Utility

Question

I have a TB external HDD divided in 2 partition:

First partition: 280 GB
Second partition: 1720 GB

Initially, both partitions were NTFS.

Then, I formatted the first partition to macOS Extended FS, and then to FAT32, and the second partition vanished. I can't see it in Disk Utilities nor in Paragon NTFS 15.

I tried to revert first partition to NTFS, but the second one is still not showing... What should I do?

here is the result of diskutil list

~ diskutil list
  /dev/disk0 (internal, physical):
     #:                       TYPE NAME                    SIZE       IDENTIFIER
     0:      GUID_partition_scheme                        *250.1 GB   disk0
     1:                        EFI EFI                     209.7 MB   disk0s1
     2:                 Apple_APFS Container disk1         249.8 GB   disk0s2

  /dev/disk1 (synthesized):
     #:                       TYPE NAME                    SIZE       IDENTIFIER
     0:      APFS Container Scheme -                      +249.8 GB   disk1
                                   Physical Store disk0s2
     1:                APFS Volume Macintosh HD            119.9 GB   disk1s1
     2:                APFS Volume Preboot                 20.5 MB    disk1s2
     3:                APFS Volume Recovery                503.9 MB   disk1s3
     4:                APFS Volume VM                      5.4 GB     disk1s4

  /dev/disk2 (external, physical):
     #:                       TYPE NAME                    SIZE       IDENTIFIER
     0:     FDisk_partition_scheme                        *2.0 TB     disk2
     1:               Windows_NTFS HDD1                    228.4 GB   disk2s1

Here is the result of sudo fdisk /dev/disk2

~ sudo fdisk /dev/disk2
    Disk: /dev/disk2    geometry: 243201/255/63 [3907029167 sectors]
    Signature: 0xAA55
             Starting       Ending
     #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
    ------------------------------------------------------------------------
    *1: 07 1023 254  63 - 1023 254  63 [    206848 -  446126158] HPFS/QNX/AUX
     2: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
     3: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
     4: 00    0   0   0 -    0   0   0 [         0 -          0] unused      

EDIT:

$ sudo dd if=/dev/disk2 bs=512 skip=446333006 count=150000000 | grep -o -a -b "BOOTMGR"

71010552671:BOOTMGR
71010552692:BOOTMGR
150000000+0 records in
150000000+0 records out
76800000000 bytes transferred in 11355.441546 secs (6763277 bytes/sec)

Answer 1

There is only one partition on your external drive. I suspect that instead of erasing the first partition, you erased the entire drive. But if this were true, then the new partition would span the entire drive. So at this point, it would be best to try and find the missing partition.

The correct function to find the header of a missing NTFS partitions is given below. To use this function, you will need to first copy this function and then paste as a command in a Terminal application window.

findntfs() { sudo bash -c "for i in {$1..$2};do xxd -a -s \$[\$i*1000000] -l 1000000 $3|fgrep -a -b 'NTFS    ';echo -en '\r'\$i:;done";echo done;}

Below is a example of its use. I have a 4 GB NTFS formatted flash drive. The output from sudo fdisk /dev/disk1 is given below.

Disk: /dev/disk1    geometry: 968/128/63 [7811072 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: 07    1   0   1 -  967  81  18 [      8064 -    7803008] HPFS/QNX/AUX
 2: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 3: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 4: 00    0   0   0 -    0   0   0 [         0 -          0] unused      

Since the flash drive contains 7811072 sectors and the sector size is 512 bytes, the drive size is exactly 3999268864 bytes, which is the product of the two numbers. If wanted to search the entire flash drive for a NTFS partition, I would need to search from 0 MB to 3999 MB of data. An example of using findntfs to do this is shown below.

Marlin:~ davidanderson$ findntfs 0 3999 /dev/disk1
Password:
3:70:003f0000: eb52 904e 5446 5320 2020 2000 0208 0000  .R.NTFS    .....
3998:1125334:ee5ffe00: eb52 904e 5446 5320 2020 2000 0208 0000  .R.NTFS    .....
3999:done
Marlin:~ davidanderson$ 

Note: While this function is executing, you will see values being updated. This is current megabyte being searched. From these values, you can determine the progress of the search.

The important information to extract from this output are the hexadecimal values 003f0000 and ee5ffe00. These values are the offset in bytes for the first and last sectors of the NTFS partition.

Below is the compute value of the byte location of the first sector based on the value shown from the output of fdisk.

8064 * 512 = 4128768 = 0x3F0000

Below is the compute value of the byte location of the last sector based on the value shown from the output of fdisk.

(8064 + 7803008 - 1) * 512 =  3999268352  = 0xEE5FFE00

Both of these values match the output from findntfs.

In your case, I would suggest looking for the beginning of your missing partition somewhere around 270 GB to 290 GB. For this, the command would be as shown below.

findntfs 270000 290000 /dev/disk2

Of course, this may take a while. If you feel lucky, you can try narrowing your search.

I would suggest looking for the ending of your missing partition somewhere around 1980398 GB to 2000398 GB. For this, the command would be as shown below.

findntfs 1980398 2000398 /dev/disk2

The function below looks into the found sector and prints out the number of sectors occupied by the candidate NTFS partition. The input is the offset of the partition in bytes and the drive name.

ntfssectors() {(n=$(sudo hexdump -e '1/8 "%u"' -s $((0x$1+40)) -n 8 $2); echo $(($n+1)))}

Below is an example where this function is used.

Note: The input is assumed to be hexadecimal.

Marlin:~ davidanderson$ ntfssectors2 003F0000 /dev/disk1
7803008
Marlin:~ davidanderson$ ntfssectors2 ee5ffe00 /dev/disk1
7803008
Marlin:~ davidanderson$ 

The output from both functions is the same as from fdisk.

Answer 2

David's answer already explains what probably happened to your drive. You accidentally partitioned the drive instead of erasing just a volume.

According to your statement your drive contained two partitions previously:

• First partition: 280 GB
• Second partition: 1720 GB

After repartitioning the drive only one partition is left:

• First and only partition: 228.4 GB

This probably means that the second partition wasn't affected - only the entry in the MBR was removed.

You should be able to recover the partition by simply adding a second partition in the MBR.

To detect the former boundaries of the lost partition you have to search for specific strings on the disk which determine the first and last block of a (former) NTFS volume.

The specific strings are either NTFS or BOOTMGR/bootmgr.

The content of the block depends on your locale, so searching for "BOOTMGR is compressed" (found in an English NTFS Partition Boot Sector) is not necessarily successful. "BOOTMGR" (English/German) or "bootmgr" (Spanish/French?) should work though. I haven't tested non-latin Windows systems.

Examples

First block of a German NTFS volume:

Last block of a German NTFS volume:

This can be done by dd'ing the device to grep.

Example:

$ sudo dd if=/dev/disk2 bs=512 skip=2048 count=512 | grep -o -a -b "BOOTMGR"    
421:BOOTMGR
512+0 records in
512+0 records out
262144 bytes transferred in 0.010566 secs (24810155 bytes/sec)

The explanation of the command:

Copy /dev/disk2 with a block size of 512 Byte to stdout, but skip the first 2048 blocks of disk2 and stop after (another) 512 blocks, pipe it to grep, treat the output as text, search for "BOOTMGR" and finally show the byte offset(s) of the matched pattern in front of the respective matched line.

In your case the result 71010552671:BOOTMGR of sudo dd if=/dev/disk2 bs=512 skip=446333006 count=150000000 | grep -o -a -b "BOOTMGR"means:

The byte offset is 71010552671 Byte after the last block (block 446333006) of the currently existing HDD1 volume on disk1. In blocks that's the relative block 138692486 or the absolute block (446333006 + 138692486) = 585025492.

This means two things:

1. Your previous partition 1 probably had a size of ~ 299 GB (= ~278 GiB) instead of 280 GB
2. Your partitions aren't aligned properly to 4k blocks because neither 446333006 nor 585025492 are divisible by 8

---

The last block of the vanished NTFS volume can be expected in the last 10,000 blocks of disk2. The appropriate command to search for it is then

sudo dd if=/dev/disk2 bs=512 skip=3907019167 count=10000 | grep -o -a -b "BOOTMGR"

With the result of the command you can determine the last block of the vanished partition 2.

With the first block and the last block you can add the lost partition with fdisk to the MBR.

To crosscheck the size you can extract the partition size in sectors in the partition boot sector at offset 0x028 and field length of 8 Bytes and the sector size at offset 0x0B and field length of 2 Bytes.

In the example screenshots above that's FF E7 DF E8 00 00 00 00 (= 3906988031+1) and 00 02 (= 512 Byte).

The diskutil info output for the example volume (visible in the screenshots) is:

...
Disk Size:                2.0 TB (2000377872384 Bytes) (exactly 3906988032 512-Byte-Units)
Device Block Size:        512 Bytes
...