4

I have a 2 TB external HDD that was divided in 2 partition:

First partition: 280 GB
Second partition: 1720 GB

I accidentally delete the second partition.

Here are several steps that I already did;

result of diskutil list

~ diskutil list
  /dev/disk0 (internal, physical):
     #:                       TYPE NAME                    SIZE       IDENTIFIER
     0:      GUID_partition_scheme                        *250.1 GB   disk0
     1:                        EFI EFI                     209.7 MB   disk0s1
     2:                 Apple_APFS Container disk1         249.8 GB   disk0s2

  /dev/disk1 (synthesized):
     #:                       TYPE NAME                    SIZE       IDENTIFIER
     0:      APFS Container Scheme -                      +249.8 GB   disk1
                                   Physical Store disk0s2
     1:                APFS Volume Macintosh HD            119.9 GB   disk1s1
     2:                APFS Volume Preboot                 20.5 MB    disk1s2
     3:                APFS Volume Recovery                503.9 MB   disk1s3
     4:                APFS Volume VM                      5.4 GB     disk1s4

  /dev/disk2 (external, physical):
     #:                       TYPE NAME                    SIZE       IDENTIFIER
     0:     FDisk_partition_scheme                        *2.0 TB     disk2
     1:               Windows_NTFS HDD1                    228.4 GB   disk2s1

Here is the result of sudo fdisk /dev/disk2

~ sudo fdisk /dev/disk2
    Disk: /dev/disk2    geometry: 243201/255/63 [3907029167 sectors]
    Signature: 0xAA55
             Starting       Ending
     #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
    ------------------------------------------------------------------------
    *1: 07 1023 254  63 - 1023 254  63 [    206848 -  446126158] HPFS/QNX/AUX
     2: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
     3: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
     4: 00    0   0   0 -    0   0   0 [         0 -          0] unused      

EDIT:

$ sudo dd if=/dev/disk2 bs=512 skip=446333006 count=150000000 | grep -o -a -b "BOOTMGR"

71010552671:BOOTMGR
71010552692:BOOTMGR
150000000+0 records in
150000000+0 records out
76800000000 bytes transferred in 11355.441546 secs (6763277 bytes/sec)
3
+50

The NTFS volume has been recovered in a TeamViewer session. The method is slightly related to my answer here: Can't see external HDD partition in Disk Utility

Preface:

The NTFS volume was formatted attached to a Mexican-Spanish (or French?) Windows system.

The specific string "BOOTMGR" to find the NTFS Partition Boot Sector with grep wasn't successful because on these systems - as it later transpired - the proper string is "bootmgr" instead.

Assumptions:

The vanished partition and its important blocks weren't overwritten. The partition is situated near the "end" of the disk.


So the following method was used:

  • Enable and log-in as root and install wxHexEditor
  • get the device identifier with diskutil list. Below I assume it's disk2.
  • Open the device disk2 in wxHexEditor, jump to the very end of the disk and backward-search for the string "NTFS" which revealed the (2nd) Partition Boot Sector of the NTFS volume.
  • With its byte offset the block number of the last NTFS volume block can be determined (byte offset/512 + 1 = block number)
  • The (2nd) Partition Boot Sector contains the size of the whole NTFS volume in sectors at offset 0x028 and a field length of 8 Bytes and the sector size at offset 0x0B and a field length of 2 Bytes.
    • Sector size: 00 02 (= 512 Byte)
    • volume size in sectors was (after a 64bit to decimal conversion) 2047997951+1 blocks (one has to add 1 to the number of blocks because block count starts at 0!)
  • In Terminal the partition was added with fdisk:

    fdisk -e /dev/disk2
    edit 2 #add second partition
    Partition id ('0' to disable)  [0 - FF]: [0] (? for help) 7 #HPFS/QNX/AUX
    Do you wish to edit in CHS mode? [n] n
    Partition offset [0 - 3907029167]: [446333006] 1859028992
    Partition size [1 - 2048000175]: [2048000175] 2047997952
    write
    exit
    
  • the volume was mounted automatically.
  • The NTFS volume was checked with Paragon NTFS for Mac with a "no errors" result.

The initial details of at least one of the two deleted partitions posted by the OP were wrong:

  • First partition: 280 GB
  • Second partition: 1720 GB

The second partition had and has a size of 1.049 TB only!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .