2

I have an external 2 TB Harddisk that had a 1.5 TB exFAT Partition and a 500GB HFS+ encrypted Partition. I wanted to shrink the 1.5 TB to 1 TB. I used https://www.diskgenius.com/ to shrink the exFAT Partition which worked, I ended up with a 1 TB Partition visible in Windows.

But after attaching the external harddisk to Mac now the 500 GB encrypted Partition is not recognized anymore. Mac's disk utility still shows disk2s2 with 512 GB but is not able to mount it.

My guess is that this disk was GPT before but got overwritten with a MBR by disk genius and that there is now data missing for MacOS to recognize the disk. Is that possible?

  1. Is there any hope of recovering my data? Does HFS store some information needed for encryption in the GPT that might have been overwritten now?
  2. Can I somehow force MacOS to mount disk2s2 as an encrypted HFS+ volume?
  3. Does the GPT automatically get overwritten by MBR or is it possible that the MBR somehow just takes priority over the GPT and if the MBR gets deleted the GPT takes over again? Sorry if this is a dumb idea, I don't know much how these partitioning tables are stored on disk.

Any help appreciated.

enter image description here

enter image description here

enter image description here

  • 1
    I thinks this call for professional help. drivesavers.com Should you want to continue trying. Get an external drive. use dd command to make a copy of the drive. work with the copy. example be careful. detach all irrelevant disks: dd if=/dev/disk0 bs=4096m | dd of=/dev/disk1 bs=4096m – historystamp Dec 23 '18 at 0:35
  • may be helpful: apple.stackexchange.com/questions/316464/… – historystamp Dec 23 '18 at 0:38
2

I managed to get my data back.

After copying the harddisk to another one with dd to not cause any more damage I started to try to get it to work again. The solution turned out to be:

  1. change mbr back to gpt (used disk genius for that again, had to delete the first 200mb partition to be able to do that)
  2. change the guid type of disk2s2 to corestorage using diskutil (set id=53746F72-6167-11AA-AA11-00306543ECAC)
  3. boot again in macos and the volume was back

It took a lot longer because I expected that disk2s2 was a HFS+ encrypted volume but viewing it in a hex editor I didn't find the markers for that, so I thought my data somehow has been overwritten or that the partitions were not aligned properly anymore. Only after recreating my previous setup I found out that there was a CoreStorage layer in between and then it was an easy fix.

Still not entirely sure what went wrong in the first place, because I tried to recreate my scenario on another harddisk and it worked there. My guess is my old harddisk had an mbr and gpt (hybrid) and thats what confused disk genius, but I don't know for sure.

  • 1
    Thank you +1, someone will be happy to find your answer to the problem – Ruskes Dec 24 '18 at 23:27
  • Wow!! Now that’s an impressive repair! Glad you managed to recover the disk. I’ve been struggling with a kinda similar issue for over a year on my iPad pro, had to jailbreak to have any chance of repairing a weird false disk full error with 30+GB free. I can get to a root shell and even unmount the Data partition, but when I try to fsck_hfs -fdyr to Rebuild BTree, it always says it needs X many blocks but only like 5% of that is free (continuously). How long did your dd command take? And where did you send it to? How do you set the receiving machine to accept? – Syclone0044 Jul 14 at 20:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .