1

I have 2TB Toshiba 3.0 HDD. (1863 GiB). I have rewritten accidentally the GPT partition table and I need to recover it.


Old partition table. I need to recover it

It had FOUR partitions. GPT table with

1) EFI 200 MB

2) HFS+ 1844 GB (with data) ☜ I need to recover this one

3) HFS+ 10 GB (not important)

4) HFS+ 10 GB (not important)


New partition table (accidentally written)

P EFI System 40 409639 409600 [EFI System Partition] [EFI]
P Mac HFS 409640 3906766983 3906357344 (1862.70GiB)

gpt output

iMac-Wrona:~ Wrona$ sudo gpt -r show disk1
       start        size  index  contents
           0           1         PMBR
           1           1         Pri GPT header
           2          32         Pri GPT table
          34           6         
          40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      409640  3906357344      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  3906766984      262147         
  3907029131          32         Sec GPT table
  3907029163           1         Sec GPT header

I used Testdisk, "Deep search" and I found this partition entries.

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/rdisk4 - 2000 GB / 1863 GiB - 3907029168 sectors
     Partition               Start        End    Size in sectors
 D EFI System                    40     409639     409600 [EFI System Partition] [EFI]
 D EFI System                    46     409645     409600 [EFI System Partition] [EFI]
>P MS Data                     2048 3867961343 3867959296 [T2_B]
 D Mac HFS                   409640 3906766983 3906357344  
 D Mac HFS                   528920 3906886263 3906357344
 D Mac HFS                   528992 3906886335 3906357344
 D Mac HFS                   529096 3906886439 3906357344
 D Mac HFS                   529128 3906886471 3906357344
 D Mac HFS                   529168 3906886511 3906357344
 D Mac HFS                   529248 3906886591 3906357344
 D Mac HFS                   529376 3906886719 3906357344
 D Mac HFS                   529456 3906886799 3906357344
 D Mac HFS                   529536 3906886879 3906357344
 D Mac HFS                   529648 3906886991 3906357344
 D Mac HFS                   529704 3906887047 3906357344
 D Mac HFS                   529768 3906887111 3906357344
 D Mac HFS                   529832 3906887175 3906357344
 D Mac HFS                   529888 3906887231 3906357344
 D Mac HFS                   530000 3906887343 3906357344
 D Mac HFS                   530112 3906887455 3906357344
 D Mac HFS                   530216 3906887559 3906357344
 D Mac HFS                   530256 3906887599 3906357344
 D Mac HFS                   530368 3906887711 3906357344
 D Mac HFS                   530432 3906887775 3906357344
 D Mac HFS                   530528 3906887871 3906357344
 D Mac HFS                   530592 3906887935 3906357344
 D Mac HFS                   530680 3906888023 3906357344
 D Mac HFS                   530736 3906888079 3906357344
 D Mac HFS                   530824 3906888167 3906357344
 D Mac HFS                   530936 3906888279 3906357344
 D Mac HFS                   531072 3906888415 3906357344
 D Mac HFS                   531104 3906888447 3906357344
 D Mac HFS                   531120 3906888463 3906357344
 D Mac HFS                   531296 3906888639 3906357344
 D Mac HFS                   531376 3906888719 3906357344
 D Mac HFS                   531440 3906888783 3906357344
 D Mac HFS                   531480 3906888823 3906357344
 D Mac HFS                   531552 3906888895 3906357344
 D Mac HFS                   531672 3906889015 3906357344
 D Mac HFS                   531712 3906889055 3906357344
 D Mac HFS                   531840 3906889183 3906357344
 D Mac HFS                   531960 3906889303 3906357344
 D Mac HFS                   532000 3906889343 3906357344
 D Mac HFS                   532016 3906889359 3906357344
 D Mac HFS                   532184 3906889527 3906357344
 D Mac HFS                   532264 3906889607 3906357344
 D Mac HFS                   532360 3906889703 3906357344
 D Mac HFS                   532400 3906889743 3906357344
 D Mac HFS                   532520 3906889863 3906357344
 D Mac HFS                   532632 3906889975 3906357344
 D Mac HFS                   532936 3906890279 3906357344
 D Mac HFS                   533048 3906890391 3906357344
 D Mac HFS                   533232 3906890575 3906357344
 D Mac HFS                   533272 3906890615 3906357344
 D Mac HFS                   533352 3906890695 3906357344
 D Mac HFS                   533560 3906890903 3906357344
 D Mac HFS                   533664 3906891007 3906357344
 D Mac HFS                   533744 3906891087 3906357344
 D Mac HFS                   533824 3906891167 3906357344
 D Mac HFS                   533840 3906891183 3906357344
Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
NTFS found using backup sector, blocksize=4096, 1980 GB / 1844 GiB

I need to recover this entry: >P MS Data 2048 3867961343 3867959296 [T2_B]

IMPORTANT NOTE: The partition It shoul be "Mac HFS", but it appears as "MS Data". I do not know why

I have tried to rewite the partition table with gpt on Mac:

diskutil unmountDisk /dev/disk1
sudo gpt destroy /dev/disk1
sudo gpt create /dev/disk1
sudo gpt add -b 2048 -i 1 -s 3867959296 /dev/disk1

But it does not work!!!!!

This is the status now

iMac-Wrona:~ Wrona$ sudo gpt -r show disk1
       start        size  index  contents
           0           1         PMBR
           1           1         Pri GPT header
           2          32         Pri GPT table
          34        2014         
        2048  3867959296      1  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  3867961344    39067791         
  3907029135          32         Sec GPT table
  3907029167           1         Sec GPT header

sudo dd if=/dev/disk1 skip=409640 bs=512 count=3 | hexdump

This is the output

iMac-Wrona:~ Wrona$ diskutil umountDisk disk1
Unmount of all volumes on disk1 was successful
iMac-Wrona:~ Wrona$ sudo dd if=/dev/disk1 skip=409640 bs=512 count=3 | hexdump

3+0 records in
3+0 records out
1536 bytes transferred in 0.298440 secs (5147 bytes/sec)
0000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000400 48 2b 00 04 80 00 21 00 48 46 53 4a 00 00 3a 37
0000410 d9 b2 93 73 da 14 65 c2 00 00 00 00 d9 b2 77 53
0000420 00 00 00 ad 00 00 00 13 00 00 10 00 1d 1a c9 0c
0000430 1d 17 9b 2f 00 84 80 00 00 01 00 00 00 01 00 00
0000440 00 00 06 5c 00 00 0d a1 00 00 00 00 00 00 00 01
0000450 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000460 00 00 00 00 00 00 00 00 15 0e 8e 2a 36 83 cc ce
0000470 00 00 00 00 03 a3 60 00 03 a3 60 00 00 00 3a 36
0000480 00 00 00 01 00 00 3a 36 00 00 00 00 00 00 00 00
0000490 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
00004c0 00 00 00 00 00 e0 00 00 00 e0 00 00 00 00 0e 00
00004d0 00 00 d2 38 00 00 0e 00 00 00 00 00 00 00 00 00
00004e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000510 00 00 00 00 12 60 00 00 12 60 00 00 00 01 26 00
0000520 00 0d 82 38 00 01 26 00 00 00 00 00 00 00 00 00
0000530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000560 00 00 00 00 12 60 00 00 12 60 00 00 00 01 26 00
0000570 00 00 e0 38 00 01 26 00 00 00 00 00 00 00 00 00
0000580 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000600

What I have to do to recover 1844 partition T2_B?

P MS Data 2048 3867961343 3867959296 [T2_B]

5
  • 2
    Please unmount disk1 diskutil umountDisk disk1 and execute sudo dd if=/dev/disk1 skip=409640 bs=512 count=3 | hexdump. Add the result (copied from the Terminal window) to your question.
    – klanomath
    Dec 15 '19 at 14:30
  • Welcome to Ask Different, Retrorec - you’ve got a good chance to start an answer with the information requested above or please edit that into the question. It’s not answerable from the details you posted, but super close to getting you to a next step.
    – bmike
    Dec 15 '19 at 14:53
  • Doing the math I'm getting the same result as your first gpt output! Did you initialize/repair the volume between old partition table and New partition table (accidentally written)?
    – klanomath
    Dec 16 '19 at 17:29
  • @retrorec I recommend a TeamViewer session. It's a remote desktop tool and I may have a "personal look" at the partition/volume- your question and the results are somehow inconsistent. Don't post the TeamViewer credentials here but send them to klanomath(at)googlemail.com
    – klanomath
    Dec 16 '19 at 22:42
  • Dear klanomath, I am out for Christmas. As soon I come back home I will send you a TeamViewer credentials. Is it ok? Thank you in advance.
    – retrorec
    Dec 21 '19 at 14:59
1

Usually the original size of the file system (apart from the partition size in the partition table) is saved in the volume header - the 3rd block(512) of an HFS+-partition/volume (considering the old partition scheme). It's based on the allocation block size and the allocation block number. A "resulting volume" of a falsely applied partition table entry mustn't be initialized or repaired though.

To get the device number and the first three blocks unmount the disk and enter:

diskutil list
sudo dd if=/dev/diskX skip=409640 bs=512 count=3 | hexdump #replace diskX with the device no. found in the previous command; below I assume it's disk1

The allocation block size is an UInt32 starting at 0x0000428

0000400 48 2b 00 04 80 00 21 00 48 46 53 4a 00 00 3a 37
0000410 d9 b2 93 73 da 14 65 c2 00 00 00 00 d9 b2 77 53
0000420 00 00 00 ad 00 00 00 13→00 00 10 00←1d 1a c9 0c
0000430 1d 17 9b 2f 00 84 80 00 00 01 00 00 00 01 00 00

The allocation block number is an UInt32 starting at 0x000042C

0000400 48 2b 00 04 80 00 21 00 48 46 53 4a 00 00 3a 37
0000410 d9 b2 93 73 da 14 65 c2 00 00 00 00 d9 b2 77 53
0000420 00 00 00 ad 00 00 00 13 00 00 10 00→1d 1a c9 0c←
0000430 1d 17 9b 2f 00 84 80 00 00 01 00 00 00 01 00 00

To convert hex to decimal use echo "obase=10; ibase=16; (uppercase hex)" | bc

So the allocation block size of the above example is:

echo "obase=10; ibase=16; 00001000" | bc #(=4096 byte)

and the number of allocation blocks is:

echo "obase=10; ibase=16; 1D1AC90C" | bc #(=488294668)

The total size of the volume is allocation block size x allocation block number: 488294668 x 4096 Byte (= 2000054960128 Byte or 3906357344 blocks(512)).

The resulting partition table looks theoretically like this then:

sudo gpt -r show disk1
       start        size  index  contents
           0           1         PMBR
           1           1         Pri GPT header
           2          32         Pri GPT table
          34           6         
          40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      409640  3906357344      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  3906766984      262147         
  3907029131          32         Sec GPT table
  3907029163           1         Sec GPT header

To get this partition table you'd have to execute:

diskutil unmountDisk /dev/disk1
sudo gpt destroy /dev/disk1
sudo gpt create /dev/disk1
sudo gpt add -i 1 -b 40 -s 409600 -t C12A7328-F81F-11D2-BA4B-00A0C93EC93B /dev/disk1
sudo gpt add -i 2 -b 409640 -s 3906357344 -t 48465300-0000-11AA-AA11-00306543ECAC /dev/disk1

Considering the given command/volume/partition table history either the volume was initialized or some other (human) error occured because the result doesn't fit with the presumed original partition table.

0

I apply your code:

diskutil unmountDisk /dev/disk1
sudo gpt destroy /dev/disk1
sudo gpt create /dev/disk1
sudo gpt add -i 1 -b 40 -s 409600 -t C12A7328-F81F-11D2-BA4B-00A0C93EC93B /dev/disk1
sudo gpt add -i 2 -b 409640 -s 3906357344 -t 48465300-0000-11AA-AA11-00306543ECAC /dev/disk1

And I get this: the new partition table. Yes it works but...

iMac-Wrona:~ Wrona$ sudo gpt -r show disk1
Password:
       start        size  index  contents
           0           1         PMBR
           1           1         Pri GPT header
           2          32         Pri GPT table
          34           6         
          40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      409640  3906357344      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  3906766984      262151         
  3907029135          32         Sec GPT table
  3907029167           1         Sec GPT header
iMac-Wrona:~ Wrona$ 

But I need to recover the old partition table, accidentally rewritten, concretly this Entry (T2_B), (If needed, see Testdisk output in the 1st post)


Disk /dev/rdisk4 - 2000 GB / 1863 GiB - 3907029168 sectors
     Partition               Start        End    Size in sectors
>P MS Data                     2048 3867961343 3867959296 [T2_B]

What do you you recommend me?

Thank you so much for your time!!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .