1

I was trying to restore the system and forgot to copy the data folder, so I shut down the computer in the middle of the Internet Recovery.

There I think I broke the table or MacOs partition because it was corrupted or something. It has some data like FFFF-FFFFF-FFF. And it only booted to Internet Recovery.

Then, I did something like here (with disk1), but when doing "gpt add -i 2..." I noticed I forgot to see the output of "gpt -r show /dev/disk1". Oh, and I did it anyways without the "-b 409640 -s 194016208 -t hfs /dev/disk0" I think.

So, first I think I would have to repair the partition table, or to add again that partition that I removed back again. Then I would need to fix the original problem of type or corruption, don't I?

I'm attaching some info of TestDisk analysis and other:

Backup:

#1586201402 Disk /dev/sda - 500 GB / 465 GiB - CHS 60821 255 63
2 : start=       34, size=        6, Id=00, P
1 : start=       40, size=   409600, Id=00, P

Error:

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 500 GB / 465 GiB - CHS 60821 255 63

The harddisk (500 GB / 465 GiB) seems too small! (< 232 TB / 211 TiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partition can't be recovered:
     Partition               Start        End    Size in sectors
>  MS Data                156346757 454172223877 454015877120 [~?~?H~I ~EM-@uDH~
MLPL~I 1 ]


[ Continue ]
btrfs blocksize=4294960503 Backup superblock, 232 TB / 211 TiB

Result:

Disk /dev/sda - 500 GB / 465 GiB - CHS 60821 255 63
     Partition               Start        End    Size in sectors
>P EFI System                    40     409639     409600 [EFI]
 P Mac HFS                 10284176   10300561      16386
 P Mac HFS                 10597040   10613425      16386
 P MS Data                107908924  107911227       2304 [NO NAME]
 P MS Data                156471568  281469199  124997632
 D MS Data                283997118  301126589   17129472
 D MS Data                294410875  294413754       2880 [NO NAME]
 P Linux Swap             417780000  417780015         16
 D MS Data                571317688  601673143   30355456
 D MS Data                589088358  619443813   30355456
 P MS Data                709222272  834219903  124997632
 P MS Data                957573120  976842751   19269632

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
FAT32, blocksize=512, 209 MB / 200 MiB

Log:

OS: Linux, kernel 5.3.0-28-generic (#30~18.04.1-Ubuntu SMP Fri Jan 17 06:14:09 UTC 2020) x86_64
Compiler: GCC 7.2
ext2fs lib: 1.44.1, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       977105060 sectors
/dev/sda: user_max   977105060 sectors
/dev/sda: native_max 977105060 sectors
/dev/sda: dco        977105060 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60821 255 63, sector size=512 - APPLE SSD SM0512G, S/N:S2ZCNY0H915970, FW:BXZ13A0Q
Disk /dev/sdc - 15 GB / 14 GiB - CHS 14784 64 32, sector size=512 - Kingston DataTraveler 3.0, FW:PMAP

Partition table type (auto): EFI GPT
Disk /dev/sda - 500 GB / 465 GiB - APPLE SSD SM0512G
Partition table type: EFI GPT

Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60821 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=977105059 (expected 977105059)
hdr_lba_start=34
hdr_lba_end=977105026
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 2 P Mac HFS                       34         39          6 [MacOS]
Current partition structure:
 1 P EFI System                    40     409639     409600 [EFI System Partition]
No HFS or HFS+ structure
 2 P Mac HFS                       34         39          6 [MacOS]
 2 P Mac HFS                       34         39          6 [MacOS]
Backup partition structure
partition_save

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60821 255 63
FAT32 at 0/0/41
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT32 at 0/0/41
     EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

HFS magic value at 640/40/57
part_size 16386
     Mac HFS                 10284176   10300561      16386
     HFS blocksize=32768, 8389 KB / 8193 KiB

HFS magic value at 659/161/63
part_size 16386
     Mac HFS                 10597040   10613425      16386
     HFS blocksize=32768, 8389 KB / 8193 KiB
FAT12 at 6717/5/5
check_FAT: Unusual media descriptor (0xf8!=0xf0)
FAT1 : 1-2
FAT2 : 3-4
start_rootdir : 5
Data : 37-2300
sectors : 2304
cluster_size : 4
no_of_cluster : 566 (2 - 567)
fat_length 2 calculated 2
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT12 at 6717/5/5
     MS Data                107908924  107911227       2304 [NO NAME]
     FAT12, blocksize=2048, 1179 KB / 1152 KiB

recover_btrfs: part_size 454015877120
     MS Data                156346757 454172223877 454015877120 [ëÿÿH‰ÅH
ÀuDHL$PL‰âE1Éj]
     btrfs blocksize=4294960503 Backup superblock, 232 TB / 211 TiB
This partition ends after the disk limits. (start=156346757, size=454015877120, end=454172223877, disk end=977105060)

recover_EXT2: s_block_group_nr=0/476, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 15624704
recover_EXT2: part_size 124997632
     MS Data                156471568  281469199  124997632
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 63 GB / 59 GiB
FAT32 at 18326/58/31
Bad root_cluster
FAT12 at 18326/58/32
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 18326/58/32
     MS Data                294410875  294413754       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB

block_group_nr 49

recover_EXT2: "e2fsck -b 1605632 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=49/65, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8112
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2141184
recover_EXT2: part_size 17129472
     MS Data                283997118  301126589   17129472
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8770 MB / 8364 MiB

LVM magic value at 18779/29/34
     Linux Swap             417780000  417780015         16
     SWAP2 version 0, pagesize=8192, 8192 B

LVM magic value at 27041/170/4

LVM magic value at 30433/229/47

LVM magic value at 33531/109/45

recover_EXT2: s_block_group_nr=0/115, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 3794432
recover_EXT2: part_size 30355456
     MS Data                571317688  601673143   30355456
     ext4 blocksize=4096 Large_file Sparse_SB, 15 GB / 14 GiB

block_group_nr 81

recover_EXT2: "e2fsck -b 2654208 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=81/115, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 3794432
recover_EXT2: part_size 30355456
     MS Data                589088358  619443813   30355456
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 15 GB / 14 GiB

LVM magic value at 41263/101/33

LVM magic value at 41509/45/36

LVM magic value at 42120/11/22

LVM magic value at 42469/71/26

recover_EXT2: s_block_group_nr=0/476, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
rec

sudo fdisk -l

Disk /dev/loop0: 1.9 GiB, 2029981696 bytes, 3964808 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop1: 89.1 MiB, 93417472 bytes, 182456 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop2: 54.7 MiB, 57294848 bytes, 111904 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop3: 44.9 MiB, 47063040 bytes, 91920 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop4: 160.2 MiB, 167931904 bytes, 327992 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop5: 4.2 MiB, 4403200 bytes, 8600 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop6: 14.8 MiB, 15462400 bytes, 30200 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop7: 956 KiB, 978944 bytes, 1912 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sda: 465.9 GiB, 500277790720 bytes, 977105060 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: 7E25BCD8-0A34-436E-9DD1-4D050FB0FE5C

Device     Start    End Sectors  Size Type
/dev/sda1     40 409639  409600  200M EFI System
/dev/sda2     34     39       6    3K Apple HFS/HFS+

Partition 2 does not start on physical sector boundary.
Partition table entries are not in disk order.


Disk /dev/sdc: 14.4 GiB, 15502147584 bytes, 30277632 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x6e037a9d

Device     Boot Start     End Sectors  Size Id Type
/dev/sdc1  *        0 4153407 4153408    2G  0 Empty
/dev/sdc2       12012   16939    4928  2.4M ef EFI (FAT-12/16/32)


Disk /dev/loop8: 3.7 MiB, 3825664 bytes, 7472 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop9: 152.7 MiB, 160071680 bytes, 312640 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes                                                    

sudo parted -l

Model: ATA APPLE SSD SM0512 (scsi)
Disk /dev/sda: 500GB
Sector size (logical/physical): 512B/4096B
Partition Table: gpt
Disk Flags: 

Number  Start   End     Size   File system  Name                  Flags
 2      17.4kB  20.5kB  3072B               MacOS
 1      20.5kB  210MB   210MB  fat32        EFI System Partition  boot, esp


Error: The primary GPT
table is corrupt, but the backup appears OK, so that will
be used.
OK/Cancel? cancel
Model: Kingston DataTraveler 3.0 (scsi)
Disk /dev/sdc: 15.5GB
Sector size (logical/physical): 512B/512B
Partition Table: unknown
Disk Flags:

I'm from Ubuntu Live connected with a pendrive. Please help :(

UPDATE1

I was using MacOS Catalina. I think the drive was APFS. The folder I forgot to recover I think it was ~/Desktop/Backup.

sudo dd if=/dev/sda skip=409640 count=1 bs=512 | hexdump

1+0 records in
1+0 records out
0000000 e883 cc0d e3d2 e259 0001 0000 0000 0000
0000010 386b 003d 0000 0000 0001 8000 0000 0000
0000020 584e 4253 1000 0000 458e 0640 0000 0000
0000030 0000 0000 0000 0000 0000 0000 0000 0000
0000040 0002 0000 0000 0000 f83e dca9 1c0c b642
0000050 c48e 376a 1e03 96b8 8460 0054 0000 0000
0000060 386c 003d 0000 0000 0118 0000 6c30 0000
0000070 9202 0000 0000 0000 0001 0000 0000 0000
0000080 0104 0000 0aa4 0000 0102 0000 0002 0000
0000090 0a95 0000 000f 0000 3bb8 0034 0000 0000
00000a0 41f2 000c 0000 0000 0401 0000 0000 0000
00000b0 0000 0000 0064 0000 f5c8 0026 0000 0000
00000c0 0406 0000 0000 0000 1339 0000 0000 0000
00000d0 b242 0000 0000 0000 27e5 0039 0000 0000
00000e0 0000 0000 0000 0000 0000 0000 0000 0000
*
0000200

UPDATE2

Following klanomath advice, I'm now with this problem (I think the original one, before I screwed up the partition table).

diskutil list

/dev/disk1 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *500.3 GB   disk1
   1:                        EFI EFI                     209.7 MB   disk1s1
   2: 7C3457EF-0000-11AA-AA11-00306543ECAC               429.6 GB   disk1s2

When doing diskutil verifyVolume disk1s2 it says Error starting file system verification for disk1s2: Unrecognized file system (-69846).

UPDATE3

After the last updated, I rebooted the system and now diskutil list shows the following:

/dev/disk0 (disk image):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        +2.1 GB   disk0
   1:                  Apple_HFS macOS Base System       2.0 GB   disk0s1
/dev/disk1 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *500.3 GB   disk1
   1:                        EFI EFI                     209.7 MB   disk1s1
   2:                 Apple_APFS Container disk2           429.6 GB   disk1s2
/dev/disk2 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +429.6 GB     disk2
                             Physical Store disk1s2
   1:                APFS Volume MacOS - Data            338.5 GB   disk2s1
   2:                APFS Volume Preboot                 86.4 MB    disk2s2
   3:                APFS Volume Recovery                528.5 MB   disk2s3
   4:                APFS Volume VM                      1.7 GB     disk2s4
   4:                APFS Volume MacOS                   10.8 GB     disk2s5

I don't know but that sounds good to me! At least the last time, before entering into recovery mode, I couldn't boot. Maybe there are still some commands missing, or maybe now I can? I'll wait for a confirmation.

UPDATE4

After diskutil verifyVolume disk2 I had this output: enter image description here

UPDATE5 and Final

I have dual boot so it was booting from the other one. Once I realized that I pressed option and there it was! MacOS booting!

Thank you really @klanomath! You're truly the best. Thank you, thank you, thank you!

7
  • 1
    The question with all its detailed listings is rather messy and unclear. What's the system version? "I was trying to restore the system and forgot to copy the data folder" Which data folder? – klanomath Apr 6 '20 at 22:18
  • Sorry @klanomath, you're right. I was using MacOS Catalina, and I forgot (and now trying to recover) the folder ~/Desktop/Backup I think. – alandooz Apr 6 '20 at 23:07
  • Any dual/triple-boot environment (e.g. macOS+Win10(+Linux) previously? – klanomath Apr 6 '20 at 23:09
  • Yep, dual: Linux and MacOS. I think I deleted the linux partition, except the swap partition of 10GB that I couldn't. – alandooz Apr 6 '20 at 23:35
  • I have dd version 8.28, doesn't recognize piping block. Is another command or can you tell me how to install it? I'm not finding anything on Internet about it – alandooz Apr 6 '20 at 23:52
0

My advice:

  1. Boot to macOS Internet Recovery Mode
  2. Open Terminal in the menubar Utilities > Terminal
  3. Get an overview: diskutil list
  4. Edit the GPT of the internal SSD (below I assume it's disk0) and restore the vanished APFS container:

    gpt -r show /dev/disk0
    diskutil umountDisk /dev/disk0
    gpt remove -i 2 /dev/disk0 #remove all partitions except partition1 EFI. With this command only partition2 is removed. If necessary also remove `... -i 3 ...`, `... -i 4 ...` etc.
    diskutil umountDisk /dev/disk0
    gpt add -i 2 -b 409640 -s 839003248 -t apfs /dev/disk0 #add APFS container
    

    The size of the container is derived from the hexdump output:
    584e 4253 1000 0000 458e 0640 0000 0000

    Depending on the hexdump settings and the operating system (and the bit-order) one has to swap bits and bytes specifically and convert it from hex to dec afterwards. In macOS with the default settings the same command (but with a different size of another container) shows the following result:
    4e58 5342 0010 0000 29ea 2201 0000 0000.

    4e58 5342: is the magic string of an APFS container
    0010 0000: is the allocation block size (after rearranging to 0000 0010 and 0000 1000)
    29ea 2201 0000 0000 > 0000 0000 29ea 2201 > 0000 0000 0122ea29

    enter image description here

    In Linux (alandooz's Ubuntu Live thumb drive) the result looks like this:

    584e 4253: is the magic string of an APFS container
    1000 0000 is the allocation block size: 4096 Byte (after swapping Bits and Bytes and converting)
    458e 0640 0000 0000 is the number of allocation blocks: 104875406
    (after swapping Bytes and converting: 458e 0640 0000 0000 > 8e45 4006 0000 0000 > 0000 0000 8e45 4006 > 0000 0000 0640 458e)

    enter image description here

    This equals 839003248 blocks(512) (104875406*8)!

  5. Finally check the disk: diskutil verifyDisk disk0

  6. ... and the APFS volumes diskutil list (to get the APFS Container Scheme disk number) and diskutil verifyVolume diskX (with diskX = device node of the APFS Container Scheme disk)

If you get the Suspicious MBR error you have to set a proper GPT:

  1. Get an overview: diskutil list and destroy the partition table of the SSD (below I assume it's disk0 - replace accordingly if you find another disk identifier) and later create a new one:

    diskutil list
    diskutil umountDisk disk0
    gpt destroy disk0
    

    Sometimes it's even required to zero the first block:

    dd if=/dev/zero of=/dev/disk0 bs=512 count=1
    gpt create -f disk0
    
  2. Add the partitions:

    gpt add -i 1 -b 40 -s 409600 -t C12A7328-F81F-11D2-BA4B-00A0C93EC93B /dev/disk0
    gpt add -i 2 -b 409640 -s 839003248 -t 7C3457EF-0000-11AA-AA11-00306543ECAC /dev/disk0 
    
  3. Finally check the disk: diskutil verifyDisk disk0
  4. ... and the APFS volumes diskutil list (to get the APFS Container Scheme disk number) and diskutil verifyVolume diskX (with diskX = device node of the APFS Container Scheme disk)
18
  • Could it be that when I tried to do the last step of 'gtp add', it says the following? "usage: gpt add [-b lba] [-i index] [-s lba] [-t uuid] device ..." – alandooz Apr 7 '20 at 1:43
  • Maybe I have to use 7C3457EF-0000-11AA-AA11-00306543ECAC instead of apfs, but I'll wait for your wisdom here and keep out of trouble :) – alandooz Apr 7 '20 at 2:04
  • "gpt add: /dev/disk1: Suspicious MBR at sector 0" and "gpt add: /dev/disk1: error: no space available on device" after the gtp add with the guid :( – alandooz Apr 7 '20 at 2:25
  • @alandooz If you are booted to macOS Recovery 10.15.x -t apfs should work. You can use -t 7C3457EF-0000-11AA-AA11-00306543ECAC instead. – klanomath Apr 7 '20 at 5:02
  • @alandooz Suspicious MBR... you're probably trying to modify your thumb drive (disk1 instead of disk0)! – klanomath Apr 7 '20 at 5:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .