APFS Container Corrupted - by using testDisk

Question

I have a 1 TB drive on a late 2013 mbp.

This week it decided to stop booting - was just hanging on the loading screen.

I have booted of an SD card and I could see the drive and browse it as read only.

I regretfully deployed testDisk - intending to look, but ended up saving the partition table. I didn't make any changes intentionally to the disk layout, but since then it is messed up.

Turns out testDisk doesn't recognise APFS Containers and it has written it back incorrectly.

diskutil list /dev/disk0
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *1.0 TB     disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:                  Apple_HFS 383B318C08526F8D75FF46  959.2 GB   disk0s2
   3:                  Apple_HFS                         650.0 MB   disk0s3

sudo gpt -r show disk0
       start        size  index  contents
           0           1         PMBR
           1           1         Pri GPT header
           2          32         Pri GPT table
          34           6         
          40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      409640    14116056         
    14525696  1873432632      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  1887958328    64297264         
  1952255592     1269536      3  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  1953525128           7         
  1953525135          32         Sec GPT table
  1953525167           1         Sec GPT header

UPDATE: here is the same data from the 500GB HD that was cloned onto the 1TB drive - if seeing how it used to be is any help...

diskutil list /dev/disk4
/dev/disk4 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *500.1 GB   disk4
   1:                        EFI EFI                     209.7 MB   disk4s1
   2:                 Apple_APFS Container disk5         499.9 GB   disk4s2

sudo gpt -r show disk4
Password:
      start       size  index  contents
          0          1         PMBR
          1          1         Pri GPT header
          2         32         Pri GPT table
         34          6         
         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
     409640  976363488      2  GPT part - 7C3457EF-0000-11AA-AA11-00306543ECAC
  976773128          7         
  976773135         32         Sec GPT table
  976773167          1         Sec GPT header

And disk 5 was the synthesized one in that Container...

/dev/disk5 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +499.9 GB   disk5
                                 Physical Store disk4s2
   1:                APFS Volume HD                      11.3 GB    disk5s1
   2:                APFS Volume HD - Data               231.6 GB   disk5s2
   3:                APFS Volume Preboot                 83.7 MB    disk5s3
   4:                APFS Volume Recovery                530.6 MB   disk5s4
   5:                APFS Volume VM                      1.1 GB     disk5s5

Before the partition data was damaged, it has a Container and two disks HD and HD - Data.

Is there anything I can do to rebuild the partition table back to a healthy APFS Volume state?

Answer 1

Thanks to David Anderson for his previous detailed posts here and here I managed to work it out and restore the partitions. You are a legend!

For anyone else who has this issue - this is what I did:

First remove the 2 incorrect partitions

sudo gpt remove -i 2 /dev/disk0
sudo gpt remove -i 3 /dev/disk0

And then add back in the new APFS partition

sudo gpt add -i 2 -b 409640 -s 1953115488 -t apfs /dev/disk0

The KEY part here is working out the correct Size - in my case - 1953115488.

David explains how to find the correct values in this post here.

But I also found it by accident.

I initially created the new partition with the incorrect size.

I assumed I wanted a 1TB partition, split over blocks of 512k - so 1000000000000 / 512 = 1953125000

After creating the partition at that size, it didn't work, so I ran a verifyVolume on the APFS Container

diskutil verifyVolume  disk0s2

And that failed with

warning: nx_block_count is 244139436, while device block count is 234379555

so - the block count was 244139436.

Using Davids' calculations each APFS block is 8 Logical blocks, so I multipied the nx_block_count by 8 to get the correct size of 1953115488 for the APFS Container.