Recover partition on HPFS/QNX/AUX + Extended LBA drive. Blank TYPE in diskutil

Question

I'm attempting to recover some data from an old 60GB IDE 2.5" drive from an old Windows laptop.

diskutil list gives

/dev/disk5 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                                                   *60.0 GB    disk5

fdisk is able to get some more information, which is giving my hopes up that this is recoverable: sudo fdisk /dev/disk5

Disk: /dev/disk5    geometry: 7296/255/63 [117210240 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
*1: 07    0   1   1 - 1023 254  63 [        63 -  100486512] HPFS/QNX/AUX
 2: 0F 1023   0   1 - 1023 254  63 [ 100486575 -   16723665] Extended LBA
 3: 00    0   0   0 -    0   0   0 [         0 -          0] unused
 4: 00    0   0   0 -    0   0   0 [         0 -          0] unused
Signature: 0x0
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: 00    0   0   0 -    0   0   0 [         0 -          0] unused
 2: 00    0   0   0 -    0   0   0 [         0 -          0] unused
 3: 00    0   0   0 -    0   0   0 [         0 -          0] unused
 4: 00    0   0   0 -    0   0   0 [         0 -          0] unused

I've tried reading out the byte-data to get any hints of the filesystems: sudo dd if=/dev/disk5 count=5 2>/dev/null | hexdump -C giving first block:

00000000  33 c0 8e d0 bc 00 7c fb  50 07 50 1f fc be 1b 7c  |3.м.|P.P..||
00000010  bf 1b 06 50 57 b9 e5 01  f3 a4 cb bd be 07 b1 04  |..PW��..|
00000020  38 6e 00 7c 09 75 13 83  c5 10 e2 f4 cd 18 8b f5  |8n.|.u..���.|
00000030  83 c6 10 49 74 19 38 2c  74 f6 a0 b5 07 b4 07 8b  |.�It.8,t...|
00000040  f0 ac 3c 00 74 fc bb 07  00 b4 0e cd 10 eb f2 88  |�.t...��.|
00000050  4e 10 e8 46 00 73 2a fe  46 10 80 7e 04 0b 74 0b  |N.�.s*F..~..t.|
00000060  80 7e 04 0c 74 05 a0 b6  07 75 d2 80 46 02 06 83  |.~..t..u�F...|
00000070  46 08 06 83 56 0a 00 e8  21 00 73 05 a0 b6 07 eb  |F...V..�.s..�
00000080  bc 81 3e fe 7d 55 aa 74  0b 80 7e 10 00 74 c8 a0  |.>}Ut..~..tȠ|
00000090  b7 07 eb a9 8b fc 1e 57  8b f5 cb bf 05 00 8a 56  |.�.W.˿...V|
000000a0  00 b4 08 cd 13 72 23 8a  c1 24 3f 98 8a de 8a fc  |..�r#.$?..�|
000000b0  43 f7 e3 8b d1 86 d6 b1  06 d2 ee 42 f7 e2 39 56  |C��ֱ.�B�V|
000000c0  0a 77 23 72 05 39 46 08  73 1c b8 01 02 bb 00 7c  |.w#r.9F.s....||
000000d0  8b 4e 02 8b 56 00 cd 13  73 51 4f 74 4e 32 e4 8a  |.N..V.�sQOtN2�|
000000e0  56 00 cd 13 eb e4 8a 56  00 60 bb aa 55 b4 41 cd  |V.��.V.`UA�
000000f0  13 72 36 81 fb 55 aa 75  30 f6 c1 01 74 2b 61 60  |.r6.Uu0.t+a`|
00000100  6a 00 6a 00 ff 76 0a ff  76 08 6a 00 68 00 7c 6a  |j.j.v.v.j.h.|j|
00000110  01 6a 10 b4 42 8b f4 cd  13 61 61 73 0e 4f 74 0b  |.j.B.�.aas.Ot.|
00000120  32 e4 8a 56 00 cd 13 eb  d6 61 f9 c3 55 67 79 6c  |2�V.��a�gyl|
00000130  64 69 67 20 70 61 72 74  69 73 6a 6f 6e 73 74 61  |dig partisjonsta|
00000140  62 65 6c 6c 00 46 65 69  6c 20 75 6e 64 65 72 20  |bell.Feil under |
00000150  6c 61 73 74 69 6e 67 20  61 76 20 6f 70 65 72 61  |lasting av opera|
00000160  74 69 76 73 79 73 74 65  6d 00 4d 61 6e 67 6c 65  |tivsystem.Mangle|
00000170  6e 64 65 20 6f 70 65 72  61 74 69 76 73 79 73 74  |nde operativsyst|
00000180  65 6d 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |em..............|
00000190  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

The original OS was installed in Norwegian. The last piece of the text is roughly translated to

"??valid partition table. Error during loading of OS. Missing OS"

Last block:

00000310  00 0a 0d 45 72 72 20 35  3a 20 45 72 72 6f 72 20  |...Err 5: Error |
00000320  66 69 6e 64 69 6e 67 20  56 46 4c 4f 50 50 59 2e  |finding VFLOPPY.|
00000330  53 59 53 00 0a 0d 45 72  72 20 36 3a 20 45 72 72  |SYS...Err 6: Err|
00000340  6f 72 20 72 65 61 64 69  6e 67 20 56 46 4c 4f 50  |or reading VFLOP|
00000350  50 59 2e 53 59 53 00 0a  0d 45 72 72 20 37 3a 20  |PY.SYS...Err 7: |
00000360  45 72 72 6f 72 20 72 65  61 64 69 6e 67 20 64 69  |Error reading di|
00000370  73 6b 00 0a 0d 45 72 72  20 38 3a 20 46 61 6b 65  |sk...Err 8: Fake|
00000380  20 46 6c 6f 70 70 79 20  64 72 69 76 65 72 20 6e  | Floppy driver n|
00000390  6f 74 20 66 6f 75 6e 64  00 0a 0d 45 72 72 20 39  |ot found...Err 9|
000003a0  3a 20 56 46 4c 4f 50 50  59 2e 53 59 53 20 63 6f  |: VFLOPPY.SYS co|
000003b0  72 72 75 70 74 00 00 00  00 00 90 cc 90 06 50 b8  |rrupt......�.P|
000003c0  40 00 8e c0 67 26 a0 17  00 00 00 24 01 58 07 0f  |@..g&....$.X..|

Also tried getting some info with gpt: sudo gpt -r show /dev/disk5

gpt show: unable to open device '/dev/disk5': Input/output error

Any ideas on how to move forward? I'm not too familiar with the macOS cli tools for disks (coming from Linux), and not familiar with HFPS and LBA.

Answer 1

The diskutil list is producing the output posted because the signature shown as 0x0 should be 0xAA55. This would prevent the mounting of any volume on the drive by macOS. On the other hand, when tested using Windows 11, a properly formatted NTFS volume stored in the first partition would mount. Below are two methods to correct this problem.

Note: When the sector size is 512 bytes, NTFS volumes normally start at a sector number which is evenly divisible by 8. Since first partition starts a 63, you might what to dump and review the first sector of this partition. See the end of this answer for the command.

Method 1: Remove second entry from MBR partition table

Since the extended partition appears to be empty, you could just remove the second entry from MBR partition table. The command to do so is given below.

sudo fdisk -e /dev/disk1

This command is interactive. The entries are given in the first column of the table below.

Entry	Type	Comment
p	command	Print the loaded MBR partition table, should be same as shown in question
e 2	command	Edit second entry
0	parameter	Partition id (0 to disable)
p	command	Print the loaded MBR partition table, 2nd entry should be all zeros (unused)
q	command	Quit edit of current MBR, saving current changes

Method 2: Replace the missing signature.

The commands below will write out the signature of 0xAA55 to the correct location on the drive.

start=100486575
echo 55aa | sudo xxd -r -p -seek $((start*512+510)) - /dev/disk1

Before using Method 2, I would recommend posting the output from the command below.

sudo dd if=/dev/disk1 count=1 skip=63 2>/dev/null | hexdump -Cv

This output would allow me to check if the first partition contains a NTFS volume and that the volume is not larger than the partition. Or, you can check yourself. (Although, when testing using Windows 11, I found Windows will not mount a NTFS volume larger than the partition.) The boot sector description of a volume formatted with NTFS can be found here.

Answer 2

According to Wikipedia, HPFS was used by OS/2, and was compatible with Win95 / 98 only as a network share. You may be better off using a Linux system to try and access it with, as there's driver support, whereas I don't see anything for macOS.

A brief look at what's available at https://tldp.org/HOWTO/Filesystems-HOWTO.html#toc4 though that mentions 2.2 Linux kernels. A Google search may reveal more.