9

I accidentally wrote some .iso data to a disk through dd by mistake. I cancelled the command after just 2 seconds but that was enough to wipe the first EFI partition (200MB) and a bit of the second partition where OS X and some files I do really like are stored.

The ISO image I accidentally wrote with dd was 600mb in size so the total damage would be a maximum of 400 MB since I dd from sector 0 until I hit Ctrl + C and EFI partition was gone.

I tried running fsck -fy on that partition but it's a no-go. 

sudo fsck_hfs -fy /dev/disk2s2
** /dev/rdisk2s2
Using cacheBlockSize=32K cacheTotalBlock=32768 cacheSize=1048576K.
Executing fsck_hfs (version diskdev_cmds-557~393).
** Checking Journaled HFS Plus volume.
Invalid B-tree node size

I don't know much about HFS+ but on any EXT Linux partition I could pretty much recover everything that wasn't wiped by dd, even if overwritten. Here however I don't know where to start. There are some fancy GUI tools but they probably won't do anything else then fsck does.

It can't be that the whole partition is gone because 400 MB (if the whole ISO would be written - but that wasn't the case) out of 400 GB was overwritten with data by accident. Partition table seems to be alright - gdisk on Linux says it's OK and Disk Utility on Mac as well.

Volume was journaled (seems to be a problem for HFS+ utilities on Linux)

Any tips how to rescue my files?

Improve this question
2
2

Download Testdisk. You would have to run it from an external disk. It’s a command line tool. It will diagnose problems with your partition table or filesystem and repair them. It’s very verbose so you won’t need any readmes. First recover your OS X partition and then your EFI partition. Comment back if you need any help using Testdisk.

Improve this answer
2
  • Hi Guys. Thanks for the answer. TestDisk does not goes well with journaled volumes == everything past 10.4 is journaled by default as far as I can say. – PJJ Sep 5 '12 at 21:45
  • Um, no. Testdisk was developed after Apple introduced jorunaled HFS+. It works very well with all types of filesystems. – duci9y Sep 6 '12 at 9:43
1

You should to try to rebuild the catalog file on the specified file system by specifying -r option, for example:

$ fsck.hfsplus -fryd /dev/sdd2

See also: How to fix invalid map node linkage?

Improve this answer
1
  • Worked perfect! Thank you! – Terrance Dec 18 '19 at 8:11
0

I was able to get data back using Photorec but was unable to get original filenames or directory structures.

I did find R-Studio https://r-studio.com which recovered the entire file and folder structure. It's a paid product but worked out well.

Still can't fix the Invalid B-tree node size issue. It almost seems like a partition issue.

Improve this answer
-3

Use DiskWarrior. Has saved many of my client's disks!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .