Help restoring lost partition

[buywisdom]

Dear Community,



I was running a iMac 2010 i5 until the hard drive failed a few months ago. It has all of my photos and while many of the are backed up the last 18 months are not. I have removed the HDD from the machine and have pugged it into an external enclosure I have and into my new MBP. When I plug it in I get an error that reads:



The disk you inserted was not readable by this computer.

Initialize.. / Ignore / Eject



No matter what I do only the top layer appears i.e. the drive does not mount (last one):



I discovered http://perrohunter.com/repair-a-mac-os-x-hfs-partition-table/ and I ran test disk for 8 days and got this:





I then ran pdisk but it did not go exactly like steps 8-10 of his guide:



sudo pdisk /dev/rdisk2

pdisk: Can't read block 0 from '/dev/rdisk2'

Edit /dev/rdisk2 -

Command (? for help): i

A physical block is 512 bytes:

A logical block is 512 bytes:

size of 'device' is 0 blocks (512 byte blocks):

what should be the size? 732558335

new size of 'device' is 732558335 blocks (512 byte blocks)

Command (? for help): i

map already exists

do you want to reinit? [n/y]: y

A physical block is 512 bytes:

A logical block is 512 bytes:

size of 'device' is 732558335 blocks (512 byte blocks):

new size of 'device' is 732558335 blocks (512 byte blocks)

Command (? for help): c

First block: 392580562

Length in blocks: 1036124

Name of partition: recoverydisk

pdisk: Can't read block 2 from partition 2

pdisk: Can't read block 2 from partition 3

Command (? for help): w

Writing the map destroys what was there before. Is that okay? [n/y]: y

pdisk: Unable to write block zero (Invalid argument)

pdisk: Unable to write block 1 (Invalid argument)

pdisk: Unable to write block 2 (Invalid argument)

pdisk: Unable to write block 3 (Invalid argument)

pdisk: Unable to write block 4 (Invalid argument)

The partition table has been altered!



I then reset the machine but the drive does not mount and I get the same error when initializing about size which I again put in the size. I tired writing but it seems not to "catch".



pdisk: Can't read block 0 from '/dev/rdisk2'

Edit /dev/rdisk2 -

Command (? for help): i

A physical block is 512 bytes:

A logical block is 512 bytes:

size of 'device' is 0 blocks (512 byte blocks):

what should be the size? 732558336

new size of 'device' is 732558336 blocks (512 byte blocks)

Command (? for help): w

Writing the map destroys what was there before. Is that okay? [n/y]: y

pdisk: Unable to write block zero (Invalid argument)

pdisk: Unable to write block 1 (Invalid argument)

pdisk: Unable to write block 2 (Invalid argument)

The partition table has been altered!



Any help on this would be much appreciated.

 

[treekram]

Where to begin? ...

Disclaimer: I'm not an expert in these sorts of things.

The tools that you used are meant to be used when the partition table accidentally gets overwritten or corrupted. If the HDD is bad, they have no chance of working if the HDD corruption happens where the partition table(s) are stored.

I don't know why the test took 8 days - is that normal for this software. If not, it again points to a bad HDD.

The partition it found (Linux) is possibly the recovery partition. (On my systems, I usually see a recovery partition of 650MB, the partition it found is about 530MB.) Since this used to be the system disk, it's likely there were 3 partitions total, as shown in https://perrohunter.com/files/images/36.png which is from the article you linked. Note in that example, they have an extra DOS partition, which is something that that user added and is not typical for an OSX installation. That it didn't find the 3 typical OSX partitions is not good.

In order to recover the data, you may be able to 1) do a block-level clone to a new disk, 2) find out that the typical layout of a 3TB disk should be and try using pdisk with those parameters to see if that works. My opinion is that even if you were to do that correctly, there isn't a very good chance of recovering the data because there's various things that can go wrong - most critically that the damage to the HDD was not limited to the location where the primary partition table was located.

Wait to see if somebody has a better answer. How important are the photos? If you're willing to pay a data recovery service, then that's probably the way to go. Further use of the damaged HDD may result in further damage.

 

[buywisdom]

The partition it found (Linux) is possibly the recovery partition. (On my systems, I usually see a recovery partition of 650MB, the partition it found is about 530MB.) Since this used to be the system disk, it's likely there were 3 partitions total, as shown in https://perrohunter.com/files/images/36.png which is from the article you linked. Note in that example, they have an extra DOS partition, which is something that that user added and is not typical for an OSX installation. That it didn't find the 3 typical OSX partitions is not good.

This was a second disk not the one with OSX as I had an SSN with program and OSX

In order to recover the data, you may be able to 1) do a block-level clone to a new disk, 2) find out that the typical layout of a 3TB disk should be and try using pdisk with those parameters to see if that works. My opinion is that even if you were to do that correctly, there isn't a very good chance of recovering the data because there's various things that can go wrong - most critically that the damage to the HDD was not limited to the location where the primary partition table was located.

How do I do a block level clone?

Photos are very important to me. Mostly family photos. I will go to a recovery service next week.

 

[richard2]

How do I do a block level clone?

Use ddrescue, which can be installed via MacPorts or Homebrew. You could also try using Data Rescue.

 

[treekram]

This was a second disk not the one with OSX as I had an SSN with program and OSX

How do I do a block level clone?

I'm confused. The analysis output in the image you have is of the bad HDD taken from the iMac? And was this disk the OSX disk in the iMac? If not, did you have an SSD+HDD in the iMac?

My presumption was that the analysis output in the image is of the bad HDD from the iMac and that it at one time had OSX and was the system disk. Clarifying this and the SSD+HDD question is important.

ddrescue looks like a good program but, clarifying what richard2 said, is not a program you can just download and run.

I think you should find out what the recovery service says. If the cost is too high, ask them what it will cost to make a block level clone from your disk. I would not touch the disk until you talk to the data recovery service.

In my opinion, before running other programs like Data Rescue, Disk Warrior etc., one should have a clone of the bad disk. Then make another block level clone from the clone and use that to try the data rescue programs. If you want to try a second program, re-do the clone and start from that point. In a cursory search I did earlier, I did not see a clone program that had good error correction features and was easy to use. If it comes to the point where you need to do your own block level clone, then come back here and we can sort out the alternatives.

 

[richard2]

ddrescue looks like a good program but, clarifying what richard2 said, is not a program you can just download and run.

It's certainly not user-friendly; however, it's powerful, free, and there are many detailed guides for using it on the Web.

In my opinion, before running other programs like Data Rescue, Disk Warrior etc., one should have a clone of the bad disk. Then make another block level clone from the clone and use that to try the data rescue programs. If you want to try a second program, re-do the clone and start from that point.

Once you've created an image of a disc using ddrescue, you can mount the image as a read-only virtual disc and access it as much as you wish without any risk of further data loss.

 

[treekram]

richard2, my concern with ddrescue is two-fold. Unless one has a downloadable executable from a reliable source (perhaps there's one out there - a one-minute search on my part didn't turn up one), you'd have to get (as you said) something like MacPorts or Homebrew to make it work. I just have reservations suggesting this to somebody unless I know something about their technical background. The other concern is that if it's based solely on dd, then perhaps there are other alternatives out there which can do better in the error-correction (vs. error avoidance) area. Don't get me wrong, now that you've pointed it out, I like what ddrescue does and I think I'll download and compile the program at some point.

In terms of the read-only virtual disk, if a data rescue program thinks it can fix a problem, and with the OP, the partition table seems badly damaged - it will have to write to the disk to fix it. Or is my presumption wrong? So all I'm saying is you need a copy (be it the original cloned disk or an image of the disk) so that if the data rescue program doesn't fix the problem and you want to try another data rescue program, you want to go back to the original cloned disk, not a disk that another program has written modifications to.

 

[richard2]

richard2, my concern with ddrescue is two-fold. Unless one has a downloadable executable from a reliable source (perhaps there's one out there - a one-minute search on my part didn't turn up one), you'd have to get (as you said) something like MacPorts or Homebrew to make it work. I just have reservations suggesting this to somebody unless I know something about their technical background. The other concern is that if it's based solely on dd, then perhaps there are other alternatives out there which can do better in the error-correction (vs. error avoidance) area. Don't get me wrong, now that you've pointed it out, I like what ddrescue does and I think I'll download and compile the program at some point.

1. Um, MacPorts was founded by employees of Apple (among others) and is hosted by Apple.

2. MacPorts is easy to install — the most difficult step of the installation process is entering a single command in Terminal.

3. You're contradicting yourself:

In my opinion, before running other programs like Data Rescue, Disk Warrior etc., one should have a clone of the bad disk.

Writing to a disc that has a physical fault can cause permanent data loss. As we don't know whether buywisdom's disc has a logical or physical fault, it would be reckless to advise him or her to attempt to repair the disc's logical structure before cloning the disc.

In terms of the read-only virtual disk, if a data rescue program thinks it can fix a problem, and with the OP, the partition table seems badly damaged - it will have to write to the disk to fix it. Or is my presumption wrong?

It would depend entirely on how the data recovery software was designed; well-designed software would completely avoid writing to the disc. For example, PhotoRec can recover files from a disc with a damaged partition table or filesystem without writing to the disc.

 

[treekram]

richard2, we have different views. You also have more experience dealing with damaged disks (be it physical or logical damage). As I mentioned earlier, my concern with what you suggest is how easy it is (or not) to do. But if you would be willing to guide the OP through the process of what you suggest, that would help a lot.

As it is, I would like to find out more about the specifics of the OP's disk configuration in the iMac that the bad disk came from. It's possible, probably not likely, that there was a fusion drive. That would change the entire complexion of what they're going to have to deal with. I also don't see a 3TB drive as an Apple BTO option so I have additional questions there. It might also be a while, there was a 2-1/2 week hiatus in responses from the OP the last time.

 

[buywisdom]

richard2, we have different views. You also have more experience dealing with damaged disks (be it physical or logical damage). As I mentioned earlier, my concern with what you suggest is how easy it is (or not) to do. But if you would be willing to guide the OP through the process of what you suggest, that would help a lot.

As it is, I would like to find out more about the specifics of the OP's disk configuration in the iMac that the bad disk came from. It's possible, probably not likely, that there was a fusion drive. That would change the entire complexion of what they're going to have to deal with. I also don't see a 3TB drive as an Apple BTO option so I have additional questions there. It might also be a while, there was a 2-1/2 week hiatus in responses from the OP the last time.

The 3tb drive was an over the counter drive that I installed. Hitachi. Not a fusion drive.

Sorry I have been working very long hours and don't get a lot of time to post.

 

[treekram]

The 3tb drive was an over the counter drive that I installed. Hitachi. Not a fusion drive.

Sorry I have been working very long hours and don't get a lot of time to post.

Questions are:

1) Did the iMac come with the Apple SSD?
2) How many partitions did you create on the 3TB drive? Was it formatted for HFS+ GUID? Or did you just put the drive in the system and it just worked?
3) In the old iMac, in the Finder, in the Devices list, other than "Remote Disc", how many items (not counting external drives) showed up in the list?
4) Do you still have the iMac - if so, does it still work and boot properly? What OS does it have (Snow Leopard, Mountain Lion, etc.)?

I misread the numbers in the TestDisk results so my guess that the partition it found could have been the recovery partition is wrong. The TestDisk results is saying it found a 4.2GB partition in the middle of the disk. That's odd.

 

[buywisdom]

Questions are:

1) Did the iMac come with the Apple SSD?

No it came with a 1TB HDD (not fusion) this is the late 2010 model.

2) How many partitions did you create on the 3TB drive? Was it formatted for HFS+ GUID? Or did you just put the drive in the system and it just worked?

I replaced the 1TB HDD with a 128 Gb SSD and added a 3 TB HDD. the 1 TB SSD only had apps and OS X while the 3 TB drive had everything else eg my pictures

3) In the old iMac, in the Finder, in the Devices list, other than "Remote Disc", how many items (not counting external drives) showed up in the list?

The machine running 10.9 did not boot and I got the following message see attached image. I think this answers question 4 too

 

[treekram]

Do you still have the SSD in the iMac? I think if you didn't have it there, a different error would come up.

If the SSD is still in there, from what I've read, there's a problem with the SSD and it's trying to run Internet Recovery but can't connect to a network. (So the cause of your SSD not booting is not the -1005F error.) Without knowing exactly what happened when, it appears that your SSD and HDD had problems at the same time. That would be very unusual.

Has somebody else helped you with setting up your machine, or upgrading to Mavericks or installing your disks? The reason why I ask is that while a fusion drive is something that Apple sells, it's something that can also be setup manually. But I think that doing so in Mavericks requires some work (unlike Yosemite, where one can almost accidentally create a fusion drive) and you would have known that you did it. Having a fusion drive is probably the best explanation of why the SSD and HDD now don't work and why the Data Recovery Utility program you ran came up with the results that it did. There could be other explanations of what's going on but it would be difficult to determine what that is without somebody there looking at the hardware and asking you questions about the history of what's been done to the computer.

This hasn't asked before - did you have an encrypted disk (File Vault)?

At this point, I think you should talk to the data recovery service. If you encrypted the disk, it's important that you tell them that. If you were the only one who setup the disks and did the OS upgrade to Mavericks, then you likely don't have a fusion drive. Otherwise, you want to find out if the person who helped you set up a fusion drive because that would be important for the data recovery service to know.

 

[ktuluslav]

I had exactly the same issue. Solved it by doing the following:

1. entered "pdisk /dev/disk1" instead of "pdisk /dev/rdisk1" (your disk # is likely to be different)
2. when entering "i" - on both lines about physical and logical block size I entered 4096 (it was showing "512"), after that the size of the disk in blocks was correctly displayed (instead of displaying "0 blocks" earlier)
3. entered "c" and created the partition (specifying the start block and size in blocks taken from TestDisk Analysis), then entered "w" to write the changes to the partition table. No errors posted to the screen.
4. Restarted the computer and the partition reappeared in the finder!

Thank you TestDisk!

Good luck!