HFS partition recov...
 
Notifications
Clear all

HFS partition recovery using TestDisk and gpt (OS X)

2 Posts
2 Users
0 Likes
898 Views
ArsenalConsulting
(@arsenalconsulting)
Posts: 49
Eminent Member
Topic starter
 

Hello all,

I had a very important HFS partition to recover from an external 3TB hard drive recently… it was a bit of a hassle, so I'm going to document my workflow here in case it helps others. Please feel free to jump in if anyone has thoughts on how to do this more efficiently!

Here are some TestDisk screenshots… I think for the most part they are self explanatory. I called the raw disk image (dd) obtained from the external 3TB hard drive "zackwusb3.dd4.001."








(Update - apparently the in-line images above are not being displayed in some browsers. Here are external links to the images

Screenshot 1
Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5
Screenshot 6
Screenshot 7
Screenshot 8)

At this point I have the boundaries of the lost HFS partition.

The next step was to attach the raw disk within "zackwusb3.dd4.001" on OS X. By default, OS X will not attach disk images that it thinks lack file systems. In the attach command below you will see I used the "-nomount" option which forces OS X to attach the disk image even though it will not find any file systems within it

sudo hdiutil attach -imagekey diskimage-class=CRawDiskImage -nomount /Volumes/4TB/zackwusb3.dd4.001

Now that the "disk" is attached (as /dev/disk3), time to create an HFS partition using the boundaries I got from TestDisk earlier (note, I had to use the "-f" option as gpt did not like the fact that an MBR existed on this disk)

sudo gpt create -f /dev/disk3
sudo gpt add -b 262656 -s 5860203968 -t hfs /dev/disk3

Next, I reattach the disk without the "-nomount" option… because, in theory, OS X will now see an HFS partition in the attached disk

sudo hdiutil attach -imagekey diskimage-class=CRawDiskImage /Volumes/4TB/zackwusb3.dd4.001

At this point I was finally able to access the HFS partition on OS X and copy everything I needed out of it.

Mark Spencer, President
Arsenal Consulting, Inc.
www.ArsenalExperts.com

 
Posted : 09/02/2014 9:31 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Here are some TestDisk screenshots…

Boy, do I hate these Romulan cloaking devices …. roll

wink

jaclaz

P.S. To clear the above, my Opera does not display those screenshots.
Srware Iron (Chromium based) OK, screenshots visible.
Opera (the "real" one, Presto Engine, v. 12.x) NO screenshots
Mozilla Firefox (latest) OK, screenshots visible.

 
Posted : 09/02/2014 9:37 pm
Share: