| View previous topic :: View next topic |
| Author |
Message |
falko
Apprentice
Joined: 03 Dec 2004
Posts: 242
Location: Rovereto (TN) Italy
|
 Posted: Thu Jan 28, 2021 9:08 pm Post subject: Recover HFS (mac) partitions |
 |
|
Hi,
I have to try to recover a disk where the partitions are lost or damage (without any delete or other operations).
The disk had no physical damage.
I found
| Code: | app-admin/testdisk
sys-fs/hfsutils
sys-fs/hfsplusutils |
The disc isn't mine, so before I do anything I'd like to be sure, I don't want to lose data!.
Which is the best tool that I could use to restore the partitions.
Thanks in advance
_________________
Io non sarò mai nessuno ma... nessuno sarà mai come me. (Jim Morrison)
A ciacere no se sgonfa done
Gentoo on: Lenovo R500 |
|
| Back to top |
|
 |
Buffoon
Veteran
Joined: 17 Jun 2015
Posts: 1369
Location: EU or US
|
| Posted: Thu Jan 28, 2021 9:33 pm Post subject: |
|
|
| You do not want to lose data. Then take a full image of disk before you do anything else, yes you need a larger disk for that. You can work on that image instead of real disk. However, you talk about restoring partitions and then mention HFS tools ... HFS is filesystem, not partition ... There is some basic knowledge required. You sure you know what you are doing? |
|
| Back to top |
|
|
falko
Apprentice
Joined: 03 Dec 2004
Posts: 242
Location: Rovereto (TN) Italy
|
| Posted: Thu Jan 28, 2021 9:47 pm Post subject: |
|
|
| Buffoon wrote: | | You do not want to lose data. Then take a full image of disk before you do anything else, yes you need a larger disk for that. You can work on that image instead of real disk. However, you talk about restoring partitions and then mention HFS tools ... HFS is filesystem, not partition ... There is some basic knowledge required. You sure you know what you are doing? |
Ok.. thanks for your reply I use a wrong word. 
When I use fdisk, it doesn't find the partitions.
When I analize with testdisk it found two hfs
When I analize with hfsutils it ask me if i would fix it
_________________
Io non sarò mai nessuno ma... nessuno sarà mai come me. (Jim Morrison)
A ciacere no se sgonfa done
Gentoo on: Lenovo R500 |
|
| Back to top |
|
|
Buffoon
Veteran
Joined: 17 Jun 2015
Posts: 1369
Location: EU or US
|
| Posted: Thu Jan 28, 2021 9:58 pm Post subject: |
|
|
| If the partition table was destroyed then gdisk or some other partitioning tool may be able to restore it using backup, the partition table macOS is using is GPT and older versions of fdisk cannot handle it. If there are no valid backups of GPT then testdisk can make very intelligent guesses about it. I doubt hfsutils can restore lost partition table. But then again, was the partition table lost or the damage was done only to the filesystem? You need to know what is broken before you start fixing it ... |
|
| Back to top |
|
|
falko
Apprentice
Joined: 03 Dec 2004
Posts: 242
Location: Rovereto (TN) Italy
|
| Posted: Thu Jan 28, 2021 10:15 pm Post subject: |
|
|
Ok thanks,
I underestand. I found the disk with no partitions, I guess the problem is the partition table.
I could try with gdisk?
_________________
Io non sarò mai nessuno ma... nessuno sarà mai come me. (Jim Morrison)
A ciacere no se sgonfa done
Gentoo on: Lenovo R500 |
|
| Back to top |
|
|
NeddySeagoon
Administrator
Joined: 05 Jul 2003
Posts: 54317
Location: 56N 3W
|
| Posted: Thu Jan 28, 2021 10:56 pm Post subject: |
|
|
falko,
First of all, make a disk image with ddrescue. The image can be in a file.
Never work with your only copy.
Testdisk will have given you a partition table that it would write, if you let it. Do not do that. It can make a bad situation worse.
Never write to the only copy.
Make a note of the start of all the partitions that testdisk finds. There are often a number of false positives.
The partion table is not required to mount the filesystems in the partitions that it used to contain. Its just a set of pointers.
Read man mount, you need to use | Code: | | -o ro,offset=<bytes> /dev/sd<whole_drive> |
where offset= the the count of the number of bytes to the partition start.
You get to calculate offset= from the start sector that testdisk gave you.
You can do all this with your disk image in a file, as a file can be treated as a block device with loopback support in the kernel.
Practice on a USB stick, where you can use fdisk to see the partition table, in sectors. You cannot afford off by 1 errors, so you need to know your method is correct before you start.
Oh, before you do anything else, make a backup, or two if you are paranoid.
Once you are sure that the filesystems are OK you can recreate the partition table.
If the filesystem is journaled, even a ro mount can trigger a journal replay. If the filesysem is damaged, a journal replay can make a bad situation worse.
You will need a backup to be able to test that, or recover from it, when the journal replay trashes what's left of the filesystem.
_________________
Regards,
NeddySeagoon
Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail. |
|
| Back to top |
|
|
falko
Apprentice
Joined: 03 Dec 2004
Posts: 242
Location: Rovereto (TN) Italy
|
| Posted: Fri Jan 29, 2021 7:32 am Post subject: |
|
|
| NeddySeagoon wrote: |
The partion table is not required to mount the filesystems in the partitions that it used to contain. Its just a set of pointers.
Read man mount, you need to use | Code: | | -o ro,offset=<bytes> /dev/sd<whole_drive> |
where offset= the the count of the number of bytes to the partition start.
You get to calculate offset= from the start sector that testdisk gave you.
|
Thanks, I didn't know that!
| NeddySeagoon wrote: |
If the filesystem is journaled, even a ro mount can trigger a journal replay. If the filesysem is damaged, a journal replay can make a bad situation worse.
You will need a backup to be able to test that, or recover from it, when the journal replay trashes what's left of the filesystem. |
This is very interesting, I never would have thought that
_________________
Io non sarò mai nessuno ma... nessuno sarà mai come me. (Jim Morrison)
A ciacere no se sgonfa done
Gentoo on: Lenovo R500 |
|
| Back to top |
|
|
|
Other Things Gentoo
