TestDisk and PhotoRec for Mac OS X Data Recovery

Comments

1. test disk guru says:
   October 18, 2009 at 02:12

   OS X (Intel)

   New Mac including MacBook and Mac Pro have an Intel CPU and HardDisk is partionned by default using EFI partition table. TestDisk & PhotoRec handle EFI since version 6.9, so you can use them to recover your data.
   OS X (PowerPC)

   Starting TestDisk or PhotoRec
   Open the Terminal program, found in the /Applications/Utilities folder.
   Using terminal commands such as cd (change directory), navigate to the folder where you downloaded or installed TestDisk.
   The only sure-fire way of doing this is typing cd(space) and then dragging the folder containing TestDisk into the Terminal window. This will copy the location of the TestDisk directory after the current command on the terminal command line.
   If you have the TestDisk folder on your desktop, the command would look something like: cd ~/Desktop/testdisk-6.4
   Move into the folder inside the TestDisk folder, where the binary executables are stored (in darwin/ on OS X ports). The command for this would look something like: cd darwin.
   Now it’s time to run TestDisk (or PhotoRec). To do this, type sudo ./testdisk (or sudo ./photorec). The sudo command tells your system to run testdisk as root (“administrator”, or superuser). You will be required to enter your password (no echo of the characters will be apparent on the screen), press the enter key to validate .
   Using TestDisk
   Upon startup, the following will appear. Highlight the disk of interest and hit return/enter to select it.
   Select a media (use Arrow keys, then press Enter):
   Disk /dev/disk0 – 80 GB / 74 GiB – CHS 156301488 1 1 (RO), sector size=512
   Disk /dev/disk1 – 250 GB / 232 GiB – CHS 488397168 1 1, sector size=512
   Disk /dev/rdisk0 – 80 GB / 74 GiB – CHS 156301488 1 1 (RO), sector size=512
   Disk /dev/rdisk1 – 250 GB / 232 GiB – CHS 488397168 1 1, sector size=512

   Once the disk of interest is selected, you must tell TestDisk what type of partition table to expect. For OS X users, this is probably the [Mac ] option.
   Disk /dev/rdisk1 – 250 GB / 232 GiB – CHS 488397168 1 1
   Please select the partition table type, press Enter when done.
   [Intel ] Intel/PC partition
   [Mac ] Apple partition map
   [None ] Non partioned media
   [Sun ] Sun Solaris partition
   [XBox ] XBox partition
   [Return ] Return to disk selection

   At this point, you should analyze the disk to see if TestDisk can determine the partion map to replace the possibly-corrupted version on the drive. Select [ Analyse ] from the menu and hit return/enter.
   Disk /dev/rdisk1 – 250 GB / 232 GiB – CHS 488397168 1 1
   [ Analyse ] Analyse current partition structure and search for lost partition
   [ Advanced ] Filesystem Utils
   [ Geometry ] Change disk geometry
   [ Options ] Modify options
   [ Quit ] Return to disk selection

   The following screen will appear, allowing you to tell TestDisk if the partitions are “Primary” or “Deleted” partitions. I’m not sure if it’s critical to mark any as “D” — I believe they default to “P”. Select proceed, and hit return/enter.
   Current partition structure:
   1 P partition_map 1 63 63
   2 P Free 64 262207 262144
   3 P HFS 262208 162267199 162004992
   4 P Free 162267200 162529343 262144
   5 P HFS 162529344 324534335 162004992
   6 P Free 324534336 324796479 262144
   7 P HFS 324796480 488397151 163600672

   P=Primary D=Deleted

   [Proceed ] [ Save ]

   After analyzing, a screen will appear, informing you of the partitions that were found (the partitions will be colored green). Hit return/enter to return to the display of all the partions found, which looks something like the screen below. You will need to copy/print this information for later, as it will be required for rewriting the partion table using pdisk. ‘Copying to a text file is recommended, as partitioning your drive incorrectly could cause further problems. Once copied, select [ Quit ] and exit TestDisk.
   Current partition structure:
   Partition Start End Size in sectors
   1 P partition_map 1 63 63
   2 P Free 64 262207 262144
   3 P HFS 262208 162267199 162004992
   4 P Free 162267200 162529343 262144
   5 P HFS 162529344 324534335 162004992
   6 P Free 324534336 324796479 262144
   7 P HFS 324796480 488397151 163600672

   [ Quit ] [ Write ]
   Now you can use this information with pdisk to rewrite your drive partition map.
   Repairing/Rewriting Your Drive’s Partition Map
   To rewrite the partition map given by TestDisk, use the command pdisk. If pdisk reports, “No partition map exists,” it may be necessary to initialize the disk. Once the disk is initialized, the numeric entries defining the partition may completed and a name may be assigned to the partition (“rec_part” in the example below). Given the following information from TestDisk,
   Disk /dev/rdisk1 – 160 GB / 149 GiB – CHS 312581808 1 1
   Partition Start End Size in sectors
   P HFS 262208 312581791 312319584
   Start pdisk: sudo pdisk /dev/rdisk1
   In this example, the required pdisk commands are:
   pdisk: No valid block 1 on ‘/dev/rdisk1′
   Edit /dev/rdisk1 -
   Command (? for help): c
   No partition map exists
   Command (? for help): i
   Command (? for help): c
   First block: 262208
   Length in blocks: 312319584
   Name of partition: rec_part
   Command (? for help): w
   Command (? for help): q
   Consult pdisk help for more information.
   Note: pdisk is for Mac PowerPC partition table, not for Mac Intel partition table.

   GD Star Rating
   loading...

   GD Star Rating
   loading...
2. test disk guru says:
   October 18, 2009 at 02:15

   be careful about partioning and formating… it is very dangerous and/or more dangerous than wintel platform… recovery is not easy and these programs must be used very carefully. Full Unix environment is harder but if you know what you doing results are more positive.

   I recommend testdisk, data rescue 3 programs for any partition recovery if not succeded use data rescue 3 for file recovery.

   GD Star Rating
   loading...

   GD Star Rating
   loading...

Speak Your Mind Cancel reply