14 Replies Latest reply: Jan 17, 2013 9:08 PM by MrElvey
MrElvey Level 1 (25 points)

(Yes, I've  googled a bunch and read threads like this one already.)

 

What can I use - gpt or some other tool - to recreate/unerase a partition table and effectively undo an unintentional disk erasure completely?  That is, how can I rebuild a disk's GPT/GUID partition table?)  I don't want to do the file scavenging type recovery.  I didn't do a secure delete, so I think all the actual partitions are still there, undamaged.

 

What happened: Instead of erasing a single partition off a disk with many partitions, the entire partition table was erased (using Disk Utility, w/o deleting the underlying files).  Somehow the "Erasing a disk deletes all data on all its partitions." warning message was missed.

 

I have a copy of the output of df, with the number of blocks in each partition, from just prior to the erasure, so I should be able to recreate the GPT/GUID partition table.  Editing the GPT with a hex editor is not feasible.  Simply recreating the partitions with Disk Utility will overwrite the key filesystem tables on each partition, and I don't want to do that, plus Disk Utility doesn't allow me to specify exact partition sizes anyway.

Surely there's an app for rebuilding the partition table (other than emacs' hexl-mode!) for recreating/unerasing a partition table when the partition sizes and orders are known?  I've looked at the advertising for a bunch of recovery software and none of them clearly indicate that they will do what I want. 

 

I guess I can try using gpt on a copy of the reformatted drive I've made with dd, and see what happens.  But perhaps someone knows of a tool that should do what I need, or knows if gpt is that tool or not.

 

There are answers and tools that will do FILE recovery - search for files and recover the ones that aren't fragmented or deleted.  As far as I can find, they just look for files on the disk, and don't pay much, if any attention to the filesystem info or directory heirarchy, which in this case is valuable.  Of course I could send it in to DriveSavers, or the like.  But none of that seems necessary, and the scavenging file recovery apps won't do the job well,

E.g. some are mentioned here:

 

Thanks for any help.

 

The links in this post are to pages describing the underlined term, e.g. the man pages for df and gpt.


OS X Mountain Lion (10.8.2), SSD, USB, FireWire, external drives
  • macjack Level 9 (51,622 points)

    Your best shot at recovery is  Prosoft Data Rescue  There is a free trial to see if it can recover what you need. But don't do another process on that drive until you've downloaded and run it.

     

    To format the disk boot up holding command-r keys into your Recovery Volume.

    The screen should give you these choices...

     

    Restore from TM backup

    Reinstall Mac OS X

    Get help online

    Disk Utility

     

    Choose Disk Utility > Choose your HDD > Choose the Partition tab and make it Mac Extended Journaled.

    You can then recreate the partitons by dragging or entering the actual size in GB.

  • MrElvey Level 1 (25 points)

    Maybe I should have been clearer.  I wrote,

      I didn't do a secure delete, so I think all the actual partitions are still there, undamaged.

    I also wrote,

      Simply recreating the partitions with Disk Utility will overwrite the key filesystem tables on each partition, and I don't want to do that.

    and yet you gave me instructions on how to to exactly what I said I don't want to do - instructions that would destroy my data.

     

    It really seems like you're a spammer promoting Prosoft Data Rescue.   Since you didn't seem to read my post, I think it's a long, long shot.  But I'll take a look.

  • Barney-15E Level 8 (46,274 points)

    and yet you gave me instructions on how to to exactly what I said I don't want to do - instructions that would destroy my data.

     

    But don't do another process on that drive until you've downloaded and run it.

    Hmmm.

  • MrElvey Level 1 (25 points)

    Your point, Barney? 

    He also said:

     

    Choose Disk Utility > Choose your HDD > Choose the Partition tab and make it Mac Extended Journaled.

    You can then recreate the partitons by dragging or entering the actual size in GB.

     

    Hmmm, indeed.

     

    It seems like macjack has given lots of good advice, and Level 8 and all.  But bad advice is bad advice, even if preceeded by other (questionable) advice.

  • macjack Level 9 (51,622 points)

    I'm suggesting that utility because it's been known to work where others have failed. I couldn't care less if you use it or not. I have no skin in the game. I'm just trying to help.

     

    Just what you don't want to do is probably your only option here, if you can't recover the files.

     

    I thought you were selling DriveSavers!

  • Barney-15E Level 8 (46,274 points)

    MrElvey wrote:

     

    Your point, Barney? 

    He also said:

     

    Choose Disk Utility > Choose your HDD > Choose the Partition tab and make it Mac Extended Journaled.

    You can then recreate the partitons by dragging or entering the actual size in GB.

     

    Hmmm, indeed.

     

    It seems like macjack has given lots of good advice, and Level 8 and all.  But bad advice is bad advice, even if preceeded by other (questionable) advice.

    His advice was to use a data recovery tool, and do absolutely nothing else prior. Sounds like pretty good advice.

    Once you've completed that task, you'll need to reformat the drive.

    I'm not sure why all of that is confusing to you.

  • Linc Davis Level 10 (192,151 points)

    ...or knows if gpt is that tool or not.

     

    It's not. Creating a new partition table with the same size partitions as the one you deleted, which is all you can do with gpt, won't cause the data to magically reappear. You'll have a partitioned empty drive, and less chance of recovering anything than you have now.

     

    Data recovery is a job for experts. You mentioned DriveSavers. If the lost data is worth to you what they charge, pay it.

  • johnl927 Level 3 (565 points)

    You might want to look into this and give it a try to recover your partition table on your Mac, click here and its free

  • MrElvey Level 1 (25 points)

    Correction/clarification to my initial post:

    MrElvey wrote:

    ...
    I didn't do a secure delete, so I think all the actual partitions are still there, undamaged.

     

    What happened: Instead of erasing a single partition off a disk with many partitions, the entire partition table was erased (using Disk Utility, w/o deleting the underlying files).  Somehow the "Erasing a disk deletes all data on all its partitions." warning message was missed.

    Well, so the new partition table would have totally overwritten the old table.

    But a small correction: The in addition single new partition would have overwritten the first 3 sectors of the first partition, and several sectors after that.  But I don't care about that partition (and if I did, its Alternate Volume Header is likely still in good shape.  The first partition I care about is disk2s5.  The Alternate Volume Header of the last partition is likely overwritten too.  But its Volume Header should be fine.

     

    The  output of df from the erased drive (from before it was erased) was:

     

    Filesystem512-blocksUsed Available CapacityMounted on
    /dev/disk2s2 276915120 2664294321048568897%/Volumes/Partition I do not care about
    /dev/disk2s339955240  13815239817088 1%/Volumes/Ditto this is empty
    /dev/disk2s526946688  2618045676623298%/Volumes/GB-I quite want the contents of this partition.
    /dev/disk2s613491664  6161613430048 1%/Volumes/This is empty too
    /dev/disk2s1197763840  585952003916864060%/Volumes/Partition I care a little about
    /dev/disk2s1094348072  774862721686180083%/Volumes/F-I quite want the contents of this partition.
    /dev/disk2s9 524487280 4608528246363445688%/Volumes/M-I quite want the contents of this partition.
    /dev/disk2s8 524487280 4764230804806420091%/Volumes/TM-Partition I care a little about
    /dev/disk2s7 351615760 351615760 0100%/Volumes/N-I quite want the contents of this partition.

     

    Oh, and the answer to "Q: Can I recover files that I accidentally deleted, or from a reformatted Mac hard drive [with Data Rescue 3]?"

    at http://www.prosofteng.com/products/data_rescue.php weakly suggests Data Rescue 3 does NOT do what I want. 

  • MrElvey Level 1 (25 points)

    macjack wrote:

     

    I'm suggesting that utility because it's been known to work where others have failed. I couldn't care less if you use it or not. I have no skin in the game. I'm just trying to help.

     

    Just what you don't want to do is probably your only option here, if you can't recover the files.

     

    I thought you were selling DriveSavers!

        Fair enough.  I'll give 'em a call in the morning.  (Prosoft, not drivesavers, LOL!) 
     

  • MrElvey Level 1 (25 points)

    By the way, since this fiasco, I've created and set up some code to periodically back up the partition tables of every attached drive on a system.  Cheap insurance.  I'm not aware of any apps that that do that (other than the ones that image and entire drive - including, of course, its partition table). 

  • MrElvey Level 1 (25 points)

    It looks like a tool like this could be  indispensable to a lot of folks - e.g.  James Pond's excellently written pondini.com article, How do I restore my entire system? says,

     

    "(If any of your user home folders were on a separate internal HD or partition, be sure the new disk(s) are set up the same way.)"


    Easier said than done!!

  • MrElvey Level 1 (25 points)

    Linc Davis wrote:

     

    ...or knows if gpt is that tool or not.

     

    It's not. Creating a new partition table with the same size partitions as the one you deleted, which is all you can do with gpt, won't cause the data to magically reappear. You'll have a partitioned empty drive, and less chance of recovering anything than you have now,

    Everything I've read about partition tables (including partition tables) says you're mistaken - that is, creating a new partition table with the same size partitions as the one you deleted, and identical in terms of  which is all you can do with gpt, won't cause the data to magically reappear.  Let's see if I can prove one of us wrong.

  • MrElvey Level 1 (25 points)

    Aha! 

     

    "Partition table recovery using TestDisk is really easy." - http://www.cgsecurity.org/wiki/TestDisk

     

    SOLVED!  (Well, we'll see, but I think so...)

     

     

    (This is confirmed by other documentation, e.g.

     

    TestDisk can find lost partitions for all of these file systems:

    • HFS, HFS+ and HFSX, Hierarchical File System
      and

    http://www.cgsecurity.org/wiki/Data_Recovery_Examples#Disk_geometry_problem_-_Wh en_all_partitions_are_deleted .


    I knew it was out there.