14 Replies Latest reply: Jan 17, 2013 9:08 PM by MrElvey
MrElvey Level 1 Level 1 (25 points)

(Yes, I've  googled a bunch and read threads like this one already.)

 

What can I use - gpt or some other tool - to recreate/unerase a partition table and effectively undo an unintentional disk erasure completely?  That is, how can I rebuild a disk's GPT/GUID partition table?)  I don't want to do the file scavenging type recovery.  I didn't do a secure delete, so I think all the actual partitions are still there, undamaged.

 

What happened: Instead of erasing a single partition off a disk with many partitions, the entire partition table was erased (using Disk Utility, w/o deleting the underlying files).  Somehow the "Erasing a disk deletes all data on all its partitions." warning message was missed.

 

I have a copy of the output of df, with the number of blocks in each partition, from just prior to the erasure, so I should be able to recreate the GPT/GUID partition table.  Editing the GPT with a hex editor is not feasible.  Simply recreating the partitions with Disk Utility will overwrite the key filesystem tables on each partition, and I don't want to do that, plus Disk Utility doesn't allow me to specify exact partition sizes anyway.

Surely there's an app for rebuilding the partition table (other than emacs' hexl-mode!) for recreating/unerasing a partition table when the partition sizes and orders are known?  I've looked at the advertising for a bunch of recovery software and none of them clearly indicate that they will do what I want. 

 

I guess I can try using gpt on a copy of the reformatted drive I've made with dd, and see what happens.  But perhaps someone knows of a tool that should do what I need, or knows if gpt is that tool or not.

 

There are answers and tools that will do FILE recovery - search for files and recover the ones that aren't fragmented or deleted.  As far as I can find, they just look for files on the disk, and don't pay much, if any attention to the filesystem info or directory heirarchy, which in this case is valuable.  Of course I could send it in to DriveSavers, or the like.  But none of that seems necessary, and the scavenging file recovery apps won't do the job well,

E.g. some are mentioned here:

 

Thanks for any help.

 

The links in this post are to pages describing the underlined term, e.g. the man pages for df and gpt.


OS X Mountain Lion (10.8.2), SSD, USB, FireWire, external drives