-
All replies
-
Helpful answers
-
Mar 25, 2015 5:11 PM in response to Loner Tby Nosedragon,what do I choose?
PhotoRec 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
4 P MS Data 571383808 0 1 976773119 0 1 405389312 [BOOTCAMP]
To recover lost files, PhotoRec need to know the filesystem type where the
file were stored:
[ ext2/ext3 ] ext2/ext3/ext4 filesystem
>[ Other ] FAT/NTFS/HFS+/ReiserFS/...
-
Mar 25, 2015 5:47 PM in response to Nosedragonby Loner T,Choose NTFS. If this does not give you what you need, one option you have is to download the 7.0 version of Testdisk and scan once again.
-
Mar 26, 2015 12:29 AM in response to Loner Tby Nosedragon,I did one recovery..
my result was this:
PhotoRec 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
Disk /dev/rdisk0 - 500 GB / 465 GiB (RO)
Partition Start End Size in sectors
4 P MS Data 571383808 0 1 976773119 0 1 405389312 [BOOTCAMP]
265829 files saved in /Users/.../Documents/recup_dir directory.
Recovery completed.
You are welcome to donate to support further development and encouragement
http://www.cgsecurity.org/wiki/Donation
the recovered files are in total 53GB...which is not enough.
does it just recover files that were deleted?
-
Mar 26, 2015 3:49 AM in response to Nosedragonby Loner T,No. It should recover more, but file naming may be an issue.
-
Mar 26, 2015 12:47 PM in response to Loner Tby Nosedragon,with the new version...
PhotoRec 7.0-WIP, Data Recovery Utility, March 2015
Christophe GRENIER <grenier@cgsecurity.org>
Disk /dev/disk0 - 500 GB / 465 GiB (RO)
Partition Start End Size in sectors
4 P MS Data 571383808 0 1 976773119 0 1 405389312 [BOOTCAMP]
268995 files saved in /Users/....../Documents/Recov 1.1/recup_dir directory.
Recovery completed.
You are welcome to donate to support further development and encouragement
-
Mar 26, 2015 1:28 PM in response to Nosedragonby Loner T,Can you run Testdisk, not PhotoRec, to see if you see additional partition entries after the scan?
-
Mar 26, 2015 2:42 PM in response to Loner Tby Nosedragon,Yes I will...
what is the difference between
>Disk /dev/disk0 - 500 GB / 465 GiB (RO)
and
Disk /dev/rdisk0 - 500 GB / 465 GiB (RO)
which one is better to take?
-
Mar 26, 2015 3:00 PM in response to Nosedragonby Loner T,Use rdisk0. It is the raw disk which helps more granular IO to the disk for scanning purposes. The disk0 is a block device, which allows block-level access. Typically applications will use block IO.
-
Mar 27, 2015 12:01 AM in response to Loner Tby Nosedragon,these are the results...
same as the last!
TestDisk 7.0-WIP, Data Recovery Utility, March 2015
Christophe GRENIER <grenier@cgsecurity.org>
Disk /dev/rdisk0 - 500 GB / 465 GiB - 976773168 sectors (RO)
Partition Start End Size in sectors
P EFI System 40 409639 409600 [EFI]
D Mac HFS 409640 558397919 557988280
D Mac HFS 12125992 570114271 557988280
D MS Data 433719265 839163872 405444608
D MS Data 436503201 841947808 405444608
D Mac HFS 558397920 559667455 1269536
D Mac HFS 570114272 571383807 1269536
D MS Data 571326464 976771071 405444608
D MS Data 571383808 976773119 405389312
D MS Data 578531259 578537432 6174
D MS Data 578537432 578543605 6174 [Boot]
D MS Data 578537451 578543624 6174
D MS Data 578543624 578549797 6174 [Boot]
D MS Data 578543643 578549816 6174
D MS Data 578549816 578555989 6174 [Boot]
D MS Data 578555992 578558871 2880 [EFISECTOR]
D MS Data 578558872 578561751 2880 [EFISECTOR]
D Mac HFS 580316100 588704709 8388610 [ D^A]
D MS Data 608137196 608142955 5760
D Mac HFS 608816208 608816302 95
D Mac HFS 664010245 664010339 95
D Mac HFS 664977397 664977491 95
>D MS Data 786288772 786294531 5760
-
Mar 27, 2015 4:58 AM in response to Nosedragonby Loner T,Can you check these just for the sake of completeness?
D MS Data 436503201 841947808 405444608
D MS Data 571326464 976771071 405444608
D MS Data 571383808 976773119 405389312
-
Mar 27, 2015 2:57 PM in response to Loner Tby Nosedragon,1. can't open filesystem
2.
TestDisk 7.0-WIP, Data Recovery Utility, March 2015
Christophe GRENIER <grenier@cgsecurity.org>
MS Data 571326464 976771071 405444608
Directory /
>dr-xr-xr-x 0 0 0 12-Mar-2015 10:41 .
dr-xr-xr-x 0 0 0 12-Mar-2015 10:41 ..
3. can't open filesystem
-
Mar 27, 2015 3:14 PM in response to Nosedragonby Loner T,If we assume entry 2 to be the correct one, here is a table that I use to verify numbers.
GPT 3 Start GPT 3 Size GPT 3 End NTFS Start Sector Offset NTFS Size NTFS End Sector Offset (MB) 558397920 1269536 559667456 571326464 11659008 405444608 976771072 5,693 If you notice there is a ~5.6GB gap. Do you recall any resizing/repartitioning of Windows at any point in time? The following steps only manipulate the partition offsets. They do not change any other data on disk.
Leave your Testdisk display and start a new Terminal Window. Please use the following steps. If you see any error messages during the following steps, please stop and post back here with the error message. The following steps have values from your Testdisk output (and you can verify) in Steps 7 and 8.
Rebuild GPT4 using start/end offsets
- Sudo gdisk /dev/rdisk0
- P (print the full list of parts)
- D (delete)
- 4 (part 4)
- N (new part)
- 4 (part 4)
- 571326464 - Start offset in bytes (start point for Bootcamp part)
- +405444608 - (Size offset as opposed to End offset)
- 0700 (Windows part type)
- P (print list of all parts just to see what changes will be made)
- W (Write the new GPT)
- Y (Yes! really write the new GPT)
This will delete and re-write the GPT partition info for /dev/disk0s4.
Rebuild MBR to match the new GPT information thus resetting the Hybrid MBR. Use defaults for other questions (like partition codes). The only values that need modifications are the Boot flags and step 6. Accept all other defaults that Gdisk offers.
- Sudo gdisk /dev/disk0
- P (Print list of parts)
- R (Recover)
- H (chooses Hybrid)
- Partitions numbers to be hybridized: 2 3 4
- Y (Good for GRUB question)
- N (part 2 boot flag)
- N (part 3 boot flag)
- Y (part 4 boot flag make NTFS bootable partition)
- W (Write the new MBR)
- Y (Yes! write the new MBR)
- Reboot
Here is an example Q&A session with Gdisk (for the second set of Gdisk commands).
Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): Y
Creating entry for GPT partition #2 (MBR partition #2)
Enter an MBR hex code (default AF): Press Enter/Return
Set the bootable flag? (Y/N): N
Creating entry for GPT partition #3 (MBR partition #3)
Enter an MBR hex code (default AB): Press Enter/Return
Set the bootable flag? (Y/N): N
Creating entry for GPT partition #4 (MBR partition #4)
Enter an MBR hex code (default 07): 07
Set the bootable flag? (Y/N): Y
Test 1 - Does Bootcamp Volume show up in Finder?
Test 2 - Can you see files in Bootcamp Volume?
Test 3 - Can you select Bootcamp in System Preferences -> Startup Disk?
Test 4 - If Test 3 is successful, select Bootcamp and Click Restart.
-
Mar 27, 2015 4:09 PM in response to Loner Tby Nosedragon,Oh I am very sorry!!!
I totally forgot to tell that I changed partition size of the Macintosh Partition cause I read somewhere here that this might help...
but I didn't change it back so I have a small undefined part on my disk....
can I still do the procedure you explained?
-
Mar 27, 2015 4:13 PM in response to Nosedragonby Loner T,Yes, please. The 5GB gap is not much. The primary goal is to get your Windows back.
-