December 31, 2011

How to recover data from failed hard drive on OSX

Yesterday afternoon my data drive for OSX had it’s partition table destroyed by OWC’s Mercury Elite Pro hard drive enclosure. They did not mention that even if you decline the OSX initialize disk dialogue, you will still have your partition table over written. You see when you put your drive into this enclosure that hardware need to reformat your drive. You cannot just pop a drive in and enjoy. Thanks to the help of Testdisk, pDisk, and a wonderful tutorial from PerroHunter.com my hard drive was back up and running with about a half hour work of effort. I will outline the steps below, but if you are going to do this definitely check out PerroHunter.com‘s tutorial.

  1. Read through all of the directions below before starting the process. Plus I highly recommend checking out the more detailed tutorial from PerroHunter.com.
  2. Download Testdisk (Free software via Open Source GPL license)
  3. Connect the drive. I used a SATA to usb adapter.
  4. In OSX the dialogue that appears about initializing the drive, choose Ignore.
  5. Open Terminal and navigate to the location of where you downloaded Testdisk to.
  6. Run Testdisk as root. bash#sudo ./testdisk
  7. Choose [Create]. It creates a new log file.
  8. Select the disk you would like to operate on (up/down arrows). For me this was /dev/rdisk1. Press Enter to Proceed
  9. Select the disk partition table type. If you are on OSX, this should be “Mac”. Press Enter to Proceed.
  10. Choose Analyze to find partitions on the drive. Press Enter to continue.
    • An error will likely appear on the next screen saying “Bad MAC partition, invalid block0 signature read_part_mac: bad DPME signature. Do not worry about this.
  11. Press enter to perform a Quick Search.
    1. The following screen is going to tell you the relevant information on where the partition starts and stops. This will allow you to use pDisk to recreate the partition table. Testdisk cannot recreate the partition table as of the writing of this article. It will only allow you to find the information you need to fix the partition table.
    2. Here is an exanmple of the data the Quick Analysis should give you:
      Disk /dev/rdisk1 - 320 GB / 298 GiB - CHS 625142448 1 1
           Partition               Start        End    Size in sectors
      >P HFS                       409640  624880263  624470624
  12. Choose Quite to exit out of Testdisk.
  13. In a new Terminal window enter the command bash#sudo pdisk /dev/rdisk1
    • Replace “/dev/rdisk1” with the disk you choose on step 7.
    • You will likely be asked for you password once you hit enter.
  14. You should receive a warning about “No valid block  1 on ‘/dev/rdisk1/’ (or whatever disk you are performing this on)”, do not worry about this.
  15. Press “i” and Enter to confirm block size and some other information. As each line of information appears hit enter until you arrive back at “Command (? for help):”
  16. Hit “c” and Enter to start defining the new partition table. Note that the partition table will not be written until the end.
  17. Using the information from step 11, I am going to define the “First block” as “409640” per the “Start” heading from the output of Testdisk. Hit Enter to continue.
    • Remember the value 409640 is specific to my device, use the values you receive from Testdisk for your device.
  18. For the “Length in blocks” I will use “624470624” as defined in the “Size in sectors”  from Testdisk. Hit Enter to continue.
    • Remember the value 624470624 is specific to my device, use the values you receive from Testdisk for your device.
  19. Now enter a name for the partition. This is not reflected as the name of the drive in OSX. Because of this I chose the simple name “one”. Press Enter to continue.
  20. You should now be back at “Command (? for help):”.
  21. Press “w” and hit Enter to write the new partition table to the drive.  pDisk will ask you to confirm the operation before I writes the partition table.
  22. Quite pDisk. bash#quite
  23. If all goes as planned, your drive will show up shortly either on your Desktop or in Disk Utility. A reboot may be necessary.

Congratulations, you have just repaired a hard drive without paying someone a ton of money or buying expensive tools. If you have any questions feel free to comment below.

~Nathan

46 responses to “How to recover data from failed hard drive on OSX”

  1. Barry McDermid says:

    Hi Nathan,

    Thanks so much for posting this. I had a very similar problem also with OWC’s Mercury Elite Pro and my partition table being wiped. I changed the switch from RAID to span and that did it. Could not access my 2 drives at all.

    Anyway figured it was the partition table but your instructions especially with pdisk were spot on.

    Saved my bacon this did. Nice one.

    Barry

  2. Nathan Hein says:

    Just glad I can help someone else in the same situation Barry!

  3. Nathan Hein says:

    I just had the OWC enclosure destroy the partition again. These instruction worked even better the 2nd time through!

  4. Ross says:

    SOO close! My partition size is 3907022848 and the response I got was, “the map is not big enough.” This is a 2tb drive containing my entire iTunes library (movies and music etc)

    What can I do!? HELP! Thanks!!!

  5. Nathan says:

    What is saying “the map is not big enough”? Can you post some screenshots online?

  6. Ross says:

    Just saw your quick response. Thanks!

    Here is a screen snot. The black one is testdisk and the tan one is pdisk.

    https://www.dropbox.com/s/97rh710j60nhqep/pdisk%20attempt%20-%20RW%202013-03-23.png

    So nervous to lose everything on this drive. Going to make an off-site backup as soon as I get it repaired.

    Thank you!!!

  7. Andrey says:

    Thanks a lot! You’ve just saved for me 1 Tb of content!

  8. Nathan says:

    Glad I could help. I cannot even keep track of how many times I have been able to save hard drives using this technique to repair the partition table.

  9. andy says:

    How long does the quick search usually take?

  10. hoodwink says:

    Thank you so much! It’s been 3 years since my WD MyPassport failed to heartbeat! This saved me!

  11. Nathan says:

    Glad to help. I have saved many “dead” drives using Test Disk.

  12. Nathan says:

    It depends on the size of the drive. On a large drive I would give it a few hours just to be sure.

  13. Rusty says:

    Hi Nathan: Hoping you still check this post! I am getting the same error “the map is not big enough” when I use the “c” command and enter the start sector and sizes. I’m so close! How do I remedy that error? It is the same problem Ross had in pdisk. Please help!

  14. Nathan says:

    Rust,

    I have not encountered this issue and am not sure what the solution is. Please let us know if you are able to find a solution.

    Sorry,
    Nate

  15. Dan says:

    Current version of TD says it detects an EFI format and gives me:

    Disk /dev/rdisk3 – 4000 GB / 3726 GiB – 3519069872 sectors
    Partition Start End Size in sectors
    >P EFI System 40 409639 409600 [EFI]
    P Mac HFS 409640 7813774983 7813365344

    and pdisk doesn’t seem happy once I enter any combination of these. Advice?

    iMac 10.6.8 Core 2 Due
    repairing an external firewire drive (4 TB) with a single partition.
    perhaps this cannot handle 4 TB disks?

  16. Ted says:

    Hello,
    Thanks for the information about partition repair. I’m simply trying to recover deleted files.
    I’m a relatively nontechnical guy who’s trying to figure out TestDisk and PhotoRec.
    Using PhotoRec, when I get to the point of having to choose the directory to save recovered files to, I’d like to choose an external hard disk. But I don’t know how to identify it in the list PhotoRec offers (seems to be a Unix description) and it looks to me like the external drive isn’t in the list. Can you tell me how to specify the drive/directory I want to recover to? Thanks!

    /Users/tgreenwald/Desktop/Screen shot 2013-12-04 at 8.17.18 AM.png

  17. Mark says:

    Nathan,

    Thanks for this outstanding guide!

    I’ve run testdisk on my HFS (or HFS+, can’t remember) and come up with this:

    START END SIZE IN SECTORS
    0 0 1 3907029167 0 1 3907029168

    Based on your guide, should I use “1” as the first block? This is a single partition drive. Since my output from testdisk looks slightly different from yours, I wanted to be sure I’ve got the right values.

    Thanks again for your help. Sent the drive to some local “experts” who couldn’t find anything on it. I’m hoping your solution works.

    mark

  18. Mark says:

    Okay, ran Testdisk again and now am getting the following:

    START________________END__________SECTORS
    3907010120______3907021039_________10920

    I had gotten this result before, but ignored it as the drive has only one partition on it (unless this is a “hidden” partition created by WD).

    Any advice? Should I use the above numbers in pdisk or should I use a START value of 0 0 1?

    I think the implications of getting it wrong are that I will not be able to access the files on the drive (which I can’t do right now anyway).

    What I would also like to know is whether I can try both values without endangering the files I have.

    Thanks again for any assistance you can provide.

    Mark

  19. Fabien Demangeat says:

    Thank you soooooo much for you post !!!

  20. John Bader says:

    Hi Nathan,

    we are very grateful to you for your guidance!
    In using the programs TestDisk and pdisk I, as a MAC layman, could restore with your help and God’s help, an external partition of a good friend with many important data, where other tools failed miserably!

    Best wishes and God’s blessings
    John

  21. Nathan says:

    Thank you John, I am glad I could help.

    God bless!

  22. Mike says:

    THANK YOU!!!!

    I tried to read some files on my PC from a 500gb External WD formatted for Mac. In trying to get the PC to read the disk, I accidentally initialized the drive on the PC thus rewriting the partition. It showed no files whatsoever neither on my PC or my Mac.

    I encountered a different scenario on mine than most others. After hitting enter on step 13 I received,

    map already exists
    do you want to reinit? [n/y]:

    I double checked that I had chosen and written the correct drive (in my case it was dev/rdisk1) and selected “Y”.
    After entering “Y”, the rest of the steps are exactly the same.

    After step 21 it will show a warning that it is going to write over the existing. I selected “Y” and after writing “quit” on test disk my drive popped up on the desktop!

    I followed the perrohunter tutorial for the testdisk portion and this tutorial for the rest. This was pretty straight forward and saved my drive!!!!!!

  23. Tino says:

    i also have the problem “the map is not big enough” – what can i do?

  24. JIJISAN says:

    In trying to redefined the sectors on pDisk, I keep getting “requested base and length is not within an existing free partition.” What did I miss. I’ve tried several times and keep getting the same problem. This happens even if I set the size to the testdisk result.

  25. Raghav T. says:

    Hi, JIJISAN
    I am having the same problem as you are. I am entering the values taken from TestDisk and they give me requested base and length is not within an existing free partition. TestDisk START: 1, LENGTH: 490234751. Also in TestDisk my deleted partition shows as unknown format. The i use TestDisk to change it to HFS for mac running on puppy linux live usb. After I click continue in TestDisk it tells me to use terminal in mac recovery. Please help urgently. Need help for my important data.

  26. Jay says:

    I am having the same “requested base and length is not within an existing free partition” problem as JIJISAN and Raghav.

  27. Daniel says:

    it is that normal?:

    sudo pdisk /dev/rdisk2
    pdisk: Can’t read block 0 from ‘/dev/rdisk2’

  28. Fred says:

    Hi Nathan, thanks for sharing your expertise. Everything runs smoothly until step 19. I get “the map is not big enough”. What can I do?
    Thank you!
    Fred

  29. Moritz says:

    you saved my live/sd-card with 3-weeks-holiday-photos.

    muchas gracias from germany!

  30. Nathan says:

    Glad I could help. Data loss is lame. I use this guide myself about twice a year to recover and fix drives. 🙂

  31. Stephanie says:

    Hi there,
    I am having trouble with my mac external disk. The thing is that I tried to follow your instructions but I have my Test disk that gives me two sectors :
    Partition Start End Size in sectors
    >P Mac HFS 51205 121937948 121886744
    P Mac HFS 121937949 122096640 158692

    How should I deal with it at the pDisk step? Obviously I could try things out but as it is a question of data I prefer to ask you first. I saw I can make the first one work out but then they don’t ask for the second partition only ask if I accept to map.

    Thanks a lot for the help by the way.

  32. Martin says:

    Hi,

    Great article on how to fix a broken disk but Im experiencing issues when writing created partitions

    after selecting w, and then p to show recently created partition it looks fine
    Partition map (with 512 byte blocks) on ‘/dev/rdisk0’
    #: type name length base ( size )
    1: Apple_partition_map Apple 63 @ 1
    2: Apple_Free Extra 409576 @ 64 (200.0M)
    3: Apple_HFS One 488555312 @ 409640 (233.0G)
    4: Apple_Free Extra 1269800 @ 488964952 (620.0M)

    but if I exit and enter again to pdisk, it shows not partitions as I havent done anything

    artition map (with 512 byte blocks) on ‘/dev/rdisk0’
    #: type name length base ( size )
    1: Apple_partition_map Apple 63 @ 1
    2: Apple_Free Extra 490234688 @ 64 (233.8G)

    Any Idea why its not saved?

    Thanks

  33. Monoroy says:

    My first time to use TERMINAL, since My backup Drive cannot be read (3T, Buffalo External).

    I follow those steps, but keep on ask me password, so I cannot process down…..

  34. Nathan says:

    The password it is asking for is the main “root” password that was given when OSX was installed.

  35. Stefan says:

    Does the pdisk fix require another drive to be stored over to or does it simply repair on same storage space ?

  36. Nathan says:

    It repairs the disk in it’s current location. No second disk is required.

    That being said, duplicating the drive at a low level is a good precaution to take before modifying you broken drive in case things go wrong.

  37. Kecia says:

    How long does it take to finish the Quick Search? In my case, the terminal seems to be stuck with the columns (partition Start End Size in sectors) but with no values..

    Does anyone know the answer?

    Thanks.

  38. Nathan says:

    It will depend on the size of the drive. If it has ran for hours and it is still not completing, there is a problem.

  39. eva says:

    Hello, I have the same problem, Quick Search has ran during 3 hours and nothing happen. In my case I have problems with WD my passport. Any advice?

    Thanks,

  40. Mehdi R says:

    Absolute star! This has saved me so much work for my customers data recovery. Fantastic that you’ve taken the time to write this. Can i link this to my blog?

  41. Nathan says:

    Certainly.

  42. Hey gang… Testdisk has been analyzing for three days now and it’s over 200%. It wouldn’t quick search because it found a bad partition. Should I let it do its thing or am I going down a rabbit hole? Thanks for any guidance.

  43. Mike Scholz says:

    I had so many chats with data security guys but no one could help me. I’m so happy that I found your post. It was all over after 10 minutes. Thank you Nathan!!!

  44. Nathan says:

    Glad I could help. 🙂

  45. AmitK says:

    Hi Nathan,

    Following is what I get on terminal, unsure what to do Please help-
    ==========================================
    TestDisk 7.1-WIP, Data Recovery Utility, November 2017
    Christophe GRENIER
    https://www.cgsecurity.org

    Disk /dev/disk3 – 1000 GB / 931 GiB – 1953458176 sectors (RO)
    Current partition structure:
    Partition Start End Size in sectors

    Bad MAC partition, invalid block0 signature
    read_part_mac: bad DPME signature
    ===============================

    Please help

    Thanks in advance
    Amit

  46. AmitK says:

    So in the meantime, I moved forward and now stuck at
    ===============================
    sudo pdisk /dev/rdisk2
    pdisk: Can’t read block 0 from ‘/dev/rdisk2’
    Edit /dev/rdisk2 –
    Command (? for help): i
    A physical block is 512 bytes:
    A logical block is 512 bytes:
    size of ‘device’ is 0 blocks (512 byte blocks):
    what should be the size?

Leave a Reply

Your email address will not be published. Required fields are marked *