Is it possible to recover a formatted macOS partition

Backstory: After I went to the Apple Store today, the drive in my Mac was wiped by an employee as I was supposed to have it replaced. The replacement unit had an issue though, so they gave me my old machine back with the SSD already reset to factory.

As the employee probably just used the DiskUtil UI to wipe the drive, I was wondering if there was any way for me to get my data back by rebuilding the HFS volume tables back to their previous state for instance. Using a backup would take days to get everything back and I want to try the other options before restoring a backup that would corrupt the data and prevent any further recovery.

Small issue: I only have a Sierra Recovery USB stick, so I can only use the terminal with whatever is already installed, like gpt, diskutil or pdisk. TestDisk for instance doesn’t work as it seems like it’s lacking some dependencies in this recovery environment.

Solution 1:

There are several professional, commercial data recovery options.

One is DiskWarrior, as an external boot media, which can recover corrupted file systems. However, as your file system was completely wiped, you will need to do block-by-block scanning of the raw data.

DataRescue is the tool of choice here. Starting it from a different Mac, connect your current machine via FireWire or Thunderbolt in target disk mode (start the current machine while pressing and holding the t key). It will show up as an external drive on the other Mac. Select the drive as source in DataRescue and run a full scan. This will take hours. After it finishes, you can choose which of the reconstructed files should be saved to a new location.

Direct manipulation on-disk is not possible, especially not now that a new OS appears to have been already installed. Without the partition table and metadata information, data is just on the disk but in an unusable way. That's why modern filesystems save the metadata information to several locations on the disk, so it is more likely to be recoverable even when the sector containing the superblock is damaged. But wiping the information manually wouldn't even help there.

So your best bet is reconstructing files with DataRescue. You could also ask your cloud backup provider to send you your data on disk. It will be quite expensive but if the data is important, just do it and consider it a hard-learned lesson for the future.