How should I recover my NTFS partition that I have accidentally deleted on my Mac
The NTFS volume has been recovered in a TeamViewer session. The method is slightly related to my answer here: Can't see external HDD partition in Disk Utility
Preface:
The NTFS volume was formatted attached to a Mexican-Spanish (or French?) Windows system.
The specific string "BOOTMGR" to find the NTFS Partition Boot Sector with grep wasn't successful because on these systems - as it later transpired - the proper string is "bootmgr" instead.
Assumptions:
The vanished partition and its important blocks weren't overwritten. The partition is situated near the "end" of the disk.
So the following method was used:
- Enable and log-in as root and install wxHexEditor
- get the device identifier with
diskutil list
. Below I assume it's disk2. - Open the device disk2 in wxHexEditor, jump to the very end of the disk and backward-search for the string "NTFS" which revealed the (2nd) Partition Boot Sector of the NTFS volume.
- With its byte offset the block number of the last NTFS volume block can be determined (byte offset/512 + 1 = block number)
- The (2nd) Partition Boot Sector contains the size of the whole NTFS volume in sectors at offset 0x028 and a field length of 8 Bytes and the sector size at offset 0x0B and a field length of 2 Bytes.
- Sector size:
00 02
(= 512 Byte) - volume size in sectors was (after a 64bit to decimal conversion) 2047997951+1 blocks (one has to add 1 to the number of blocks because block count starts at 0!)
- Sector size:
-
In Terminal the partition was added with fdisk:
fdisk -e /dev/disk2 edit 2 #add second partition Partition id ('0' to disable) [0 - FF]: [0] (? for help) 7 #HPFS/QNX/AUX Do you wish to edit in CHS mode? [n] n Partition offset [0 - 3907029167]: [446333006] 1859028992 Partition size [1 - 2048000175]: [2048000175] 2047997952 write exit
- the volume was mounted automatically.
- The NTFS volume was checked with Paragon NTFS for Mac with a "no errors" result.
The initial details of at least one of the two deleted partitions posted by the OP were wrong:
- First partition: 280 GB
- Second partition: 1720 GB
The second partition had and has a size of 1.049 TB only!