How should I recover my NTFS partition that I have accidentally deleted on my Mac

The NTFS volume has been recovered in a TeamViewer session. The method is slightly related to my answer here: Can't see external HDD partition in Disk Utility

Preface:

The NTFS volume was formatted attached to a Mexican-Spanish (or French?) Windows system.

The specific string "BOOTMGR" to find the NTFS Partition Boot Sector with grep wasn't successful because on these systems - as it later transpired - the proper string is "bootmgr" instead.

Assumptions:

The vanished partition and its important blocks weren't overwritten. The partition is situated near the "end" of the disk.


So the following method was used:

  • Enable and log-in as root and install wxHexEditor
  • get the device identifier with diskutil list. Below I assume it's disk2.
  • Open the device disk2 in wxHexEditor, jump to the very end of the disk and backward-search for the string "NTFS" which revealed the (2nd) Partition Boot Sector of the NTFS volume.
  • With its byte offset the block number of the last NTFS volume block can be determined (byte offset/512 + 1 = block number)
  • The (2nd) Partition Boot Sector contains the size of the whole NTFS volume in sectors at offset 0x028 and a field length of 8 Bytes and the sector size at offset 0x0B and a field length of 2 Bytes.
    • Sector size: 00 02 (= 512 Byte)
    • volume size in sectors was (after a 64bit to decimal conversion) 2047997951+1 blocks (one has to add 1 to the number of blocks because block count starts at 0!)
  • In Terminal the partition was added with fdisk:

    fdisk -e /dev/disk2
    edit 2 #add second partition
    Partition id ('0' to disable)  [0 - FF]: [0] (? for help) 7 #HPFS/QNX/AUX
    Do you wish to edit in CHS mode? [n] n
    Partition offset [0 - 3907029167]: [446333006] 1859028992
    Partition size [1 - 2048000175]: [2048000175] 2047997952
    write
    exit
    
  • the volume was mounted automatically.
  • The NTFS volume was checked with Paragon NTFS for Mac with a "no errors" result.

The initial details of at least one of the two deleted partitions posted by the OP were wrong:

  • First partition: 280 GB
  • Second partition: 1720 GB

The second partition had and has a size of 1.049 TB only!