Recovering HFS+ partition

Usually the original size of the file system (apart from the partition size in the partition table) is saved in the volume header - the 3rd block(512) of an HFS+-partition/volume (considering the old partition scheme). It's based on the allocation block size and the allocation block number. A "resulting volume" of a falsely applied partition table entry mustn't be initialized or repaired though.

To get the device number and the first three blocks unmount the disk and enter:

diskutil list
sudo dd if=/dev/diskX skip=409640 bs=512 count=3 | hexdump #replace diskX with the device no. found in the previous command; below I assume it's disk1

The allocation block size is an UInt32 starting at 0x0000428

0000400 48 2b 00 04 80 00 21 00 48 46 53 4a 00 00 3a 37
0000410 d9 b2 93 73 da 14 65 c2 00 00 00 00 d9 b2 77 53
0000420 00 00 00 ad 00 00 00 13→00 00 10 00←1d 1a c9 0c
0000430 1d 17 9b 2f 00 84 80 00 00 01 00 00 00 01 00 00

The allocation block number is an UInt32 starting at 0x000042C

0000400 48 2b 00 04 80 00 21 00 48 46 53 4a 00 00 3a 37
0000410 d9 b2 93 73 da 14 65 c2 00 00 00 00 d9 b2 77 53
0000420 00 00 00 ad 00 00 00 13 00 00 10 00→1d 1a c9 0c←
0000430 1d 17 9b 2f 00 84 80 00 00 01 00 00 00 01 00 00

To convert hex to decimal use echo "obase=10; ibase=16; (uppercase hex)" | bc

So the allocation block size of the above example is:

echo "obase=10; ibase=16; 00001000" | bc #(=4096 byte)

and the number of allocation blocks is:

echo "obase=10; ibase=16; 1D1AC90C" | bc #(=488294668)

The total size of the volume is allocation block size x allocation block number: 488294668 x 4096 Byte (= 2000054960128 Byte or 3906357344 blocks(512)).

The resulting partition table looks theoretically like this then:

sudo gpt -r show disk1
       start        size  index  contents
           0           1         PMBR
           1           1         Pri GPT header
           2          32         Pri GPT table
          34           6         
          40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      409640  3906357344      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  3906766984      262147         
  3907029131          32         Sec GPT table
  3907029163           1         Sec GPT header

To get this partition table you'd have to execute:

diskutil unmountDisk /dev/disk1
sudo gpt destroy /dev/disk1
sudo gpt create /dev/disk1
sudo gpt add -i 1 -b 40 -s 409600 -t C12A7328-F81F-11D2-BA4B-00A0C93EC93B /dev/disk1
sudo gpt add -i 2 -b 409640 -s 3906357344 -t 48465300-0000-11AA-AA11-00306543ECAC /dev/disk1

Considering the given command/volume/partition table history either the volume was initialized or some other (human) error occured because the result doesn't fit with the presumed original partition table.

Recovering HFS+ partition

Related

Recent Posts