TestDisk failed in Deep Search?

0

I'm trying to recover data from a colleague's 4TB external G-RAID drive. I've saved the main partition from the quick scan result, but that didn't help, so i spent the past week doing a Deeper Search. It appears to have failed at 78% though (same percentage as three days ago) and the shell is not printing newlines or my input anymore. I've rebooted Ubuntu 14.04.2 and copied testdisk.log, which doesn't appear to be complete:

Mon Jun 22 09:31:18 2015
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.13.0-53-generic (#89-Ubuntu SMP Wed May 20 10:34:39 UTC 2015) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48 support
/dev/sda: size       83886080 sectors
/dev/sda: user_max   83886080 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
/dev/sr0 is not an ATA disk
Hard disk list
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63, sector size=512 - VBOX HARDDISK, S/N:VBa13db256-dd2c60e4, FW:1.0
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486402 255 63, sector size=512 - External RAID
Disk /dev/sr0 - 58 MB / 55 MiB - 28379 sectors (RO), sector size=2048 - VBOX CD-ROM, S/N:VB1-1a2b3c4d, FW:1.0

Partition table type (auto): EFI GPT
Disk /dev/sdb - 4000 GB / 3726 GiB - External RAID
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486402 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814058331 (expected 7814058331)
hdr_lba_start=34
hdr_lba_end=7814058298
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P Mac HFS                   262272 7814058327 7813796056

search_part()
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486402 255 63

HFS+ magic value at 16/83/4
part_size 7813796056
     Mac HFS                   262272 7814058327 7813796056
     HFS+ blocksize=4096, 4000 GB / 3725 GiB

Results
   P Mac HFS                   262272 7814058327 7813796056
     HFS+ blocksize=4096, 4000 GB / 3725 GiB

interface_write()
 1 P Mac HFS                   262272 7814058327 7813796056

TestDisk 6.14 stuck at 78%

It's probably using hardware RAID 0 - Oxford 936 chipset. Can TestDisk help me recover the data, or should i skip to PhotoRec?

Cees Timmerman

Posted 2015-06-29T08:00:50.573

Reputation: 1 240

Answers

0

I made sure that the first depicted partition was written as Primary, but was unable to verify the correctness in Ubuntu, even after installing all hfs packages i could find on short notice, adding "hfs" and "hfsplus" to /etc/modules, using sudo fsck.hfsplus -f /dev/sdb1, and rebooting multiple times:

vagrant@vagrant-ubuntu-trusty-64:~$ sudo mount -o force /dev/sdb1 /mnt/reet
mount: unknown filesystem type 'hfsplus'

I disconnected the USB drive from VirtualBox and was then able to see and correctly extract the files in HFSExplorer in Windows 7. Reconnecting it to the Mac with FireWire worked as well.

Cees Timmerman

Posted 2015-06-29T08:00:50.573

Reputation: 1 240