Update Nov 19, 2009
— I just came accross an open source piece of software that might do all of the manual work described below for you. It’s called TestDisk, open source data recovery software.
I haven’t used it, but it looks very promising! —

Original article, Jan 4, 2008
Say you’ve got an external harddisk in a Firewire or USB enclosure. It’s Apple Partition Map (APM) partitioned and contains a couple of HFS+ Journaled formatted volumes. You’re happily using it on your Mac and for some reason you’ve decided to hook it up to a Windows PC. You’ve installed MacDrive on it, but somehow it doesn’t recognize the volumes that are on it. You check the Disk Management tool and you notice a red stop sign on the external drive. When you right-click the symbol, you’re able to “initialize” the drive. You hesitate for a second, but decide it must mean something like “just start the damn thing up, so that it works” (later on you know that this must have been your weakest moment of that day, maybe even the entire week, but at this “moment suprême” you feel it’s the only choice). And then, disaster strikes. Cause “initialize” means something entirely else. The Disk Management tool has just overwritten the APM with a Master Boot Record (MBR) and all partition information seems lost.
That is exactly what happened to me last week. After extensive searches on the internet, the only option seemed to be to buy and use a data restore/recovery program like Disk Warrior II, which meant copying/restoring/recovering the full 250GB of info to another harddisk, which I don’t have. It seemed wrong, the only thing gone was the partition information, the data was still there, why should I spend money on: a) software; b) hardware; to recover “undamaged” data?
Then I found this post on Ubuntuforums.org and it made me see the light.
Before you start doing anything I recommend reading through all below-mentioned steps and then decide whether you can do this. Furthermore note that the disk I used was originally partitioned using an Apple Partition Map. Recent (Intel) Macs have been formatted using GUID Partition Table (GPT) and I have no clue at all whether this will work on GPT drives.

1. Attach the drive to the Mac (using either USB or Firewire). Don’t initialize the drive when asked (cause you want to write as little as possible to the drive to avoid data corruption). To be safe, disconnect other external drives from your Mac. The fewer mistakes you can make, the fewer you will.
2. Install StellarPhoenix. Follow the instructions on enabling the “root” user. Warning: this has serious security implications! Know what you do when enabling the “root” user. I for sure can’t guarantee that even StellarPhoenix is virus/malware free!
3. Relogon with the “root” user and start StellarPhoenix.
4. When you’re lucky, StellarPhoenix instantly finds the Logical Volumes. When it does, skip the next step, else…
5. Scan the disk (which needs to be restored…) for Logical Volumes. To do so, double click the Physical Disk and choose “Scan for Logical Volumes”.
6. Write down the name of the found partition (e.g. something like “Apple_HFS_Untitled_1″) and type (e.g. “HFS+”). Double click the found partition, you’ll be presented with three options. Under the second option “Advanced Scan” is the blue highlighted text “selected region”. Click on “selected region” and write down the information (start and end sectors). Be sure to write them down exactly the same! Repeat this step for every found partition that is on the external disk.
7. You now have a list of partitions with: name, type, start sector, end sector. If you don’t, repeat the steps until you have exactly this information.

Now comes the tricky part. You have to use the Terminal and “pdisk” or “fdisk” to manually recreate the partition information. I’ve used “pdisk” as I found it to be easier to use than “fdisk”, so that is what I’ll show you to use here. Proceed with caution!

8. I logged out from the “root” account and logged in to my own account, don’t know why, but it “felt better”. I know… I guess the difference is whether you need to use “sudo” (to become the root) to execute the next commands.
9. Open up the Terminal, and execute sudo pdisk. It’ll ask you for your root password, so be polite and give it to the Terminal. (Be aware that the Terminal is like a very loyal dog: it’ll do exactly what you’re telling it. But don’t make jokes, cause it doesn’t understand them. Tell it to kill all your files and it’ll do it. Loyal, but stupid. Like a dog.)
10. You’ll be presented with Top level command (? for help):. Enter ? to get acquainted with what pdisk can do for you.
11. Enter L to list the partition information of all attached disks. This is what it told me (and this will probably screw up the layout):

pdisk: No valid block 1 on '/dev/rdisk1' 

Partition map (with 512 byte blocks) on '/dev/rdisk0'
 #:                type name                   length   base     ( size )
 1: Apple_partition_map Apple                      63 @ 1
 2:          Apple_Free                        262144 @ 64       (128.0M)
 3:           Apple_HFS Apple_HFS_Untitled_1 77877936 @ 262208   ( 37.1G)
 4:          Apple_Free                            16 @ 78140144
Device block size=512, Number of Blocks=78140160 (37.3G)
DeviceType=0x0, DeviceId=0x0 

Top level command (? for help):

As you can see my /dev/rdisk1 is screwed up. What you need to do now is recreate the partition information. Look at the above output of pdisk and try to understand how it relates to the information you’ve written down before. As you can see, the APM itself exists as the first entry in the table as

#:                type name                   length   base     ( size )
1: Apple_partition_map Apple                      63 @ 1

The next entry (#2 Apple_Free) starts (base) at (64) the base (1) plus length (63) of the preceding entry. This holds true for every entry. The length of an entry is the base of the next entry minus the base of the entry. The length of the last entry is the size of the disk in blocks minus the base of the entry. So how does this relate to the name, type, start sector, end sector list you made earlier? I suspect you already understand, but here it goes.

• Name, I won’t explain.
• If the type is HFS+, it’ll relate to Apple_HFS and you’ll be fine, otherwise you’re in bigger trouble and you need to find out what the type definition of that volume is.
• Start sector, relates to the base.
• The length you can find by subtracting the start sector from the end sector.

Now, see whether this fits a certain pattern. In my case, I had two logical volumes of type HFS+, named Apple_HFS_Untitled_1 and Apple_HFS_Untitled_2. The space between the volumes was exactly 262144 blocks, so I presumed that each was preceded by an Apple_Free volume without a name and with a length of 262144 blocks. This also fit the start sector of the first volume, being 262208, exactly like my existing /dev/rdisk0. The space between the end sector of the last volume and the last block of the disk was exactly 16, so that would have to be the last Apple_Free volume. That made enough sense to me to procede.

12. I assume you still have Terminal opened and pdisk active. Enter e /dev/rdisk1. (Replace /dev/rdisk1 with the right disk.)
13. Enter p to be sure you’re not screwing with the wrong disk. (It’s wrong when there actually is a partition map.)
14. Enter i. This will initialize a partition map. When it asks whether you really want to do this, enter y. Just enter (press enter/return) on physical block size, logical block size and size of device. Verify what you’ve just done by entering p again (it’s a good thing to verify every step you make). You’ll now see two entries in the partition map. The Apple_partition_map and an Apple_Free entry, which takes up the rest of the space. That’s quite convenient, cause this means that you won’t need to enter the Apple_Free volumes manually. I don’t think it matters that the Apple_Free volumes get the name “Extra”. If you do think it matters, you can remove the name using pdisk (hint: n).
15. Enter c, this will create a new volume of type Apple_HFS. Enter the exact start sector (base) of the first volume you’re recovering. Next, enter the length of the volume. Verify the result (p). Repeat this step for every volume to be recovered. When you want/need to manually fill out all volume properties, use C instead of c.
16. Verify the result for the last time. When you’re sure this is what you expected, enter w. When asked whether you’re sure, enter y.
17. Enter q until you’re back at the command prompt.

By now, the volumes may have already been mounted and you’re jumping on your chair in joy. When they didn’t mount, unplug the external disk and plug it in again. When it still doesn’t work, something is wrong and you need to review what you’ve done in the preceding steps. When you come to the conclusion that you’ve done exactly what I described but it hasn’t helped, blame me, but I can not help you. Buy a license of a recovering tool, buy an extra harddisk and start recovering those files.

This entry was posted on Friday, January 4th, 2008 at 16:32 and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.