Restore an Apple Partition Map
Update Nov 19, 2009
— I just came accross an open source piece of software that might do all of the manual work described below for you. It’s called TestDisk, open source data recovery software.
I haven’t used it, but it looks very promising! —
Original article, Jan 4, 2008
Say you’ve got an external harddisk in a Firewire or USB enclosure. It’s Apple Partition Map (APM) partitioned and contains a couple of HFS+ Journaled formatted volumes. You’re happily using it on your Mac and for some reason you’ve decided to hook it up to a Windows PC. You’ve installed MacDrive on it, but somehow it doesn’t recognize the volumes that are on it. You check the Disk Management tool and you notice a red stop sign on the external drive. When you right-click the symbol, you’re able to “initialize” the drive. You hesitate for a second, but decide it must mean something like “just start the damn thing up, so that it works” (later on you know that this must have been your weakest moment of that day, maybe even the entire week, but at this “moment suprême” you feel it’s the only choice). And then, disaster strikes. Cause “initialize” means something entirely else. The Disk Management tool has just overwritten the APM with a Master Boot Record (MBR) and all partition information seems lost.
That is exactly what happened to me last week. After extensive searches on the internet, the only option seemed to be to buy and use a data restore/recovery program like Disk Warrior II, which meant copying/restoring/recovering the full 250GB of info to another harddisk, which I don’t have. It seemed wrong, the only thing gone was the partition information, the data was still there, why should I spend money on: a) software; b) hardware; to recover “undamaged” data?
Then I found this post on Ubuntuforums.org and it made me see the light.
Before you start doing anything I recommend reading through all below-mentioned steps and then decide whether you can do this. Furthermore note that the disk I used was originally partitioned using an Apple Partition Map. Recent (Intel) Macs have been formatted using GUID Partition Table (GPT) and I have no clue at all whether this will work on GPT drives.
- Attach the drive to the Mac (using either USB or Firewire). Don’t initialize the drive when asked (cause you want to write as little as possible to the drive to avoid data corruption). To be safe, disconnect other external drives from your Mac. The fewer mistakes you can make, the fewer you will.
- Install StellarPhoenix. Follow the instructions on enabling the “root” user. Warning: this has serious security implications! Know what you do when enabling the “root” user. I for sure can’t guarantee that even StellarPhoenix is virus/malware free!
- Relogon with the “root” user and start StellarPhoenix.
- When you’re lucky, StellarPhoenix instantly finds the Logical Volumes. When it does, skip the next step, else…
- Scan the disk (which needs to be restored…) for Logical Volumes. To do so, double click the Physical Disk and choose “Scan for Logical Volumes”.
- Write down the name of the found partition (e.g. something like “Apple_HFS_Untitled_1″) and type (e.g. “HFS+”). Double click the found partition, you’ll be presented with three options. Under the second option “Advanced Scan” is the blue highlighted text “selected region”. Click on “selected region” and write down the information (start and end sectors). Be sure to write them down exactly the same! Repeat this step for every found partition that is on the external disk.
- You now have a list of partitions with: name, type, start sector, end sector. If you don’t, repeat the steps until you have exactly this information.
Now comes the tricky part. You have to use the Terminal and “pdisk” or “fdisk” to manually recreate the partition information. I’ve used “pdisk” as I found it to be easier to use than “fdisk”, so that is what I’ll show you to use here. Proceed with caution!
- I logged out from the “root” account and logged in to my own account, don’t know why, but it “felt better”. I know… I guess the difference is whether you need to use “sudo” (to become the root) to execute the next commands.
- Open up the Terminal, and execute
sudo pdisk. It’ll ask you for your root password, so be polite and give it to the Terminal. (Be aware that the Terminal is like a very loyal dog: it’ll do exactly what you’re telling it. But don’t make jokes, cause it doesn’t understand them. Tell it to kill all your files and it’ll do it. Loyal, but stupid. Like a dog.) - You’ll be presented with
Top level command (? for help):. Enter?to get acquainted with what pdisk can do for you. - Enter
Lto list the partition information of all attached disks. This is what it told me (and this will probably screw up the layout):
pdisk: No valid block 1 on '/dev/rdisk1' Partition map (with 512 byte blocks) on '/dev/rdisk0' #: type name length base ( size ) 1: Apple_partition_map Apple 63 @ 1 2: Apple_Free 262144 @ 64 (128.0M) 3: Apple_HFS Apple_HFS_Untitled_1 77877936 @ 262208 ( 37.1G) 4: Apple_Free 16 @ 78140144 Device block size=512, Number of Blocks=78140160 (37.3G) DeviceType=0x0, DeviceId=0x0 Top level command (? for help):
As you can see my /dev/rdisk1 is screwed up. What you need to do now is recreate the partition information. Look at the above output of pdisk and try to understand how it relates to the information you’ve written down before. As you can see, the APM itself exists as the first entry in the table as
#: type name length base ( size ) 1: Apple_partition_map Apple 63 @ 1
The next entry (#2 Apple_Free) starts (base) at (64) the base (1) plus length (63) of the preceding entry. This holds true for every entry. The length of an entry is the base of the next entry minus the base of the entry. The length of the last entry is the size of the disk in blocks minus the base of the entry. So how does this relate to the name, type, start sector, end sector list you made earlier? I suspect you already understand, but here it goes.
- Name, I won’t explain.
- If the type is
HFS+ , it’ll relate toApple_HFSand you’ll be fine, otherwise you’re in bigger trouble and you need to find out what the type definition of that volume is. - Start sector, relates to the base.
- The length you can find by subtracting the start sector from the end sector.
Now, see whether this fits a certain pattern. In my case, I had two logical volumes of type HFS+, named Apple_HFS_Untitled_1 and Apple_HFS_Untitled_2. The space between the volumes was exactly 262144 blocks, so I presumed that each was preceded by an Apple_Free volume without a name and with a length of 262144 blocks. This also fit the start sector of the first volume, being 262208, exactly like my existing /dev/rdisk0. The space between the end sector of the last volume and the last block of the disk was exactly 16, so that would have to be the last Apple_Free volume. That made enough sense to me to procede.
- I assume you still have Terminal opened and pdisk active. Enter
e /dev/rdisk1. (Replace/dev/rdisk1with the right disk.) - Enter
pto be sure you’re not screwing with the wrong disk. (It’s wrong when there actually is a partition map.) - Enter
i. This will initialize a partition map. When it asks whether you really want to do this, entery. Just enter (press enter/return) on physical block size, logical block size and size of device. Verify what you’ve just done by enteringpagain (it’s a good thing to verify every step you make). You’ll now see two entries in the partition map. The Apple_partition_map and an Apple_Free entry, which takes up the rest of the space. That’s quite convenient, cause this means that you won’t need to enter the Apple_Free volumes manually. I don’t think it matters that the Apple_Free volumes get the name “Extra”. If you do think it matters, you can remove the name using pdisk (hint:n). - Enter
c, this will create a new volume of type Apple_HFS. Enter the exact start sector (base) of the first volume you’re recovering. Next, enter the length of the volume. Verify the result (p). Repeat this step for every volume to be recovered. When you want/need to manually fill out all volume properties, useCinstead ofc. - Verify the result for the last time. When you’re sure this is what you expected, enter
w. When asked whether you’re sure, entery. - Enter
quntil you’re back at the command prompt.
By now, the volumes may have already been mounted and you’re jumping on your chair in joy. When they didn’t mount, unplug the external disk and plug it in again. When it still doesn’t work, something is wrong and you need to review what you’ve done in the preceding steps. When you come to the conclusion that you’ve done exactly what I described but it hasn’t helped, blame me, but I can not help you. Buy a license of a recovering tool, buy an extra harddisk and start recovering those files.
October 20th, 2008 at 21:17
You have save my life!!!!!!! I was also looking into purchasing the recovery software… It took me a while to get the blocks right, but in the end it worked. Am now backing up to another external drive just in case. Thanks for sharing your knowledge with the rest of the world!
December 24th, 2008 at 22:51
OMMFG!!!!!! Thank you!
December 25th, 2008 at 1:56
Thank you too! Now Roach can restore my server!
June 3rd, 2009 at 1:54
Thanks for the information.Recently I have used Stellar Phoenix Macintosh data recovery software to recover my lost mac data.This software has GUi interface which makes it very easy to use.
October 16th, 2009 at 0:19
Thanks a lot, I was trying to recover 600Gb of information from 1Tb disk. This tutorial helps me
October 24th, 2009 at 1:39
My partition map is fine, it’s my boot0 boot block that is gone. I plugged the drive into a Windows PC and stupidly let it “initialize” the disk. Now I have a Windows MBR instead of a APM boot0 record.
Your method will restore the partition map, which I already have in fine shape. Will recreating the partition map also fix the boot0 block?
HELP!
October 26th, 2009 at 16:37
Follow up here. I rebuild the boot0 block by hand in a hex editor and it worked.
October 26th, 2009 at 16:48
Great to hear that you’ve succeeded in rebuilding the boot0 block. I’m sorry I didn’t reply earlier, but I’ve actually searched for some time after hearing of your (unique!?) problem for a solution. Didn’t find one though.
In my case, the APM was on an external disk without a bootable partition on it, so I didn’t have the same problem you did.
Would you please share your solution, so others can benefit from it?
October 26th, 2009 at 18:13
Here are some more details:
I tried booting a Mac install disk and “repairing” the disk. It checked the partition map, which was fine, but did not repair the boot block. I tried installing and choosing the custom install to install “nothing” but that was no help either.
Finally I decided I had to do it by hand. I found a detailed description of what goes in the boot0 block of an Apple Partition Map (APM).
I booted the Mac into target-disk-mode (hold down ‘T’ when booting), then used a firewire cable to connect the drive to another computer. Using a hex editor (like one of these http://en.wikipedia.org/wiki/Disk_editor) I hand entered hex values as follows:
45 52 (APM boot block signature)
02 00 (block size=512 bytes in hex)
xx xx xx xx (size of entire hard disk in blocks in hex)
00 00 00 00 00 00 00 00 (reserved all zeros)
00 00 (NO special device drivers)
00 00 00 00 00 00 00 01 (empty device driver entry)
Then I booted the Mac, and it worked!
Note: to find the size of your hard disk, boot with the Mac install CD, open a terminal and use: diskutil list, and diskutil info /dev/disk0
Note: to convert the size into hex, use a calculator that can do it for you or open a terminal and use “bc” : ibase=10; obase=16; 500000000 (or whatever your size is)
Note: While in the hex editor I looked at the first few 512 byte blocks of the disk. I had an MSDOS block0 with the text “Invalid partition table. Error loading operating system. Missing operating system”. That didn’t belong there, that was the cause of my problem. I also had a good Apple Partition Table in the next four 512-byte blocks. Each one started with the characters “PM”, which told me they were undamaged.
Again, read the link above that describes APM in detail for better understanding.
October 26th, 2009 at 18:46
Hans, thank you so much for sharing!
November 5th, 2009 at 5:16
You are great Broes!!
This saved my 500gb usb maxtor hdd!! All my photos, everything was there!!
I really thank you!!
It took me 2 days to find you, so please publish this everywhere!!
Thanks again!!!
January 19th, 2010 at 22:12
This was a headache for the last few days: I was not able to mount my external hard drives to my new Xubuntu PC, though they were running fine on my Mac. I did not want to format them as it takes hours to put back the data on them. But as I have a backup (in the worst case, I would format the drive and waste time, but no data), I took the chance to try your solution: it worked like a charm !
Thank you so much for sharing this
January 20th, 2010 at 22:47
[...] qui ce pdisk ? La meilleur réponse, adapté en français par mes soins, vient du blog de Broes. pdisk est un rescapé des outils Unix qui équipent les Mac, aussi puissant [...]
February 7th, 2010 at 16:13
I was working with a external 1TB WD disk when I bought a NASduo. In the instalation process I was catch with suprise that it had just made a quick format to my disk. I thought all data of my disk was ruined until I found Testdisk and saw my old partitions and structure of my files. This was the table of my partitions:
Disk /dev/disk1 – 1000 GB / 931 GiB – CHS 1953525168 1 1
Partition Start End Size in sectors
P HFS 409640 488790935 488381296
P DOS_FAT_32 488792064 977172479 488380416 [DOCS]
P DOS_FAT_32 977172480 1465552895 488380416 [PICTURES]
P DOS_FAT_32 1465552896 1953523711 487970816 [OTHERS]
Everything was bright until I received the message “Function write_part_mac not implemented” and I had to use pdisk.
I read carefully all your post in order to restored the missing partition.I open the terminal and when I reached 11) from your to do list this was what i received:
Last login: Sun Feb 7 14:16:21 on ttys000
Macintosh-2:~ M$ sudo pdisk
Password:
Top level command (? for help): L
pdisk: No valid block 1 on ‘/dev/rdisk1′
Floating point exception
Macintosh-2:~ M$
..and once more I’m looking to a brick wall without any clue what to do.
I do not know which partition is missing and how do I acess to my partition table in pdisk. I would desperately appreciate any help.
I’m using a Intel/mac and I hope that this is not a problem..
February 9th, 2010 at 3:49
same problem as above =). can it be fixed somehow?
February 9th, 2010 at 11:06
@Dua @zam0th:
It might be that your HDD is partitioned using GPT (GUID Partition Table) or MBR (Master Boot Record) and not APM (Apple Partition Map). I cannot see that from the above data, since it only lists the partitions and doesn’t tell anything about the partition table type.
Note that the bootdisk of all Intel Macs is certainly of the type GPT. Extra drives may be of any format.
When you want to recover a GPT, you might want to look at this thread on MacRumors Forum.
February 27th, 2010 at 2:43
Hi Broes!
A ruined my 1.5 Tb Drive after i sold my PPC MAC. I used on a PC with Madrive until i want to make ntfs partition to changing the hdd to ntfs! So i didn’t know that if i change one partition on win it will ruin all of them, because its a completly different than MBR. So with macdrive i ruined the tables, and my best music projects…
Have you got any solution for PC platform recovery like this. Or i have to get a PPC Mac from somewhere?!
Thanks
May 2nd, 2010 at 15:49
Thank you so much for the clear step-by-step instructions. Following your instructions, I was able to recreate the partition map in my external USB drive and recovered all the data. I can’t thank you enough.
May 24th, 2010 at 9:01
Using your instructions I was able to save my 500GB drive full of valuable info. Thank you very much!
May 26th, 2010 at 3:11
Data Recovery is a very costly option that is why you should always check your storage media for any signs of wear and tear.`;:
June 1st, 2010 at 9:52
d2 quadra
/dev/rdisk1
that’s the name of the disk I want to repair but… it doasn’t work.
e d2 quadra
pdisk: can’t open file ‘d2′ (No such file or directory)
June 2nd, 2010 at 21:05
Sorry for a long comment, but I want to be sure that I’m being clear about what I have and what my question is about how to go forward.
Same starting situation – 1TB external with HFS+ and MacDrive, the APM was overwritten with an MBR. TestDisk shows that all the APM partition data is still there, with invalid block) signature.
Bad MAC partition, invalid block0 signature
1 P partition_map 1 63 63
2 P Driver43 64 119 56
3 P Driver43 120 175 56
4 P Driver_ATA 176 231 56
5 P Driver_ATA 232 287 56
6 P FWDriver 288 799 512
7 P Driver_IOKit 800 1311 512
8 P Patches 1312 1823 512
9 P Free 1824 263967 262144
10 P HFS 263968 1953525151 1953261184
11 P Free 1953525152 195352516
pdisk shows the same information on the external.
Partition map (with 512 byte blocks) on ‘/dev/rdisk1′
#: type name length base ( size )
1: Apple_partition_map Apple 63 @ 1
2: Apple_Driver43 Macintosh 56 @ 64
3: Apple_Driver43 Macintosh 56 @ 120
4: Apple_Driver_ATA Macintosh 56 @ 176
5: Apple_Driver_ATA Macintosh 56 @ 232
6: Apple_FWDriver Macintosh 512 @ 288
7: Apple_Driver_IOKit Macintosh 512 @ 800
8: Apple_Patches Patch Partition 512 @ 1312
9: Apple_Free 262144 @ 1824 (128.0M)
10: Apple_HFS Apple_HFS_Untitled_1 1953261184 @ 263968 (931.4G)
11: Apple_Free 16 @ 1953525152
Device block size=512, Number of Blocks=0 (0.0 )
DeviceType=0×0, DeviceId=0×0
I have looked through everything on the TestDisk documentation and in this blog, but I can’t figure out how I need to proceed to restore the partition. Do I use pdisk to initialize and then write in the details for each of the 11 stages of the map? Or do I just need to put in the data for the main 931.4G block and initialize that? Or maybe just give the initialize command using the existing directory information? Some very specific instruction would be greatly appreciated – this is pretty advanced stuff for me.
June 5th, 2010 at 5:46
Problem solved, drive restored, thanks to this blog.