A friend of mine recently asked me whether I had any experience of data recovery. Her WD Elements external hard drive was no longer mountable and she had years of data stored on it. A data recovery company was asking for 800 EUR to fix it.
After a bit of Googling, I came up with two tools. The first was PhotoRec and the second was TeskDisk. I downloaded the Ultimate Boot CD, which is essentially a bunch of LINUX tools that run off a bootable CD. Both PhotoRec and TeskDisk are available on that disk.
I first ran PhotoRec. and it successfully started to extract her files off the disk. Since PhotoRec was working so well I started to realise that the disk was probably not that corrupted, so I killed the PhotoRec process.
My gut feeling was that the partitions were still there, but the MBR was corrupted, probably because the disk had been pulled out of the machine without being unmounted first.
TestDisk isn’t that obvious but I battled through with it. First you choose to [Create] a new log file.
Then you choose the physical disk that you want to work with. I choose based on the disk size since I knew it was 1000GB (i.e. 1TB). It was labelled /dev/sda.
The first thing you have to do is to select a partition type. I knew this disk had been setup on an older Mac, so I choose [EFI GPT].
I then select to [Analyse]
It found two partitions. One EFI and the other was Mac HFS. You can move between the two partitions. The EFI one had the [P] option to ‘list files’. The Mac HFS one didn’t. I chose the [Deeper Search] option and it started to scan the drive in more detail.
The process was so slow on this 1TB drive that i left it run overnight. This process ended up listing what seemed like hundreds on Mac HFS partitions. That seemed strange. I then Googled around and realised that the HFS system is “journalled”, meaning that the file system stores versions of your data. Each partition was a slightly different version of the same data. I came across a post that suggested I could use the ‘pdisk’ utility to rebuild all of those partitions, but it meant naming and sizing all of those (what seemed like) hundreds of partitions. The lazy hacker in me said no. There must be a better option.
I researched further and came across Revision of Case Study: Repair mac filesystem. I followed through the [Advanced] section [Superblock] and noted that I also had the error “Sectors are not identical”. I selected [Backup BS], which then seemed to fix the issue.
I then asked my friend to plugin the drive into her Mac. It still didn’t mount, but using the built-in Mac Disk Utility app, it could now see the drive! Result.
However, the volume/partition was greyed out. The right hand panel noted that the volume needed to be repaired. We clicked on repair and the Disk Utility went through a series of checks that were output in the Disk Utility output panel. Finally we had a green light and the disk popped up on the desktop.
It was fixed!