[Strong]

Hey, a couple months ago I created a second partition on my hard drive, However I don't need the partition anymore, so I tried to delete it, long story short I put the 10.6 DVD into the computer and used the DVD's disk utility to partition the hard drive into having a single partition on it, little did I know doing this wiped everything off the hard drive.

how do I get this stuff back? since I partitioned my computer I'v installed 10.6 onto an old macs hard drive am using it as a target disk to boot my computer. how do I get undo my partitioning? are there any good programs? I'v checked into testdisk however the I'm command line is confusing for me and I cant figure the program out

[reader50]

If you remember the partition sizes you used before, you can repartition the drive exactly as it was before. Then use Data Rescue on the lost data partition. It probably won't find everything, but it may find a lot.

So long as you don't write anything to the drive, most of the data is probably recoverable.

[Strong]

Hey no I haven't written anything to the hard drive since it was partitioned however I don't remember the exact partition sizes either, does anybody know if it's possible to recover the sizes with a freeware? I'm not sure that I want to invest $100 into software if I don't know the partition sizes.

[reader50]

Was your data on the first partition, or the second? If the data was on the 2nd, Data Rescue probably can't recover anything unless you remember the exact partition sizes, and reestablish them.

If your data was on the first partition, it may be able to recover data as-is. You'd basically have the first partition now, only bigger than it was. If the virtual block size and offset are unchanged, then DR should work.

note: you have to recover files to a different drive. DR will not write to the suspect drive for safety reasons.

[Strong]

All my file were on my second partition, while I can't remember the exact size of the partitions could I use a rough estimate? I could probably get an estimate within 500mbs-1gb of accuracy

[reader50]

Belated obvious question - do you have a Time Machine backup? Or any other backup made recently? Using a backup is way easier than data recovery.

--------------------

A rough estimate of the partition size won't do. You need the first partition to be the same size as before, so the offset (from beginning of drive) will be correct. DR needs this for data alignment purposes.

The size of the first partition is really all you need, since the 2nd partition would be whatever space was left on the disk. If you can't determine how big the first partition was, then the only option would be to fish for the data. ie - try various byte offsets, and hope one of them will make one of the lost directories readable.

Basically, start DR on the drive using default settings. Typically a 4KB virtual block size, and the default byte offset. Let it scan the full drive for lost files. This will take hours (or days). If it finds none, increase the byte offset by 1 and scan again. Do the same thing if it recovers some files, but they are all corrupted when you try to open them.

Assuming the virtual block size was 4K on all the old and new partitions (this is a good bet) you have 8 values to try. That is: the offset value it starts with, then increase the byte offset by 1 to 7. Rescan each time. If everything works as expected, one of the values will yield recoverable files.

This approach will take a really long time. Since the lost data is on the 2nd partition, and you start each scan from the beginning of the drive, it is likely to go 50% or more into the scan before it even gets to where the 2nd partition was.

Edit: the above trick won't work. Realized it a few minutes after posting. Recovery software *has to have* the partition start where it did the first time. Otherwise, when it does find a directory, all the data pointers will be wrong because they're referenced from the wrong starting point. You need to recreate your original partitions, or the data can't be recovered.

Perhaps you printed out a system profile report, or a screen shot showing the drive sizes? Ever send a picture of your desktop to someone else, with Disk Utility visible? The other person might still have such a shot.

[P]

If I read it correctly, the first partition is what contains the important stuff. Is that correct? If so, one big partition should work.

[Spheric Harlot]

Nope. All his files were on the second partition.

[Strong]

Nope no backup, I would have used it long ago and avoided this whole mess, I think I'l be investing in some sort of back up in the near future.

As far as I know I never took a screen shot with disk utility open, and I have never sent a screen shot to someone else.

for what it's worth I'v let TestDisk scan my hard drive for lost partitions and it's found quite a few, perhaps two of them were the deleted partitions I need.

[reader50]

A new thought. When some applications crash, they offer to send data about the crash back to the developers. That crash report may contain a list of attached disk sizes.

Apple does this, but you won't be able to talk them into coughing up a copy of such a report. They've gotten big enough, and such a request would be too personal.

Omni used to do this, as did Mozilla (Firefox/Thunderbird/Songbird). Not sure how many other developers do.

Did any of those apps ever crash before you wiped the partitions, and did you ever allow it to send a report in?

[Strong]

Great though, it's a long shot but it's not like I'v got a whole lot of options right now. I know I used omnidisksweeper before deleting the partitions to clear out files, however I'm not sure if it crashed and even if it did crash I'm not sure if I sent the report. I never really use firefox but I had it on the computer anyways, don't remember it crashing before. If I did send a report in though how would they identify my report in particular? maybe IP address but thats all I can think of.

It really looks like I'm out of options, I'v been looking at just buying data rescue and giving it a try since after a week I'm really starting to need thing to go back to normal. I'l tell you guys if it works.

[reader50]

If a crash report were sent in, they are most likely to reference it by your email address or IP address at the time. Some send the report right through Mail.app, so those definitely have your email address. Others sent directly probably use a web submission in the background, with the IP being recorded. Possibly also your computer name, if it was unique enough. Maybe the email address, if the report script could access that info.

[Strong]

I never used the mail app for an email client so I doubt they have my email address, they probably have my IP address though. I would assume reports were sent via a web submission system.

[ghporter]

Do you have an Apple account? That is tied to an email address-whether it's set up to buy a computer online or just with the iTunes store.

[jmiddel]

Just ran across this on MacFixit:

TestDisk

Along with Apple's supplied disk utility is the command-line "diskutil" program, which can perform similar fixing routines in the Terminal (either when logged in or when in single-user mode). TestDisk is another command-line tool for disk repair, but it's far more robust and allows you to recover lost partitions, undelete files, and manage and fix boot sectors for a variety of formats and partition tables, including FAT, HFS+, NTFS, ext2/3, Novell, UFS, JFS...the list goes on.

TestDisk - CGSecurity

[CharlesS]

He's already tried TestDisk, from the looks of things, although he didn't say whether it solved his problem or not.

If you're not sure of the exact partition sizes, but you feel like you might be able to guess, my suggestion would be to get an external hard drive that's at least as big as the one you're trying to restore. Then you can either do a block-level restore using Disk Utility's "Restore" tab with the "Erase Destination" check box checked, or you can just make a disk image of the disk you're trying to restore and save the image onto the spare hard disk. Then, you'll have a block-for-block duplicate of the original disk on which you can try any crazy thing you want, and if it doesn't work, you haven't destroyed the original.

[reader50]

If you could remember the approximate size of the two partitions, and the TestDisk results gave a single close match for each size, you could take a chance and recover those two. CharlesS' suggestion is more involved & expensive, but it will insulate you from any further mistakes.

[Art Vandelay]

Originally Posted by CharlesS 

He's already tried TestDisk, from the looks of things, although he didn't say whether it solved his problem or not.

If you're not sure of the exact partition sizes, but you feel like you might be able to guess, my suggestion would be to get an external hard drive that's at least as big as the one you're trying to restore. Then you can either do a block-level restore using Disk Utility's "Restore" tab with the "Erase Destination" check box checked, or you can just make a disk image of the disk you're trying to restore and save the image onto the spare hard disk. Then, you'll have a block-for-block duplicate of the original disk on which you can try any crazy thing you want, and if it doesn't work, you haven't destroyed the original.

Are you sure about that? I do block copies all the time at work and the speed is dependent on the amount of current data on the drive, not the size of the drive. That would imply it only copies the blocks that have data, not every block nor blocks that have had data before.

[CharlesS]

Huh, I just tested it with a couple of USB sticks and unless I'm doing something wrong, you appear to be right. Using Disk Utility to create a read/write disk image seems to work as expected, though. I zeroed out one of the sticks, created an RTF file, trashed it, emptied the trash, and imaged the USB stick to a read/write DMG file, opened up the DMG with a hex editor, searched for the text of the RTF file, and it came up.

If you're paranoid, I suppose you could use the dd tool at the command line to do the copy. This should work either for cloning one disk onto another (if they're the same size) or to a file (if you specify a file path for the 'of' parameter — such files will be mounted by the disk image system if you put .dmg at the end of the filename).

[Strong]

I have given testdisk a try, I had it do a scan of the entire drive and it turned up a lot of lost partitions, something like 20ish. I'v lost the results but if needed I could do another scan, my hardrive is 200gb, it's smallish but still takes about 5-7 hours to do the entire scan. for some reason testdisk says it doesn't have permission to write even though I'v used the sudo. Imageshack - screenshot20100715at349.png this is the screen I get also worth noting is that testdisk says I have two of all the HDDs attached to the computer Imageshack - screenshot20100715at348.png

On another note I caved and got data rescue realizing this isn't going to be an easy fix, I let it run and it found 114gb of data on the drive, this was bigger then my other macs HDD so I went down to Frys and grabbed a 250gb external hitachi drive, I'v partitioned it into two sections and installed OS X on the first and recovered all my data to the second.it seems like it found a ton of my stuff, but it also looks like the files are somehow broken, when opening images preview gives me an error saying the image "It may be damaged or use a file format that Preview doesn’t recognize." I get similar errors with videos and audio files (I'v installed VLC and Perian to check them). documents also don't open giving similar errors (.DOCX, .Pages, .TXT)

[reader50]

Your recovery symptoms come from the lost partition not starting where it should. DR must have found directories, and tried to recover the files pointed to. Trouble is, the pointers are referenced from where the 2nd partition used to begin, and DR is using the current partition start as the reference point.

[Strong]

I see I suspected this was my problem, I'l attempt to use testdisk to figure out the partition sizes and repartition. so far it's at 9% completion and has found 18 HFS partitions and a single fat 32 (What?) so this could take a while

[CharlesS]

Please back up your disk before doing anything potentially destructive like reformatting. I'd recommend imaging it to the external drive as a read/write .dmg.

[Strong]

I'l do that, currently testdisk is 43% into the scan, my 5-7 hour estimate was pretty generous, but it should be done by tomorrow morning. Before I can restore my partitions I'l need to figure out why testdisk isn't given write permission for the drives even though I'v done the sudo.

[Strong]

Alright like you suggested I'm trying to create a backup using DD. I'v been trying to use this command to use it but I'm doing something wrong, I'v tweaked and tried a couple of different things.
sudo dd if=/dev/disk0 of=/dev/disk2s3/file.img

I get this error
dd: /dev/disk2s3/file.img: Not a directory
I'm not sure if file.IMG needs to exist on the disk but I'v tried creating it and it hasn't worked.I'm not sure if the path I'm using is correct, I did a bit of research into the DD command and I guess I need to use the BSD name of disk in the path?

I'v tried using both an app called dd-gui witch is pretty simple a GUI which converts the paths into the DD command, I'v also tried doing it directly from the command line but neither has worked.

[CharlesS]

Just make the of= argument point to a regular file in the file system. For example, /Volumes/BigUSBDisk/whatever.dmg. Only use the /dev entry for the if= argument, unless of course you want to clone straight onto the other disk.

Also, you probably want to use the character device rather than the block device. Have your if= argument be /dev/rdisk0 rather than /dev/disk0.

[Strong]

allright I'v changed the command to
sudo dd if=/dev/rdisk0 of=/volumes/untitled 1 2/backup.dmg
I'm now getting this error
dd: unknown operand 1
I feel pretty stupid right now.

[CharlesS]

You have to put quotes around the path if it has spaces in it.

[Strong]

Hey sorry to bring this problem back up but I haven't fixed it completely yet, I'v been a bit busy lately and this has been on the back burner since I'm doing fine running off the external. so I've run test disk and there are a multitude of deleted partitions found, I do believe that it found the partitions I needed however when I tell it to restore them it comes up with a write error (before I start the scan testdisk warns that it doesn't have write access) does anyone know why testdisk doesn't have write access?

Also I tried to create a backup DMG of the disk with DD I did finally work out how to use DD however the DMG refuses to mount because of a filesystem error, I'v trashed the DMG and would like to know if anyone knows how to create a proper backup DMG with DD.

Thanks