5

My neighbor brought over a 3TB external hard drive saying that after loaning it out to a Windows user, her Mac is asking her "to initialize something" whenever she plugs it in to her computer.

I'm using Fedora, and I'm trying to recover any data off of the drive before I let her try anything on her computer, because I have a feeling she will lose the data if she let's her computer attempt to "initialize" the drive.

I suspected the problem had something mangled with partition tables. Using fdisk I get the following output for the drive:

Disk /dev/sdd: 2.7 TiB, 3000558944256 bytes, 732558336 sectors
Units: sectors of 1 * 4096 = 4096 bytes
Sector size (logical/physical): 4096 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: BAAE909E-8289-421C-A8D7-9DC750F0E342

Device     Start       End   Sectors  Size Type
/dev/sdd1      6     32773     32768  128M Microsoft reserved
/dev/sdd2  33024 732558079 732525056  2.7T Microsoft basic data

Usign blkid, I get this:

/dev/sdd: PTUUID="baae909e-8289-421c-a8d7-9dc750f0e342" PTTYPE="gpt"

And using parted, I get this:

Model: WD My Book 1230 (scsi)
Disk /dev/sdd: 3001GB
Sector size (logical/physical): 4096B/4096B
Partition Table: gpt
Disk Flags: 

Number  Start   End     Size    File system  Name                          Flags
 1      24.6kB  134MB   134MB                Microsoft reserved partition  msftres
 2      135MB   3001GB  3000GB               Basic data partition          msftdata

I noticed immediately that it didn't have anything for the 'File system' column. How can I get this to mount in read-only at the least, even if it's just for me, so I can copy off the files she has on there?

UPDATE 1

Using file -sL /dev/sdd* produces:

/dev/sdd:  ; partition 1 : ID=0xee, start-CHS (0x0,0,2), end-CHS (0x3ff,255,63), startsector 1, 4294967295 sectors, extended partition table (last)\011
/dev/sdd1: data
/dev/sdd2: data

Trying to mount it using various partition types, using both /dev/sdd and /dev/sdd2. --

ntfs and ntfs-3g:

NTFS signature is missing.
Failed to mount '/dev/sdd2': Invalid argument
The device '/dev/sdd2' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

exfat:

FUSE exfat 1.0.1
ERROR: exFAT file system is not found.

vfat:

mount: wrong fs type, bad option, bad superblock on /dev/sdd2,
   missing codepage or helper program, or other error

   In some cases useful info is found in syslog - try
   dmesg | tail or so.

UPDATE 2

The partition tables were not recoverable, I had to run a rescue to recover the data. Installing testimage and running photorec worked like a champ, I was able to get back all of the lost data.

  • 3
    What does file -sL /dev/sdd* say? It looks like the Windows user has already erased the data by reformatting the disk! If that's the case, some of it may still be recoverable with forensics tools such as the ones mentioned in Recovering accidentally deleted files or How to recover data from a bad SD card? – Gilles Dec 13 '14 at 21:57
  • I guess this is rather a question for MacOS experts. I just had a USB stick which I use under Linux (mostly and in particular: at last) and Windows and a MacBook didn't recognize it and printed this nonsense about initialization – and couldn't even when I confirmed that... – Hauke Laging Dec 13 '14 at 22:30
  • @Gilles, I believe you may be right, I'll check out your links. Thank you. – Brian Dec 14 '14 at 22:28
3

It seems that the drive has been formatted by Windows - which is not surprising, since Windows definitely must have been unable to use the disk which had very likely been formatted by OS X for sole use under OS X. Now the problem is exactly the same, just with the sides swapped.

If you want to mount the Windows partition, you can try blindly guess the file system:

mount -t FILESYSTEM -o ro /dev/sdd2 /mountpoint

where FILESYSTEM is likely to be (given the size of the partition) one of NTFS, exFAT or (less likely) VFAT. For NTFS one can use either in-kernel ntfs driver (in read-only mode) or the FUSE implementation ntfs-3g. exFAT has (allegedly) working FUSE implementation; VFAT has vfat. In any case consider doing the mount with -o ro or even creating a read-only loop device for the partition and mounting that. The reason for such a cumbersome approach is that some file system drivers may update the file system even if mounted in read-only mode (usually by fiddling with metadata). Which is definitely undesirable.

If you want to try to rescue the original (read "pre-Windows") data, check the Q&As referenced by Gilles (Recovering accidentally deleted files and How to recover data from a bad SD card?) and search the internet for file system recovery for the file system used by OS X, most probably HFS Plus.

As for the general question of "initialising a disk": I believe this happens whenever the system doesn't find a partition scheme it understands - this will happen either a MBR partition table or GPT on the disk - or if no partitions it recognizes are of "the right type". This can be surprising when one is used to Linux (and I would suppose BSDs as well) which doesn't pay attention to the partition types, instead caring about the actual content only.

  • I tried with all the filesystem types you suggested, nothing was working. However, following those links I am running photorec right now and it seems to have found a few things. Though because of the size of the drive, it may take until this time tomorrow to complete. – Brian Dec 14 '14 at 22:34
  • 1
    Well, if you want to rescue the content that was there before the drive got lent out, mounting the partitions wouldn't have helped anyway. – peterph Dec 15 '14 at 13:37
  • I had been hoping that a partition table was just missing and upon correcting, all the data would be there, no rescue required. It didn't turn out that way, and the rescue was necessary. – Brian Dec 15 '14 at 15:26
0

Just install exfat-fuse and exfat-utils. Then "mount /dev/<device> <mount point>. Done.

  • I had already tried that, the partition tables were wiped out on the drive before I got it. – Brian Apr 12 '16 at 3:00
  • you can still recover the partition table using testdisk, very good tool, abs. must have installed everybody just in case. – Florin Afilipoaei Apr 12 '16 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.