My neighbor brought over a 3TB external hard drive saying that after loaning it out to a Windows user, her Mac is asking her "to initialize something" whenever she plugs it in to her computer.
I'm using Fedora, and I'm trying to recover any data off of the drive before I let her try anything on her computer, because I have a feeling she will lose the data if she let's her computer attempt to "initialize" the drive.
I suspected the problem had something mangled with partition tables. Using fdisk
I get the following output for the drive:
Disk /dev/sdd: 2.7 TiB, 3000558944256 bytes, 732558336 sectors
Units: sectors of 1 * 4096 = 4096 bytes
Sector size (logical/physical): 4096 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: BAAE909E-8289-421C-A8D7-9DC750F0E342
Device Start End Sectors Size Type
/dev/sdd1 6 32773 32768 128M Microsoft reserved
/dev/sdd2 33024 732558079 732525056 2.7T Microsoft basic data
Usign blkid
, I get this:
/dev/sdd: PTUUID="baae909e-8289-421c-a8d7-9dc750f0e342" PTTYPE="gpt"
And using parted
, I get this:
Model: WD My Book 1230 (scsi)
Disk /dev/sdd: 3001GB
Sector size (logical/physical): 4096B/4096B
Partition Table: gpt
Disk Flags:
Number Start End Size File system Name Flags
1 24.6kB 134MB 134MB Microsoft reserved partition msftres
2 135MB 3001GB 3000GB Basic data partition msftdata
I noticed immediately that it didn't have anything for the 'File system' column. How can I get this to mount in read-only at the least, even if it's just for me, so I can copy off the files she has on there?
UPDATE 1
Using file -sL /dev/sdd*
produces:
/dev/sdd: ; partition 1 : ID=0xee, start-CHS (0x0,0,2), end-CHS (0x3ff,255,63), startsector 1, 4294967295 sectors, extended partition table (last)\011
/dev/sdd1: data
/dev/sdd2: data
Trying to mount it using various partition types, using both /dev/sdd and /dev/sdd2. --
ntfs and ntfs-3g:
NTFS signature is missing.
Failed to mount '/dev/sdd2': Invalid argument
The device '/dev/sdd2' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
exfat:
FUSE exfat 1.0.1
ERROR: exFAT file system is not found.
vfat:
mount: wrong fs type, bad option, bad superblock on /dev/sdd2,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so.
UPDATE 2
The partition tables were not recoverable, I had to run a rescue to recover the data. Installing testimage
and running photorec
worked like a champ, I was able to get back all of the lost data.
file -sL /dev/sdd*
say? It looks like the Windows user has already erased the data by reformatting the disk! If that's the case, some of it may still be recoverable with forensics tools such as the ones mentioned in Recovering accidentally deleted files or How to recover data from a bad SD card?