My neighbor brought over a 3TB external hard drive saying that after loaning it out to a Windows user, her Mac is asking her "to initialize something" whenever she plugs it in to her computer.
I'm using Fedora, and I'm trying to recover any data off of the drive before I let her try anything on her computer, because I have a feeling she will lose the data if she let's her computer attempt to "initialize" the drive.
I suspected the problem had something mangled with partition tables. Using
fdisk I get the following output for the drive:
Disk /dev/sdd: 2.7 TiB, 3000558944256 bytes, 732558336 sectors Units: sectors of 1 * 4096 = 4096 bytes Sector size (logical/physical): 4096 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disklabel type: gpt Disk identifier: BAAE909E-8289-421C-A8D7-9DC750F0E342 Device Start End Sectors Size Type /dev/sdd1 6 32773 32768 128M Microsoft reserved /dev/sdd2 33024 732558079 732525056 2.7T Microsoft basic data
blkid, I get this:
/dev/sdd: PTUUID="baae909e-8289-421c-a8d7-9dc750f0e342" PTTYPE="gpt"
parted, I get this:
Model: WD My Book 1230 (scsi) Disk /dev/sdd: 3001GB Sector size (logical/physical): 4096B/4096B Partition Table: gpt Disk Flags: Number Start End Size File system Name Flags 1 24.6kB 134MB 134MB Microsoft reserved partition msftres 2 135MB 3001GB 3000GB Basic data partition msftdata
I noticed immediately that it didn't have anything for the 'File system' column. How can I get this to mount in read-only at the least, even if it's just for me, so I can copy off the files she has on there?
file -sL /dev/sdd* produces:
/dev/sdd: ; partition 1 : ID=0xee, start-CHS (0x0,0,2), end-CHS (0x3ff,255,63), startsector 1, 4294967295 sectors, extended partition table (last)\011 /dev/sdd1: data /dev/sdd2: data
Trying to mount it using various partition types, using both /dev/sdd and /dev/sdd2. --
ntfs and ntfs-3g:
NTFS signature is missing. Failed to mount '/dev/sdd2': Invalid argument The device '/dev/sdd2' doesn't seem to have a valid NTFS. Maybe the wrong device is used? Or the whole disk instead of a partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
FUSE exfat 1.0.1 ERROR: exFAT file system is not found.
mount: wrong fs type, bad option, bad superblock on /dev/sdd2, missing codepage or helper program, or other error In some cases useful info is found in syslog - try dmesg | tail or so.
The partition tables were not recoverable, I had to run a rescue to recover the data. Installing
testimage and running
photorec worked like a champ, I was able to get back all of the lost data.