While troubleshooting a faulty partition on a Macbook, I accidentally wrote a new partition table using Testdisk (from a bootable USB running Ubuntu). I forgot to backup original table! The data partition was encrypted, but I had been running a decryption from Disk Utility for 2 days, so it should have been decrypted by now.

Gparted tells me this of the disk: enter image description here

How should I proceed to recover the lost partition?

Update 1 So the corrupt startup disk has this partition table (upper part of picture), and a clean OSX installation on a new disk with the same size as the corrupt disk, has the lower partition table in the picture:

enter image description here

Would it be safe to say, that the corruption in the partition table is "just" that the Boot (recovery) partition, has been replaced with Data partition (Mac HFS), and all I need to do is set the correct sectors again using pdisk? I have only read about pdisk, and is a bit reluctant to do it.

migrated from serverfault.com Oct 10 '16 at 15:04

This question came from our site for system and network administrators.

  • 1
    Depending on how valuable the information on the drive is you can try TestDisk en.wikipedia.org/wiki/TestDisk. BUT, if you really need something on the drive hire a data recovery expert. Do you have any backups? – Matt Oct 10 '16 at 14:56
  • It was the Testdisk partition table result, that was written to the disk and made this mess. Of course I should have noticed the wrong sectors (the unallocated part). Perhaps if I knew the start and end of the sectors, I could use the terminal in Recovery mode and then pdisk to write the table? Can this be done if the partition is encrypted? – lyngsie Oct 10 '16 at 15:08
  • That seems like a reasonable approach, if you have another Mac running the same OS and similar enough hardware setup you might be able to get sector sizes and start points for some of the fixed size partitions at least? it seems safe to assume that booting another system with this disk attached in target mode then running fsck will not solve the problem – Matt Oct 10 '16 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.