0

I plugged a 32GB usb stick into a 2019 macbook pro and all data was automatically and immediately removed. OSX shows no data on the stick. There used to be data on the stick.

I went back to my linux box and checked. Sure enough, OSX had done something to the filesystem so it was empty and then it created the normal hidden files (.fseventsd, .Spotlight-V100).

On linux, I started a file recovery tool to get my data back and that worked fine but I lost the file names.

What I'd like to know is wtf did OSX do to my drive and how to reverse it? This also happened once before a long time ago with a 1TB ntfs external hdd that I forgot about so I'm sure this is a common problem.

Here is the flashdrive filsystem info after OSX changed it:

sudo file -s /dev/sdh /dev/sdh: DOS/MBR boot sector MS-MBR XP english at offset 0x12c "Invalid partition table" at offset 0x144 "Error loading operating system" at offset 0x163 "Missing operating system", disk signature 0x6f55f075; partition 1 : ID=0xc, start-CHS (0x0,63,1), end-CHS (0x270,96,1), startsector 8064, 60559488 sectors FAT32

Before, it was probably something like this (different usb flashdrive):

sudo file -s /dev/sdh /dev/sdi: DOS/MBR boot sector; partition 1 : ID=0xb, start-CHS (0x3ff,254,63), end-CHS (0x3ff,254,63), startsector 2, 121065982 sectors, extended partition table (last) FAT32 (LBA)

Looks like the filesystems are slightly different now.

Does anyone know if there is a simple fsck command I can run to just repair the filesystem on the stick (and get the file names/dir structure back)? I know all the data is still there after running a recovery util. I'm not too familiar with filesystem implementation details.

Edit: I tried to reproduce this by repartitioning+reformatting the stick with fdisk (extended 0xb and norm 0xc) and mkfs.vfat but no luck. I did manage to reproduce it when using mkfs.ntfs (mkntfs v2015.3.14AR.1 (libntfs-3g)). Maybe the flashdrive was formatted with ntfs? It was so long ago I can't be sure.

At least with that all I can say is DON'T PLUG A NTFS STICK INTO A MAC!

I'm happy to get more details if you need.

2
  • If you didn't leave any key detail out, then apple is engaging in criminal behavior, if it really did not ask you about reformatting it, and just reformatted it without anything else, no interaction, etc. But this is why I avoid apple products like the plague. While far from great, at least windows will ask you if you want to format it if it can't read the file system first. And linux, of course, would never do anything so vile, it would respect your needs as a user, and either open it in read only mode, or note it can't read the file system.. – Lizardx Feb 13 at 2:25
  • how do you know that the macbook wiped the USB stick? ... the stick could have been blank before you plugged it in – jsotola Feb 13 at 5:35
1

I had a problem with an NTFS version, created by an older linux ntfs-3g, which Windows did not recognise; there was a brief prompt before format.


The USB drive with the extended partition was not recognised and was then formatted.

https://www.active-undelete.com/hdd_partition.htm


The recovery tool is your best bet, it will do it's best to approximate the data for you, ignoring a broken MBR. Data may have been overwritten during the format, you have no way of checking the integrity.


Use dd to copy the entire image before playing around with the MBR.

https://serverfault.com/questions/4906/using-dd-for-disk-cloning

If you had made a backup dd of your MBR with:

sudo dd if=/dev/sda of=mbr_backup bs=512 count=1

Then you could apply the MBR with:

sudo dd if=mbr_backup of=/dev/sda bs=512 count=1

You could use a hexeditor to manually edit the dumped MBR before applying it to your drive, then fsck the fat32 drive, cross your fingers and mount.


You can also disable creating .fseventsd & .Spotlight-V100.

https://superuser.com/questions/89556/how-to-disable-creating-spotlight-v100-and-trash-folders-on-external-drive

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.