Hello @harderased
Do you know how many partitions were on the drive ?
Were they fat32 or ntfs partitions ?
How large is that drive ?
I’ll assume that there was only one partition and that you have enough disk space on your mac to make a disk image of this drive.
The partition table is missing on that drive, so we need to find where the partition is.
If the drive was readable on Windows 7, I guess the partition is either fat32
or ntfs
.
Do not format this drive if any system asks you to !
In order to recover data (on a mac):
Step 1: Find the offset of the partition
- before connecting the drive, open a terminal on your mac and type
diskutil list
- connect the drive to your mac, if macOS tells you something like “this drive is not readable on this computer”, select “ignore”, DO NOT SELECT FORMAT;
- run
diskutil list
again, a new drive should have appeared, note its name (something like /dev/disk2
);
- I will use
/dev/disk2
in the commands below, please use the correct disk number from the previous step;
- run
sudo hexdump -C -s 512 /dev/disk2 | head
which will show you the contents of the beginning of the disk (skipping the first 512 bytes).
You should see something like:
00000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00100000 eb 52 90 4e 54 46 53 20 20 20 20 00 02 08 00 00 |.R.NTFS .....|
00100010 00 00 00 00 00 f8 00 00 3f 00 ff 00 00 08 00 00 |........?.......|
00100020 00 00 00 00 80 00 00 00 ff 17 b7 03 00 00 00 00 |................|
00100030 00 00 0c 00 00 00 00 00 02 00 00 00 00 00 00 00 |................|
00100040 f6 00 00 00 01 00 00 00 31 0c 76 f0 2d 76 f0 9e |........1.v.-v..|
00100050 00 00 00 00 fa 33 c0 8e d0 bc 00 7c fb 68 c0 07 |.....3.....|.h..|
00100060 1f 1e 68 66 00 cb 88 16 0e 00 66 81 3e 03 00 4e |..hf......f.>..N|
00100070 54 46 53 75 15 b4 41 bb aa 55 cd 13 72 0c 81 fb |TFSu..A..U..r...|
If you see the .R.NTFS
on the third line of the output, this is an NTFS partition starting at 0x00100000
bytes (the number in the first column of the third line)= 1048576 bytes = 1MiB.
Another possible output would be
00000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00100000 eb 58 90 4d 53 44 4f 53 35 2e 30 00 02 20 2c 09 |.X.MSDOS5.0.. ,.|
00100010 02 00 00 00 00 f8 00 00 3f 00 ff 00 00 08 00 00 |........?.......|
00100020 00 18 b7 03 6a 3b 00 00 00 00 00 00 02 00 00 00 |....j;..........|
00100030 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00100040 80 00 29 24 bf 89 6e 4e 4f 20 4e 41 4d 45 20 20 |..)$..nNO NAME |
00100050 20 20 46 41 54 33 32 20 20 20 33 c9 8e d1 bc f4 | FAT32 3.....|
00100060 7b 8e c1 8e d9 bd 00 7c 88 56 40 88 4e 02 8a 56 |{......|.V@.N..V|
00100070 40 b4 41 bb aa 55 cd 13 72 10 81 fb 55 aa 75 0a |@.A..U..r...U.u.|
If you see the .X.MSDOS5
on the third line of the output, this is a FAT32 partition starting at 0x00100000
bytes (the number in the first column of the third line) = 1048576 bytes = 1MiB.
We don’t really care what type of partition (fat32 or ntfs) it is, what we need is the offset: the number in the first column, 00100000
in both cases above. This is an hexadecimal number. So 0x00100000
= 1048576
= 1MiB
Step 2: Backup the partition
Copy the raw partition to a disk image with sudo dd if=/dev/rdisk2 of=copy.img bs=1048576 skip=1
(replace rdisk2
with the number of the disk from the previous steps and note the r
before disk
), this will take some time depending on the size of the drive.
Detail:
-
if=
: input file;
-
/dev/rdisk2
: the disk from the steps above, rdisk
instead of disk
will copy faster;
-
of=
: output file;
-
bs=1048576
: tells dd
to copy 1MiB sized blocks;
-
skip=1
: tells dd
to skip one block at the beginning (which size is defined by bs=
above) because out partition starts at 1MiB. This is the most important part, you need to adapt it according to the partition offset you’ve found in step1.
Now you should have a copy of the raw partition as copy.img
in your home folder.
Step 3: Mount the partition
That’s the easy part: hdiutil attach copy.img
You should now see a new “drive” on your desktop, this is your partition.