Partition recoverability with APFS in the mix (was: gpart destroy, in depth)

From: Graham Perrin <>
Date: Wed, 19 Apr 2023 20:40:06 UTC
On 18/04/2023 19:22, Dan Langille wrote:
> Graham Perrin wrote on 4/11/23 1:46 PM:
>> On 11/04/2023 14:32, Dmitry Morozovsky wrote:
>>>> …
>>> I suppose sysutils/testdisk will be useful for recovering, as most of actual
>>> file systems are left intact
>> Thanks, I forgot that the utility has this capability.
>> This reignites hope of recovery without a third party.
>> …
>> Also, thanks to the people who responded privately.
> Any update on this please?

Thanks for asking.

<> recalls that the drive 
is in an iMac. At the time, I didn't know which version of macOS ran 
before I used gpart to destroy the partition table.

I found a 2020 record of an upgrade to Mojave. Then, from 

"… When Mojave is installed, it will convert solid-state drives (SSDs), 
hard disk drives (HDDs), and Fusion Drives, from HFS Plus to APFS. …"

With the content of the original drive cloned to an external HDD, I ran 
four utilities for short periods (not long enough to scan every block):

a) the testdisk-7.1 port of CGSecurity TestDisk 

b) Disk Drill <>

c) Stellar Data Recovery 

d) EaseUS Data Recovery Wizard 
<> for macOS.

TestDisk quickly detected an HFS Plus partition alone. No surprise; HFS 
Plus is amongst the explicitly supported file systems, APFS is not. 
Allowing TestDisk to write the detected table produced a partition with 
no useful content (Disk Utility detected no file system and, of course, 
the Mac could not boot from the drive).

Disk Drill very quickly detected a few volumes, which was encouraging, 
however I saw nothing that might equate to the APFS volume/filesystem 
that includes /Users.

Stellar Data Recovery seemed to lack the ability to quickly detect 

EaseUS Data Recovery Wizard (free edition): early results were *very* 
encouraging, so I *did* allow it to scan the entire drive. The end 
result is comparable to what pictured in the second screenshot on page 7 
of the user guide 

I'm to meet the end user on Monday afternoon.

In the meantime: tomorrow, I might run an outdated (circa 2020?) version 
of Outlook, on another iMac, to tell how it stores local-only email. 
(I'll not need help with this – I'm familiar enough with hidden 
application support directories, group containers and so on.) Also, I 
might save the result of the EaseUS scan, then rerun Disk Drill and 
allow a full scan.