From nobody Wed Apr 19 20:40:06 2023 X-Original-To: freebsd-hackers@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Q1t2f1BGZz46Qv2 for ; Wed, 19 Apr 2023 20:40:10 +0000 (UTC) (envelope-from grahamperrin@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [IPv6:2610:1c1:1:606c::24b:4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Q1t2d66sMz3Pt3 for ; Wed, 19 Apr 2023 20:40:09 +0000 (UTC) (envelope-from grahamperrin@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1681936809; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=wGlSLGruoqTNCkghKxTIPrliEIs4to53BX7lO3SohZ0=; b=qOpxrpKAFFJoXd4/2OzSibRIBJ8C+3vs5YPLMNUib8GCifTFopLfNiXbc9v09ci9J32/Cu 1axHgTEA6toS/FE0TLxVcExWZhvvM9/DCmiqm7UNM3AAkH2z8vxQv9Q4A6PEOfNqqxKFyX UWjsU0I1mlTmuKChWhoStmXRllRWmr4sBrTLZvCKzOj2pN2Xsrgi2CIV42ymVv+xzOcaym G9VdMlkTEPHPyHIfGJcxCz3HF9/A7Xo4Im3YOc4r7JHh0G/lY2h9OTSR2nv8zV7Rw5Frt+ G+0lJIfmkVoKEPe0KRTUVevSoCUScivcu2u06AwaeMKzIhQK4CG+HPBruZdFgw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1681936809; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=wGlSLGruoqTNCkghKxTIPrliEIs4to53BX7lO3SohZ0=; b=AxGIylOGOsz38Jt1c1cIspaG/lFHYc3HAastqN4Mi6L6zhAXzUb16v5dnTtENPyBG/p5hU UNjG8iiXL2GwNJ55jaNMYFz87ElF6jQnoxRhndDICW8VNItunponldR+opYQDNNj2ZgstZ Jo22LzNHV2HWYZyn4Ih6TmADMAI+dPf2Ce25xGUrhErETGOHiJ5ejrGtd1Uuo7gI9/4wDO COgtgXuySiq/PeRQQTTInR85DVaaLr7YVBW9i7+yXYM4iSsVEaE8u3QZyQJFzScqlzU7oQ /4t4rXWi/8d9C/4L86kowgn8jwg/NakHdWeiGtXLoCWHO4/TLN8x6SX8x2lkRg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1681936809; a=rsa-sha256; cv=none; b=qcYHajDFYr748aj9JzIZg08QPgDaWw8rnFdhhcDzE2yQcifTvJfr+5VFNszWEF8W4c6MjJ jkIGPol0ufAmQ7xY4oxTStszALoirXJHIqO+/YaqRam0cWZ3l/9bvPIx64a5VNp0rsS3Me Csdu3nbnBTDYP39j1JhIoYvbihYc4mw+KN/5Muv+Dt112AyRpkfS3JGddeSk7k8WwV1pTr hH9XRuhpUcHMrO3ObVeAlVCAgEbTv/4kV2T+Pg9f84ETUlGVc7KBVE+JkPoGYcnOXDNmwE ZIY4rZ8ZwEi++E0/Blvt9H4HKWVg//+qu/dqm3qgCePhF2wxg0eZuaAcIXi4lw== Received: from [192.168.1.10] (host-2-100-161-236.as13285.net [2.100.161.236]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: grahamperrin) by smtp.freebsd.org (Postfix) with ESMTPSA id 4Q1t2d3n1qzQZS for ; Wed, 19 Apr 2023 20:40:09 +0000 (UTC) (envelope-from grahamperrin@freebsd.org) Message-ID: <89493d05-2964-89da-802f-7844fda8ece7@freebsd.org> Date: Wed, 19 Apr 2023 21:40:06 +0100 List-Id: Technical discussions relating to FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-hackers List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-hackers@freebsd.org MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:102.0) Gecko/20100101 Thunderbird/102.10.0 Subject: Partition recoverability with APFS in the mix (was: gpart destroy, in depth) To: freebsd-hackers@freebsd.org References: <64e88636-1e03-7ff5-7d3f-e8a36117cdbe@freebsd.org> <29390cd8-56cd-aced-990a-f2b25a00aaed@freebsd.org> <0acc8ae5-b154-dd5f-1d63-fb8c00f260ed@langille.org> Content-Language: en-US From: Graham Perrin Organization: FreeBSD In-Reply-To: <0acc8ae5-b154-dd5f-1d63-fb8c00f260ed@langille.org> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="------------deyXQwQA8FA4TEQEWunJmVBk" X-ThisMailContainsUnwantedMimeParts: N This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------deyXQwQA8FA4TEQEWunJmVBk Content-Type: multipart/mixed; boundary="------------WJCzbGxjdeBSOlIC8kPcUCXZ"; protected-headers="v1" From: Graham Perrin To: freebsd-hackers@freebsd.org Message-ID: <89493d05-2964-89da-802f-7844fda8ece7@freebsd.org> Subject: Partition recoverability with APFS in the mix (was: gpart destroy, in depth) References: <64e88636-1e03-7ff5-7d3f-e8a36117cdbe@freebsd.org> <29390cd8-56cd-aced-990a-f2b25a00aaed@freebsd.org> <0acc8ae5-b154-dd5f-1d63-fb8c00f260ed@langille.org> In-Reply-To: <0acc8ae5-b154-dd5f-1d63-fb8c00f260ed@langille.org> --------------WJCzbGxjdeBSOlIC8kPcUCXZ Content-Type: multipart/alternative; boundary="------------7CXoISfZd16tP8mBn3GCHRTi" --------------7CXoISfZd16tP8mBn3GCHRTi Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: base64 T24gMTgvMDQvMjAyMyAxOToyMiwgRGFuIExhbmdpbGxlIHdyb3RlOg0KPiBHcmFoYW0gUGVy cmluIHdyb3RlIG9uIDQvMTEvMjMgMTo0NiBQTToNCj4+IE9uIDExLzA0LzIwMjMgMTQ6MzIs IERtaXRyeSBNb3Jvem92c2t5IHdyb3RlOg0KPj4+PiDigKYNCj4+PiBJIHN1cHBvc2Ugc3lz dXRpbHMvdGVzdGRpc2sgd2lsbCBiZSB1c2VmdWwgZm9yIHJlY292ZXJpbmcsIGFzIG1vc3Qg b2YgYWN0dWFsDQo+Pj4gZmlsZSBzeXN0ZW1zIGFyZSBsZWZ0IGludGFjdA0KPj4NCj4+DQo+ PiBUaGFua3MsIEkgZm9yZ290IHRoYXQgdGhlIHV0aWxpdHkgaGFzIHRoaXMgY2FwYWJpbGl0 eS4NCj4+DQo+PiBUaGlzIHJlaWduaXRlcyBob3BlIG9mIHJlY292ZXJ5IHdpdGhvdXQgYSB0 aGlyZCBwYXJ0eS4NCj4+DQo+PiDigKYNCj4+DQo+PiBBbHNvLCB0aGFua3MgdG8gdGhlIHBl b3BsZSB3aG8gcmVzcG9uZGVkIHByaXZhdGVseS4NCj4+DQo+IEFueSB1cGRhdGUgb24gdGhp cyBwbGVhc2U/DQoNCg0KVGhhbmtzIGZvciBhc2tpbmcuDQoNCjxodHRwczovL21hcmttYWls Lm9yZy9tZXNzYWdlL3RqYzZvd3dicTM3bm9qYWQ+IHJlY2FsbHMgdGhhdCB0aGUgZHJpdmUg DQppcyBpbiBhbiBpTWFjLiBBdCB0aGUgdGltZSwgSSBkaWRuJ3Qga25vdyB3aGljaCB2ZXJz aW9uIG9mIG1hY09TIHJhbiANCmJlZm9yZSBJIHVzZWQgZ3BhcnQgdG8gZGVzdHJveSB0aGUg cGFydGl0aW9uIHRhYmxlLg0KDQpJIGZvdW5kIGEgMjAyMCByZWNvcmQgb2YgYW4gdXBncmFk ZSB0byBNb2phdmUuIFRoZW4sIGZyb20gDQo8aHR0cHM6Ly9lbi53aWtpcGVkaWEub3JnL3dp a2kvTWFjT1NfTW9qYXZlI0NoYW5nZXM+Og0KDQoi4oCmIFdoZW4gTW9qYXZlIGlzIGluc3Rh bGxlZCwgaXQgd2lsbCBjb252ZXJ0IHNvbGlkLXN0YXRlIGRyaXZlcyAoU1NEcyksIA0KaGFy ZCBkaXNrIGRyaXZlcyAoSEREcyksIGFuZCBGdXNpb24gRHJpdmVzLCBmcm9tIEhGUyBQbHVz IHRvIEFQRlMuIOKApiINCg0KV2l0aCB0aGUgY29udGVudCBvZiB0aGUgb3JpZ2luYWwgZHJp dmUgY2xvbmVkIHRvIGFuIGV4dGVybmFsIEhERCwgSSByYW4gDQpmb3VyIHV0aWxpdGllcyBm b3Igc2hvcnQgcGVyaW9kcyAobm90IGxvbmcgZW5vdWdoIHRvIHNjYW4gZXZlcnkgYmxvY2sp Og0KDQphKSB0aGUgdGVzdGRpc2stNy4xIHBvcnQgb2YgQ0dTZWN1cml0eSBUZXN0RGlzayAN CjxodHRwczovL3d3dy5jZ3NlY3VyaXR5Lm9yZy93aWtpL1Rlc3REaXNrPg0KDQpiKSBEaXNr IERyaWxsIDxodHRwczovL3d3dy5jbGV2ZXJmaWxlcy5jb20vPg0KDQpjKSBTdGVsbGFyIERh dGEgUmVjb3ZlcnkgDQo8aHR0cHM6Ly93d3cuc3RlbGxhcmluZm8uY29tL2ZyZWUtbWFjLWRh dGEtcmVjb3ZlcnkucGhwPg0KDQpkKSBFYXNlVVMgRGF0YSBSZWNvdmVyeSBXaXphcmQgDQo8 aHR0cHM6Ly93d3cuZWFzZXVzLmNvbS9tYWMtZGF0YS1yZWNvdmVyeS1zb2Z0d2FyZS8+IGZv ciBtYWNPUy4NCg0KVGVzdERpc2sgcXVpY2tseSBkZXRlY3RlZCBhbiBIRlMgUGx1cyBwYXJ0 aXRpb24gYWxvbmUuIE5vIHN1cnByaXNlOyBIRlMgDQpQbHVzIGlzIGFtb25nc3QgdGhlIGV4 cGxpY2l0bHkgc3VwcG9ydGVkIGZpbGUgc3lzdGVtcywgQVBGUyBpcyBub3QuIA0KQWxsb3dp bmcgVGVzdERpc2sgdG8gd3JpdGUgdGhlIGRldGVjdGVkIHRhYmxlIHByb2R1Y2VkIGEgcGFy dGl0aW9uIHdpdGggDQpubyB1c2VmdWwgY29udGVudCAoRGlzayBVdGlsaXR5IGRldGVjdGVk IG5vIGZpbGUgc3lzdGVtIGFuZCwgb2YgY291cnNlLCANCnRoZSBNYWMgY291bGQgbm90IGJv b3QgZnJvbSB0aGUgZHJpdmUpLg0KDQpEaXNrIERyaWxsIHZlcnkgcXVpY2tseSBkZXRlY3Rl ZCBhIGZldyB2b2x1bWVzLCB3aGljaCB3YXMgZW5jb3VyYWdpbmcsIA0KaG93ZXZlciBJIHNh dyBub3RoaW5nIHRoYXQgbWlnaHQgZXF1YXRlIHRvIHRoZSBBUEZTIHZvbHVtZS9maWxlc3lz dGVtIA0KdGhhdCBpbmNsdWRlcyAvVXNlcnMuDQoNClN0ZWxsYXIgRGF0YSBSZWNvdmVyeSBz ZWVtZWQgdG8gbGFjayB0aGUgYWJpbGl0eSB0byBxdWlja2x5IGRldGVjdCANCnBhcnRpdGlv bnMvdm9sdW1lcy4NCg0KRWFzZVVTIERhdGEgUmVjb3ZlcnkgV2l6YXJkIChmcmVlIGVkaXRp b24pOiBlYXJseSByZXN1bHRzIHdlcmUgKnZlcnkqIA0KZW5jb3VyYWdpbmcsIHNvIEkgKmRp ZCogYWxsb3cgaXQgdG8gc2NhbiB0aGUgZW50aXJlIGRyaXZlLiBUaGUgZW5kIA0KcmVzdWx0 IGlzIGNvbXBhcmFibGUgdG8gd2hhdCBwaWN0dXJlZCBpbiB0aGUgc2Vjb25kIHNjcmVlbnNo b3Qgb24gcGFnZSA3IA0Kb2YgdGhlIHVzZXIgZ3VpZGUgDQo8aHR0cHM6Ly93d3cuZWFzZXVz LmNvbS9zdXBwb3J0L2Rvd25sb2FkL2RvY3MvcGRmL0RhdGFfUmVjb3ZlcnlfV2l6YXJkX2Zv cl9NYWNfVXNlcl9HdWlkZS5wZGY+LiANCg0KDQpJJ20gdG8gbWVldCB0aGUgZW5kIHVzZXIg b24gTW9uZGF5IGFmdGVybm9vbi4NCg0KSW4gdGhlIG1lYW50aW1lOiB0b21vcnJvdywgSSBt aWdodCBydW4gYW4gb3V0ZGF0ZWQgKGNpcmNhIDIwMjA/KSB2ZXJzaW9uIA0Kb2YgT3V0bG9v aywgb24gYW5vdGhlciBpTWFjLCB0byB0ZWxsIGhvdyBpdCBzdG9yZXMgbG9jYWwtb25seSBl bWFpbC4gDQooSSdsbCBub3QgbmVlZCBoZWxwIHdpdGggdGhpcyDigJMgSSdtIGZhbWlsaWFy IGVub3VnaCB3aXRoIGhpZGRlbiANCmFwcGxpY2F0aW9uIHN1cHBvcnQgZGlyZWN0b3JpZXMs IGdyb3VwIGNvbnRhaW5lcnMgYW5kIHNvIG9uLikgQWxzbywgSSANCm1pZ2h0IHNhdmUgdGhl IHJlc3VsdCBvZiB0aGUgRWFzZVVTIHNjYW4sIHRoZW4gcmVydW4gRGlzayBEcmlsbCBhbmQg DQphbGxvdyBhIGZ1bGwgc2Nhbi4NCg0K --------------7CXoISfZd16tP8mBn3GCHRTi Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On 18/04/2023 19:22, Dan Langille wrote:
Graham Perrin wrote on 4/11/23 1:46 PM:
On 11/04/2023 14:32, Dmitry Morozovsky wrote:
=E2=80=A6 
I suppose sysutils/testd=
isk will be useful for recovering, as most of actual=20
file systems are left intact


Thanks, I forgot that the utility has this capability.

This reignites hope of recovery without a third party.

=E2=80=A6=C2=A0

Also, thanks to the people who responded privately.

Any update on this please?


Thanks for asking.

<https://markmail.org/message/tjc6owwbq37nojad= > recalls that the drive is in an iMac. At the time, I didn't know which version of macOS ran before I used gpart to destroy the partition table.

I found a 2020 record of an upgrade to Mojave. Then, from <https://en.wikipedia.org/wiki/MacOS_Mojav= e#Changes>:

"=E2=80=A6 When Mojave is installed, it will convert solid-state dr= ives (SSDs), hard disk drives (HDDs), and Fusion Drives, from HFS Plus to APFS. =E2=80=A6"

With the content of the original drive cloned to an external HDD, I ran four utilities for short periods (not long enough to scan every block):

a) the testdisk-7.1 port of CGSecurity TestDisk

b) Disk Drill

c) S= tellar Data Recovery

d) EaseU= S Data Recovery Wizard for macOS.

TestDisk quickly detected an HFS Plus partition alone. No surprise; HFS Plus is amongst the explicitly supported file systems, APFS is not. Allowing TestDisk to write the detected table produced a partition with no useful content (Disk Utility detected no file system and, of course, the Mac could not boot from the drive).

Disk Drill very quickly detected a few volumes, which was encouraging, however I saw nothing that might equate to the APFS volume/filesystem that includes /Users.

Stellar Data Recovery seemed to lack the ability to quickly detect partitions/volumes.

EaseUS Data Recovery Wizard (free edition): early results were = very encouraging, so I did allow it to scan the entire drive. The end result is comparable to what pictured in the second screenshot on page 7 of the user guide.

I'm to meet the end user on Monday afternoon.

In the meantime: tomorrow, I might run an outdated (circa 2020?) version of Outlook, on another iMac, to tell how it stores local-only email. (I'll not need help with this =E2=80=93 I'm famil= iar enough with hidden application support directories, group containers and so on.) Also, I might save the result of the EaseUS scan, then rerun Disk Drill and allow a full scan.

--------------7CXoISfZd16tP8mBn3GCHRTi-- --------------WJCzbGxjdeBSOlIC8kPcUCXZ-- --------------deyXQwQA8FA4TEQEWunJmVBk Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature" -----BEGIN PGP SIGNATURE----- wsF5BAABCAAjFiEEWT/lssMHB+28ly8Kt2dIb0oY1AsFAmRAUacFAwAAAAAACgkQt2dIb0oY1AvP 8hAApPte3r+rBSd4xAy69rM9toPDiyNJrHfUeIg9a4iTEbPYvEsB/8TdCVHg9zCE0RHr/hE4Wwfc a3UMXyv6RS0ZdZb2ybX9aXUny3bL5UEyXM/28fqNdgotec5H9N6oCiTc7XqH/9fFkJipwCOGx6ZW btsy6IeWi7gOBzQWM5mkvw6suzDgZDdYxUQTE7WW6ClV48fz/T2F+q3+dxafaWijJOARkF0Ndp86 2DLGDQn02dJ3tQM2yq/9KneDCpRZ+VULkDIR+fGWIn97NxcAKRfmPSC/e/36jStVJvRdTmp1eY2y n/h2RC0Hyw81jUBqK9KQQZ8/CM50td2OjYwAn0lyUd6HSM13800MvJcqe7FZmUhotJJlanQMQ5lA B6yMp+jmpb+5A4hpQYt3WWiKFBD+FSRdfCZccHvmM25GO6uMKRtdru1lyCj16yQbmq+v6KNfyYo7 gCq/CFDwthIjrtwk8t15hXVh6u3jNjTq2K4wuq8AxSucBTNKm8oKye1RzQ4ezCCjD20Uj6eUjexa 2OzRQ2SdZ96mWmX9Rn6Um3BvqMXzT+auX9nRkQRar8ybmQo10WEjr6QSzxzN36an8tqqZHHO1t7l boR2ALXKxuFG/LZtxwDm+JFuUQTvmVhzhms5BZ6OzVGN1g5MH6UfEtkaeF5+7dOKXsgFc0kCNzU7 HTc= =pnSQ -----END PGP SIGNATURE----- --------------deyXQwQA8FA4TEQEWunJmVBk--