Date: Wed, 19 Apr 2023 21:40:06 +0100 From: Graham Perrin <grahamperrin@freebsd.org> To: freebsd-hackers@freebsd.org Subject: Partition recoverability with APFS in the mix (was: gpart destroy, in depth) Message-ID: <89493d05-2964-89da-802f-7844fda8ece7@freebsd.org> In-Reply-To: <0acc8ae5-b154-dd5f-1d63-fb8c00f260ed@langille.org> References: <64e88636-1e03-7ff5-7d3f-e8a36117cdbe@freebsd.org> <alpine.BSF.2.00.2304111630560.32077@woozle.rinet.ru> <29390cd8-56cd-aced-990a-f2b25a00aaed@freebsd.org> <0acc8ae5-b154-dd5f-1d63-fb8c00f260ed@langille.org>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------deyXQwQA8FA4TEQEWunJmVBk
Content-Type: multipart/mixed; boundary="------------WJCzbGxjdeBSOlIC8kPcUCXZ";
protected-headers="v1"
From: Graham Perrin <grahamperrin@freebsd.org>
To: freebsd-hackers@freebsd.org
Message-ID: <89493d05-2964-89da-802f-7844fda8ece7@freebsd.org>
Subject: Partition recoverability with APFS in the mix (was: gpart destroy, in
depth)
References: <64e88636-1e03-7ff5-7d3f-e8a36117cdbe@freebsd.org>
<alpine.BSF.2.00.2304111630560.32077@woozle.rinet.ru>
<29390cd8-56cd-aced-990a-f2b25a00aaed@freebsd.org>
<0acc8ae5-b154-dd5f-1d63-fb8c00f260ed@langille.org>
In-Reply-To: <0acc8ae5-b154-dd5f-1d63-fb8c00f260ed@langille.org>
--------------WJCzbGxjdeBSOlIC8kPcUCXZ
Content-Type: multipart/alternative;
boundary="------------7CXoISfZd16tP8mBn3GCHRTi"
--------------7CXoISfZd16tP8mBn3GCHRTi
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64
T24gMTgvMDQvMjAyMyAxOToyMiwgRGFuIExhbmdpbGxlIHdyb3RlOg0KPiBHcmFoYW0gUGVy
cmluIHdyb3RlIG9uIDQvMTEvMjMgMTo0NiBQTToNCj4+IE9uIDExLzA0LzIwMjMgMTQ6MzIs
IERtaXRyeSBNb3Jvem92c2t5IHdyb3RlOg0KPj4+PiDigKYNCj4+PiBJIHN1cHBvc2Ugc3lz
dXRpbHMvdGVzdGRpc2sgd2lsbCBiZSB1c2VmdWwgZm9yIHJlY292ZXJpbmcsIGFzIG1vc3Qg
b2YgYWN0dWFsDQo+Pj4gZmlsZSBzeXN0ZW1zIGFyZSBsZWZ0IGludGFjdA0KPj4NCj4+DQo+
PiBUaGFua3MsIEkgZm9yZ290IHRoYXQgdGhlIHV0aWxpdHkgaGFzIHRoaXMgY2FwYWJpbGl0
eS4NCj4+DQo+PiBUaGlzIHJlaWduaXRlcyBob3BlIG9mIHJlY292ZXJ5IHdpdGhvdXQgYSB0
aGlyZCBwYXJ0eS4NCj4+DQo+PiDigKYNCj4+DQo+PiBBbHNvLCB0aGFua3MgdG8gdGhlIHBl
b3BsZSB3aG8gcmVzcG9uZGVkIHByaXZhdGVseS4NCj4+DQo+IEFueSB1cGRhdGUgb24gdGhp
cyBwbGVhc2U/DQoNCg0KVGhhbmtzIGZvciBhc2tpbmcuDQoNCjxodHRwczovL21hcmttYWls
Lm9yZy9tZXNzYWdlL3RqYzZvd3dicTM3bm9qYWQ+IHJlY2FsbHMgdGhhdCB0aGUgZHJpdmUg
DQppcyBpbiBhbiBpTWFjLiBBdCB0aGUgdGltZSwgSSBkaWRuJ3Qga25vdyB3aGljaCB2ZXJz
aW9uIG9mIG1hY09TIHJhbiANCmJlZm9yZSBJIHVzZWQgZ3BhcnQgdG8gZGVzdHJveSB0aGUg
cGFydGl0aW9uIHRhYmxlLg0KDQpJIGZvdW5kIGEgMjAyMCByZWNvcmQgb2YgYW4gdXBncmFk
ZSB0byBNb2phdmUuIFRoZW4sIGZyb20gDQo8aHR0cHM6Ly9lbi53aWtpcGVkaWEub3JnL3dp
a2kvTWFjT1NfTW9qYXZlI0NoYW5nZXM+Og0KDQoi4oCmIFdoZW4gTW9qYXZlIGlzIGluc3Rh
bGxlZCwgaXQgd2lsbCBjb252ZXJ0IHNvbGlkLXN0YXRlIGRyaXZlcyAoU1NEcyksIA0KaGFy
ZCBkaXNrIGRyaXZlcyAoSEREcyksIGFuZCBGdXNpb24gRHJpdmVzLCBmcm9tIEhGUyBQbHVz
IHRvIEFQRlMuIOKApiINCg0KV2l0aCB0aGUgY29udGVudCBvZiB0aGUgb3JpZ2luYWwgZHJp
dmUgY2xvbmVkIHRvIGFuIGV4dGVybmFsIEhERCwgSSByYW4gDQpmb3VyIHV0aWxpdGllcyBm
b3Igc2hvcnQgcGVyaW9kcyAobm90IGxvbmcgZW5vdWdoIHRvIHNjYW4gZXZlcnkgYmxvY2sp
Og0KDQphKSB0aGUgdGVzdGRpc2stNy4xIHBvcnQgb2YgQ0dTZWN1cml0eSBUZXN0RGlzayAN
CjxodHRwczovL3d3dy5jZ3NlY3VyaXR5Lm9yZy93aWtpL1Rlc3REaXNrPg0KDQpiKSBEaXNr
IERyaWxsIDxodHRwczovL3d3dy5jbGV2ZXJmaWxlcy5jb20vPg0KDQpjKSBTdGVsbGFyIERh
dGEgUmVjb3ZlcnkgDQo8aHR0cHM6Ly93d3cuc3RlbGxhcmluZm8uY29tL2ZyZWUtbWFjLWRh
dGEtcmVjb3ZlcnkucGhwPg0KDQpkKSBFYXNlVVMgRGF0YSBSZWNvdmVyeSBXaXphcmQgDQo8
aHR0cHM6Ly93d3cuZWFzZXVzLmNvbS9tYWMtZGF0YS1yZWNvdmVyeS1zb2Z0d2FyZS8+IGZv
ciBtYWNPUy4NCg0KVGVzdERpc2sgcXVpY2tseSBkZXRlY3RlZCBhbiBIRlMgUGx1cyBwYXJ0
aXRpb24gYWxvbmUuIE5vIHN1cnByaXNlOyBIRlMgDQpQbHVzIGlzIGFtb25nc3QgdGhlIGV4
cGxpY2l0bHkgc3VwcG9ydGVkIGZpbGUgc3lzdGVtcywgQVBGUyBpcyBub3QuIA0KQWxsb3dp
bmcgVGVzdERpc2sgdG8gd3JpdGUgdGhlIGRldGVjdGVkIHRhYmxlIHByb2R1Y2VkIGEgcGFy
dGl0aW9uIHdpdGggDQpubyB1c2VmdWwgY29udGVudCAoRGlzayBVdGlsaXR5IGRldGVjdGVk
IG5vIGZpbGUgc3lzdGVtIGFuZCwgb2YgY291cnNlLCANCnRoZSBNYWMgY291bGQgbm90IGJv
b3QgZnJvbSB0aGUgZHJpdmUpLg0KDQpEaXNrIERyaWxsIHZlcnkgcXVpY2tseSBkZXRlY3Rl
ZCBhIGZldyB2b2x1bWVzLCB3aGljaCB3YXMgZW5jb3VyYWdpbmcsIA0KaG93ZXZlciBJIHNh
dyBub3RoaW5nIHRoYXQgbWlnaHQgZXF1YXRlIHRvIHRoZSBBUEZTIHZvbHVtZS9maWxlc3lz
dGVtIA0KdGhhdCBpbmNsdWRlcyAvVXNlcnMuDQoNClN0ZWxsYXIgRGF0YSBSZWNvdmVyeSBz
ZWVtZWQgdG8gbGFjayB0aGUgYWJpbGl0eSB0byBxdWlja2x5IGRldGVjdCANCnBhcnRpdGlv
bnMvdm9sdW1lcy4NCg0KRWFzZVVTIERhdGEgUmVjb3ZlcnkgV2l6YXJkIChmcmVlIGVkaXRp
b24pOiBlYXJseSByZXN1bHRzIHdlcmUgKnZlcnkqIA0KZW5jb3VyYWdpbmcsIHNvIEkgKmRp
ZCogYWxsb3cgaXQgdG8gc2NhbiB0aGUgZW50aXJlIGRyaXZlLiBUaGUgZW5kIA0KcmVzdWx0
IGlzIGNvbXBhcmFibGUgdG8gd2hhdCBwaWN0dXJlZCBpbiB0aGUgc2Vjb25kIHNjcmVlbnNo
b3Qgb24gcGFnZSA3IA0Kb2YgdGhlIHVzZXIgZ3VpZGUgDQo8aHR0cHM6Ly93d3cuZWFzZXVz
LmNvbS9zdXBwb3J0L2Rvd25sb2FkL2RvY3MvcGRmL0RhdGFfUmVjb3ZlcnlfV2l6YXJkX2Zv
cl9NYWNfVXNlcl9HdWlkZS5wZGY+LiANCg0KDQpJJ20gdG8gbWVldCB0aGUgZW5kIHVzZXIg
b24gTW9uZGF5IGFmdGVybm9vbi4NCg0KSW4gdGhlIG1lYW50aW1lOiB0b21vcnJvdywgSSBt
aWdodCBydW4gYW4gb3V0ZGF0ZWQgKGNpcmNhIDIwMjA/KSB2ZXJzaW9uIA0Kb2YgT3V0bG9v
aywgb24gYW5vdGhlciBpTWFjLCB0byB0ZWxsIGhvdyBpdCBzdG9yZXMgbG9jYWwtb25seSBl
bWFpbC4gDQooSSdsbCBub3QgbmVlZCBoZWxwIHdpdGggdGhpcyDigJMgSSdtIGZhbWlsaWFy
IGVub3VnaCB3aXRoIGhpZGRlbiANCmFwcGxpY2F0aW9uIHN1cHBvcnQgZGlyZWN0b3JpZXMs
IGdyb3VwIGNvbnRhaW5lcnMgYW5kIHNvIG9uLikgQWxzbywgSSANCm1pZ2h0IHNhdmUgdGhl
IHJlc3VsdCBvZiB0aGUgRWFzZVVTIHNjYW4sIHRoZW4gcmVydW4gRGlzayBEcmlsbCBhbmQg
DQphbGxvdyBhIGZ1bGwgc2Nhbi4NCg0K
--------------7CXoISfZd16tP8mBn3GCHRTi
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<html data-lt-installed=3D"true">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF=
-8">
<script data-cookieconsent=3D"ignore" src=3D"moz-extension://29fb402e=
-105a-42a3-9cdf-d9151b2bcb17/content/executor.js"></script>
</head>
<body style=3D"padding-bottom: 1px;">
<div class=3D"moz-cite-prefix">On 18/04/2023 19:22, Dan Langille
wrote:<br>
</div>
<blockquote type=3D"cite"
cite=3D"mid:0acc8ae5-b154-dd5f-1d63-fb8c00f260ed@langille.org">
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DU=
TF-8">
<span>Graham Perrin wrote on 4/11/23 1:46 PM:</span><br>
<blockquote type=3D"cite"
cite=3D"mid:29390cd8-56cd-aced-990a-f2b25a00aaed@freebsd.org"
style=3D"padding-bottom: 1px;">
<meta http-equiv=3D"Content-Type" content=3D"text/html;
charset=3DUTF-8">
<script data-cookieconsent=3D"ignore" src=3D"moz-extension://29fb=
402e-105a-42a3-9cdf-d9151b2bcb17/content/executor.js"></script>
<div class=3D"moz-cite-prefix">On 11/04/2023 14:32, Dmitry
Morozovsky wrote:<br>
</div>
<blockquote type=3D"cite"
cite=3D"mid:alpine.BSF.2.00.2304111630560.32077@woozle.rinet.ru=
">
<blockquote type=3D"cite" style=3D"color: #007cff;">
<pre class=3D"moz-quote-pre" wrap=3D"">=E2=80=A6 </pre>
</blockquote>
<pre class=3D"moz-quote-pre" wrap=3D"">I suppose sysutils/testd=
isk will be useful for recovering, as most of actual=20
file systems are left intact</pre>
</blockquote>
<p><br>
</p>
<p>Thanks, I forgot that the utility has this capability. <br>
</p>
<p>This reignites hope of recovery without a third party. <br>
</p>
=E2=80=A6=C2=A0
<p>Also, thanks to the people who responded privately. <br>
</p>
<lt-container></lt-container></blockquote>
Any update on this please?</blockquote>
<p><br>
</p>
<p>Thanks for asking. <br>
</p>
<p><a class=3D"moz-txt-link-rfc2396E" href=3D"https://markmail.org/me=
ssage/tjc6owwbq37nojad"><https://markmail.org/message/tjc6owwbq37nojad=
></a> recalls
that the drive is in an iMac. At the time, I didn't know which
version of macOS ran before I used gpart to destroy the partition
table. <br>
</p>
<p>I found a 2020 record of an upgrade to Mojave. Then, from
<a class=3D"moz-txt-link-rfc2396E" href=3D"https://en.wikipedia.org=
/wiki/MacOS_Mojave#Changes"><https://en.wikipedia.org/wiki/MacOS_Mojav=
e#Changes></a>:<br>
<br>
"=E2=80=A6 When Mojave is installed, it will convert solid-state dr=
ives
(SSDs), hard disk drives (HDDs), and Fusion Drives, from HFS Plus
to APFS. =E2=80=A6"</p>
<p>With the content of the original drive cloned to an external HDD,
I ran four utilities for short periods (not long enough to scan
every block): <br>
</p>
<p>a) the testdisk-7.1 port of CGSecurity <a moz-do-not-send=3D"true"=
href=3D"https://www.cgsecurity.org/wiki/TestDisk">TestDisk</a>; <b=
r>
</p>
<p>b) <a moz-do-not-send=3D"true" href=3D"https://www.cleverfiles.com=
/">Disk
Drill</a><br>
</p>
<p>c) <a moz-do-not-send=3D"true"
href=3D"https://www.stellarinfo.com/free-mac-data-recovery.php">S=
tellar
Data Recovery</a></p>
<p>d) <a moz-do-not-send=3D"true"
href=3D"https://www.easeus.com/mac-data-recovery-software/">EaseU=
S
Data Recovery Wizard</a> for macOS.<br>
</p>
<p>TestDisk quickly detected an HFS Plus partition alone. No
surprise; HFS Plus is amongst the explicitly supported file
systems, APFS is not. Allowing TestDisk to write the detected
table produced a partition with no useful content (Disk Utility
detected no file system and, of course, the Mac could not boot
from the drive).<br>
</p>
<p>Disk Drill very quickly detected a few volumes, which was
encouraging, however I saw nothing that might equate to the APFS
volume/filesystem that includes /Users. <br>
</p>
<p> Stellar Data Recovery seemed to lack the ability to quickly
detect partitions/volumes. <br>
</p>
<p>EaseUS Data Recovery Wizard (free edition): early results were <b>=
very</b>
encouraging, so I <b>did</b> allow it to scan the entire drive.
The end result is comparable to what pictured in the second
screenshot on page 7 of <a moz-do-not-send=3D"true"
href=3D"https://www.easeus.com/support/download/docs/pdf/Data_Recovery_Wi=
zard_for_Mac_User_Guide.pdf">the
user guide</a>. <br>
</p>
<p>I'm to meet the end user on Monday afternoon. <br>
</p>
<p>In the meantime: tomorrow, I might run an outdated (circa 2020?)
version of Outlook, on another iMac, to tell how it stores
local-only email. (I'll not need help with this =E2=80=93 I'm famil=
iar
enough with hidden application support directories, group
containers and so on.) Also, I might save the result of the EaseUS
scan, then rerun Disk Drill and allow a full scan. <br>
</p>
</body>
</html>
--------------7CXoISfZd16tP8mBn3GCHRTi--
--------------WJCzbGxjdeBSOlIC8kPcUCXZ--
--------------deyXQwQA8FA4TEQEWunJmVBk
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEEWT/lssMHB+28ly8Kt2dIb0oY1AsFAmRAUacFAwAAAAAACgkQt2dIb0oY1AvP
8hAApPte3r+rBSd4xAy69rM9toPDiyNJrHfUeIg9a4iTEbPYvEsB/8TdCVHg9zCE0RHr/hE4Wwfc
a3UMXyv6RS0ZdZb2ybX9aXUny3bL5UEyXM/28fqNdgotec5H9N6oCiTc7XqH/9fFkJipwCOGx6ZW
btsy6IeWi7gOBzQWM5mkvw6suzDgZDdYxUQTE7WW6ClV48fz/T2F+q3+dxafaWijJOARkF0Ndp86
2DLGDQn02dJ3tQM2yq/9KneDCpRZ+VULkDIR+fGWIn97NxcAKRfmPSC/e/36jStVJvRdTmp1eY2y
n/h2RC0Hyw81jUBqK9KQQZ8/CM50td2OjYwAn0lyUd6HSM13800MvJcqe7FZmUhotJJlanQMQ5lA
B6yMp+jmpb+5A4hpQYt3WWiKFBD+FSRdfCZccHvmM25GO6uMKRtdru1lyCj16yQbmq+v6KNfyYo7
gCq/CFDwthIjrtwk8t15hXVh6u3jNjTq2K4wuq8AxSucBTNKm8oKye1RzQ4ezCCjD20Uj6eUjexa
2OzRQ2SdZ96mWmX9Rn6Um3BvqMXzT+auX9nRkQRar8ybmQo10WEjr6QSzxzN36an8tqqZHHO1t7l
boR2ALXKxuFG/LZtxwDm+JFuUQTvmVhzhms5BZ6OzVGN1g5MH6UfEtkaeF5+7dOKXsgFc0kCNzU7
HTc=
=pnSQ
-----END PGP SIGNATURE-----
--------------deyXQwQA8FA4TEQEWunJmVBk--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?89493d05-2964-89da-802f-7844fda8ece7>