User Tools

Site Tools


os:linux:read_hfsplus

Read HFS+ Partition

Problem

You got an external harddrive which was used on a Mac. Now you have to read the data but you linux distribution doesn't recognize the partitions. You only have the device /dev/sdb. fdisk doesn't display partitions:

$ sudo fdisk -l /dev/sdb

Disk /dev/sdb: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x515d5868

   Device Boot      Start         End      Blocks   Id  System

Solution

Short Version

  1. Save partition to a file
  2. Mount file

Long Version

Testdisk ist required for the following steps

Execute testdrive on the external drive.

$ sudo testdisk /dev/sdb

Select disk.

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

  TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.

Select a media (use Arrow keys, then press Enter):
>Disk /dev/sdb - 320 GB / 298 GiB - LaCie Rugged FW/USB


>[Proceed ]  [  Quit  ]

Note: Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has incorrect size, check HD jumper settings, BIOS
detection, and install the latest OS patches and disk drivers.

Tell testdrive that there is an Apple partition map on it.

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org


Disk /dev/sdb - 320 GB / 298 GiB - LaCie Rugged FW/USB

Please select the partition table type, press Enter when done.
 [Intel  ] Intel/PC partition
 [EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
 [Humax  ] Humax partition table
>[Mac    ] Apple partition map
 [None   ] Non partitioned media
 [Sun    ] Sun Solaris partition
 [XBox   ] XBox partition
 [Return ] Return to disk selection


Hint: Mac partition table type has been detected.
Note: Do NOT select 'None' for media with only a single partition. It's very
rare for a drive to be 'Non-partitioned'.

Select advanced options.

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org


Disk /dev/sdb - 320 GB / 298 GiB - LaCie Rugged FW/USB
     CHS 38913 255 63 - sector size=512

 [ Analyse  ] Analyse current partition structure and search for lost partitions
>[ Advanced ] Filesystem Utils
 [ Geometry ] Change disk geometry
 [ Options  ] Modify options
 [ Quit     ] Return to disk selection


Note: Correct disk geometry is required for a successful recovery. 'Analyse'
process may give some warnings if it thinks the logical geometry is mismatched.

Select HFS partition.

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63

     Partition                  Start        End    Size in sectors
  1 P partition_map                  1         63         63
  2 P Driver43                      64        191        128
  3 P Driver_ATA                   192        319        128
  4 P FWDriver                     320        543        224
  5 P Free                         544        799        256
> 6 P HFS                          800  625142447  625141648


 [  Type  ]  [Superblock] >[Image Creation]  [  Quit  ]
                                Create an image

Select Image Creation. Choose a destination folder for the image file with a minimum free space of the capacity of the external hard drive. This step may take several hours.

The resulting image (image.dd) can now be mounted.

$ sudo mount -o loop,ro image.dd /mnt/
os/linux/read_hfsplus.txt · Last modified: 2014-12-18 20:08 by 127.0.0.1