Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

HELP Disk Utility Erased My drive!!!

N

NanoMeko

macrumors member
Original poster
Mar 24, 2009
32
0
I have an external NTFS drive from which I was trying to copy some files to my macbook pro 10.6.6. I was getting error 36 so with disk utility I clicked on Repair Disk. Now all my data is gone!!
 
I'm sorry to hear about that. I believe that Repair Disk is intended to repair Mac disks only. If you look in the help for Disk Utility, it says that you can't repair write-protected disks. OS X can't natively write to NTFS, but the drive itself isn't locked, which is, I imagine, where the problem was.

You could try to use a data recovery program to get as much data back as you can.
 
Thanks. That's probably what happened. I think Paragon NTFS for mac had the drive unlocked and disk repair messed it up.

Here is a log and it does show that some data was deleted..

2011-02-12 16:25:31 +0100: Deleting attribute 0x80 . File 0x183ca.
2011-02-12 16:25:31 +0100: File "5. Views, Drawing, and Animation (January 19, 2010).mp4" does not contain data attribute
2011-02-12 16:25:31 +0100: Attribute 0x80 has AllocatedSize not multiple of frame size 65536.
2011-02-12 16:25:31 +0100: Deleting attribute 0x80 . File 0x183cb.
2011-02-12 16:25:31 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x183cb.
2011-02-12 16:25:31 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x183ce.
2011-02-12 16:25:31 +0100: Deleting attribute 0x80 . File 0x183ce.
2011-02-12 16:25:32 +0100: File "6. Designing iPhone Applications, Model-View-Controller, View C" does not contain data attribute
2011-02-12 16:25:32 +0100: Attribute 0x80 has AllocatedSize not multiple of frame size 65536.
2011-02-12 16:25:32 +0100: Deleting attribute 0x80 . File 0x183d8.
2011-02-12 16:25:32 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x183d8.
2011-02-12 16:25:32 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x183da.
2011-02-12 16:25:32 +0100: Deleting attribute 0x80 . File 0x183da.
2011-02-12 16:25:32 +0100: File "Really Achieving Your Childhood Dreams.m4v" does not contain data attribute
2011-02-12 16:25:32 +0100: Attribute 0x80 has AllocatedSize not multiple of frame size 65536.
2011-02-12 16:25:32 +0100: Deleting attribute 0x80 . File 0x18a8a.
2011-02-12 16:25:32 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x18a8a.
2011-02-12 16:25:32 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x18a8c.
2011-02-12 16:25:32 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x18a8d.
2011-02-12 16:25:32 +0100: Deleting attribute 0x80 . File 0x18a8c.
2011-02-12 16:25:32 +0100: Deleting attribute 0x80 . File 0x18a8d.
2011-02-12 16:25:32 +0100: File "01 Uprising.mp3" does not contain data attribute
2011-02-12 16:25:33 +0100: Attribute 0x80 has AllocatedSize not multiple of frame size 65536.
2011-02-12 16:25:33 +0100: Deleting attribute 0x80 . File 0x1b158.
2011-02-12 16:25:33 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x1b158.
2011-02-12 16:25:33 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x1b1af.
2011-02-12 16:25:33 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x1b3f5.
2011-02-12 16:25:33 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x1b3f8.
2011-02-12 16:25:33 +0100: Deleting attribute 0x80 . File 0x1b1af.
2011-02-12 16:25:33 +0100: Deleting attribute 0x80 . File 0x1b3f5.
2011-02-12 16:25:33 +0100: Deleting attribute 0x80 . File 0x1b3f8.
2011-02-12 16:25:33 +0100: File "91258dc77155306f53dfe84d815fb2a2_0.ddat" does not contain data attribute
2011-02-12 16:25:33 +0100: Fixing corrupt attribute 0x80 in file 0x1b3f3.
2011-02-12 16:25:33 +0100: Attribute 0x80 has AllocatedSize not multiple of frame size 65536.
2011-02-12 16:25:33 +0100: Deleting attribute 0x80 . File 0x1b3fc.
2011-02-12 16:25:33 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x1b3fc.
2011-02-12 16:25:33 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x1b43c.
2011-02-12 16:25:33 +0100: Deleting attribute 0x80 . File 0x1b43c.
2011-02-12 16:25:33 +0100: File "office 2008 12.0.0 english.dmg" does not contain data attribute
2011-02-12 16:25:39 +0100: Fixing corrupt attribute 0x80 in file 0x214b8.
2011-02-12 16:25:39 +0100: Fixing corrupt attribute 0x80 in file 0x21dbf.
2011-02-12 16:25:39 +0100: Fixing corrupt attribute 0x80 in file 0x21dcd.
2011-02-12 16:25:39 +0100: Fixing corrupt attribute 0x80 in file 0x21dde.
2011-02-12 16:26:09 +0100: Attribute 0x80 has AllocatedSize not multiple of frame size 65536.
2011-02-12 16:26:09 +0100: Deleting attribute 0x80 . File 0x48b3d.
2011-02-12 16:26:09 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x48b3d.
2011-02-12 16:26:09 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x48b3f.
2011-02-12 16:26:09 +0100: Deleting attribute 0x80 . File 0x48b3f.
2011-02-12 16:26:09 +0100: File "MVI_6630.MOV" does not contain data attribute
2011-02-12 16:26:09 +0100: Attribute 0x80 has AllocatedSize not multiple of frame size 65536.
2011-02-12 16:26:09 +0100: Deleting attribute 0x80 . File 0x4917f.
2011-02-12 16:26:09 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x4917f.
2011-02-12 16:26:10 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x49181.
2011-02-12 16:26:10 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x49182.
2011-02-12 16:26:10 +0100: Deleting attribute 0x80 . File 0x49181.
2011-02-12 16:26:10 +0100: Deleting attribute 0x80 . File 0x49182.
2011-02-12 16:26:10 +0100: File "Thumb64Segment.data" does not contain data attribute
2011-02-12 16:26:10 +0100: Attribute 0x80 has AllocatedSize not multiple of frame size 65536.
2011-02-12 16:26:10 +0100: Deleting attribute 0x80 . File 0x49183.
2011-02-12 16:26:10 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x49183.
2011-02-12 16:26:10 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x49185.
2011-02-12 16:26:10 +0100: Deleting attribute 0x80 . File 0x49185.
2011-02-12 16:26:10 +0100: File "ThumbJPGSegment.data" does not contain data attribute
2011-02-12 16:26:46 +0100: Attribute 0x80 has AllocatedSize not multiple of frame size 65536.
2011-02-12 16:26:46 +0100: Deleting attribute 0x80 . File 0x8b29e.
2011-02-12 16:26:46 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x8b29e.
2011-02-12 16:26:46 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x8b2a0.
2011-02-12 16:26:46 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x8b2a1.
2011-02-12 16:26:46 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x8b2a2.
2011-02-12 16:26:46 +0100: Deleting attribute 0x80 . File 0x8b2a0.
2011-02-12 16:26:46 +0100: Deleting attribute 0x80 . File 0x8b2a1.
2011-02-12 16:26:46 +0100: Deleting attribute 0x80 . File 0x8b2a2.
2011-02-12 16:26:46 +0100: File "Thumb64Segment.data" does not contain data attribute
2011-02-12 16:26:46 +0100: Attribute 0x80 has AllocatedSize not multiple of frame size 65536.
2011-02-12 16:26:46 +0100: Deleting attribute 0x80 . File 0x8b2a3.
2011-02-12 16:26:46 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x8b2a3.
2011-02-12 16:26:46 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x8b2a5.
2011-02-12 16:26:46 +0100: Deleting corrupt attribute list entry with type code 0x80 in file 0x8b2a6.
2011-02-12 16:26:46 +0100: Deleting attribute 0x80 . File 0x8b2a5.
2011-02-12 16:26:46 +0100: Deleting attribute 0x80 . File 0x8b2a6.
2011-02-12 16:26:46 +0100: File "ThumbJPGSegment.data" does not contain data attribute
2011-02-12 16:26:58 +0100: Deleting orphan record 0x183ba.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x183bd.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x183c1.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x183c6.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x183ca.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x183ce.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x183da.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x18a8c.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x18a8d.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x1b1af.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x1b3f5.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x1b3f8.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x1b43c.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x48b3f.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x49181.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x49182.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x49185.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x8b2a0.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x8b2a1.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x8b2a2.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x8b2a5.
2011-02-12 16:26:58 +0100: Deleting orphan record 0x8b2a6.
2011-02-12 16:26:58 +0100: 94.88 Gb in 569132 files
2011-02-12 16:26:58 +0100: 0 Kb in 0 directories
2011-02-12 16:26:58 +0100: 0 Kb in bad blocks in 0 fragments
2011-02-12 16:26:58 +0100: 125388 Kb in use by the system
2011-02-12 16:26:58 +0100: 0 Kb occupied by the log file
2011-02-12 16:26:58 +0100: 4096 bytes in each allocation unit
2011-02-12 16:26:58 +0100: 61049000 total allocation units on volume
2011-02-12 16:26:58 +0100: 0 allocation units available on volume
2011-02-12 16:26:58 +0100: Errors were found but not fixed 'cause read-only.
2011-02-12 16:26:58 +0100:
2011-02-12 16:27:02 +0100: Repair tool completed:





iThinkergoiMac said:
I'm sorry to hear about that. I believe that Repair Disk is intended to repair Mac disks only. If you look in the help for Disk Utility, it says that you can't repair write-protected disks. OS X can't natively write to NTFS, but the drive itself isn't locked, which is, I imagine, where the problem was.

You could try to use a data recovery program to get as much data back as you can.
Click to expand...
 
That hard drive WAS the archive of my childhood dreams. I backed up everything there before sending my macbook pro for repair... now running Data Rescue 3 but it says 7750 hours remaining while it's checking each block of the hard drive.. I don't have high hopes right now that it will pick up anything.

DmbShn41 said:
So on a side note, have you achieved your childhood dreams?
Click to expand...
 
Your best bet at getting the data back may be DataRescue3. I would disregard the "7750 hours remaining" and just let it run and do its thing. It could indeed take a number of hours to complete the scan.

I would like to say something else, and it's only my opinion (I realize that others' may differ).

Here is one more example on MacRumors.com as to why you should NEVER trust "the archive of my childhood dreams" to anything except A MAC-FORMATTED DRIVE that is never used with PC's (shouting intentional).

It should be Mac-format only, and you should NEVER connect it to a PC. What has happened to the original poster above is mute testimony of why not.

I would like to offer another suggestion to the original poster, and it's a radical one, indeed:

If -- after trying and trying with DataRescue -- you still cannot access your data on the drive "as is", there MIGHT be "another way".

DO THIS AT YOUR OWN RISK (shouting is again very intentional). There is no promise of success. It may very well fail. But then again, it may work (see next paragraph).

I will testify that this solution worked for me, when nothing else seemed to be working.

I had a partition that "went bad on me" and could not be accessed no matter what I tried (note: it was a Mac-formatted partition, not NTFS).

My solution was to RE-INITIALIZE THE ENTIRE DRIVE INTO A SINGLE PARTITION. Yes, I did re-initialize it, and YES, I did intentionally wipe out all the pre-exisiting partitions.

After that, however, DataRescue was able to mount the drive, and it successfully "scavenged" the data on the drives and I got back the majority of the files I was trying to get.

This is possible because data recovery apps like DataRescue don't care about directory information -- so long as the drive can be mounted, they go directly to the data sectors and scavenge (and then re-construct) whatever they can find.

That's why re-initializing a drive and getting rid of previous partitions doesn't matter, because all this really does is reconstruct the directory info, and doing this does not "touch" the actual data that lies scattered about the sectors of the drive.

WARNING WARNING WARNING
DO NOT choose the option to "zero out" the drive! When you do this, you ARE "wiping clean" the actual data sectors of the drive. The ONLY thing you want to "wipe" is the old directory info, by replacing it with a "clean" (re-initialized) directory so that the drive can be mounted, and then accessed, by your data recovery software.

Again, this might work when nothing else does.
Or it might produce no results.
There is no way to know unless you try (after all else fails).

I don't know how this will work with a drive that was previously intialized for NTFS, which I know NOTHING about.

I will again state that this trick worked for me on a Mac-formatted drive with a bad partition when there seemed to be no hope left.

Good luck.
 
Since it is an NTFS drive you need a Windows computer (or run Windows on your Mac via Bootcamp). Then use Nucleus Kernel NTFS for data recovery. It is the most comprehensive data recovery program I know of.

Programs like Data Rescue and Disk Warrior for the Mac are light duty data recovery programs. They can't even scan a disk which has lost it's partition table. So they have to see a HFS+ formatted partition or they won't even look at the drive. They are intended for accidentally deleting a file in the trash.

Nucleus Kernel actually scans the disk surface whether the partition is there or not.

By the way if you are getting insanely long scan times then there is likely a physical hardware problem with the drive. Which has nothing to do with Disk Utility. Disk Utility may have contributed to the problems but the underlying problem has to do with the drive itself.

Also be prepared for a long scan time. Hook the drive up to a Windows PC and begin the recovery with Nucleus Kernel. It could take hours to weeks so turn off any energy saver settings except display sleep.

Edit: Be sure to use a battery backup as well. You don't want to be scanning for a couple of days and lose all your progress due to a 3 second blackout. If the drive head is damaged you can also be making the problem worse by running the drive. So you may want to turn the drive off and use a professional data recovery service.
 
Last edited:
Indeed it was a pretty bad idea using NTFS. I had my drive as NTFS to be able to use it both in windows and mac os.. I guess it would have been safer to use a mac file system or even FAT 32. I believe FAT 32 is more supported in Mac OS and disk utility can repair issues.

The good news is that Data Rescue 3 did retrieve most of my files after leaving it running the whole afternoon and night even with the drive being in NTFS. The files are named funny, and some images look like they're missing the lower part but I'm still sorting through all the data to see what was retrieved it looks like most of it is there without the folder structure etc.

Lessons learned:

  • External drive in NTFS with both mac and windows stuff and funky NTFS drivers for mac os can cause issues negative repercussions.
  • Do not use disk utility to repair an NTFS disk
  • Use FAT 32 if you want a drive that you can use with both mac and pc without having to use other drivers
  • As Fishrman said, use a mac file system format for important stuff or backups




Fishrrman said:
Your best bet at getting the data back may be DataRescue3. I would disregard the "7750 hours remaining" and just let it run and do its thing. It could indeed take a number of hours to complete the scan.

I would like to say something else, and it's only my opinion (I realize that others' may differ).

Here is one more example on MacRumors.com as to why you should NEVER trust "the archive of my childhood dreams" to anything except A MAC-FORMATTED DRIVE that is never used with PC's (shouting intentional).

It should be Mac-format only, and you should NEVER connect it to a PC. What has happened to the original poster above is mute testimony of why not.

I would like to offer another suggestion to the original poster, and it's a radical one, indeed:

If -- after trying and trying with DataRescue -- you still cannot access your data on the drive "as is", there MIGHT be "another way".

DO THIS AT YOUR OWN RISK (shouting is again very intentional). There is no promise of success. It may very well fail. But then again, it may work (see next paragraph).

I will testify that this solution worked for me, when nothing else seemed to be working.

I had a partition that "went bad on me" and could not be accessed no matter what I tried (note: it was a Mac-formatted partition, not NTFS).

My solution was to RE-INITIALIZE THE ENTIRE DRIVE INTO A SINGLE PARTITION. Yes, I did re-initialize it, and YES, I did intentionally wipe out all the pre-exisiting partitions.

After that, however, DataRescue was able to mount the drive, and it successfully "scavenged" the data on the drives and I got back the majority of the files I was trying to get.

This is possible because data recovery apps like DataRescue don't care about directory information -- so long as the drive can be mounted, they go directly to the data sectors and scavenge (and then re-construct) whatever they can find.

That's why re-initializing a drive and getting rid of previous partitions doesn't matter, because all this really does is reconstruct the directory info, and doing this does not "touch" the actual data that lies scattered about the sectors of the drive.

WARNING WARNING WARNING
DO NOT choose the option to "zero out" the drive! When you do this, you ARE "wiping clean" the actual data sectors of the drive. The ONLY thing you want to "wipe" is the old directory info, by replacing it with a "clean" (re-initialized) directory so that the drive can be mounted, and then accessed, by your data recovery software.

Again, this might work when nothing else does.
Or it might produce no results.
There is no way to know unless you try (after all else fails).

I don't know how this will work with a drive that was previously intialized for NTFS, which I know NOTHING about.

I will again state that this trick worked for me on a Mac-formatted drive with a bad partition when there seemed to be no hope left.

Good luck.
Click to expand...
 
"Indeed it was a pretty bad idea using NTFS. I had my drive as NTFS to be able to use it both in windows and mac os.. I guess it would have been safer to use a mac file system or even FAT 32. I believe FAT 32 is more supported in Mac OS and disk utility can repair issues."

No, no, no!

Again -- if the data on the drive is data you care about -- use ONLY a Mac-formatted drive (not partition, the entire DRIVE), and keep it away from PC's.

You've been burned once by this, burned right down to the ground.

Would you like to be burned again?
 
Gotcha, it's safer to use a mac formatted drive and only for backups and only for the mac.

For less critical and important data to be used by both windows and mac machines I wouldn't recommend NTFS since it needs extra drivers to be supported and disk utility doesn't like it.

I'll get a drive just for my mac backups and maybe use time machine instead of just copying the folders.






Fishrrman said:
"Indeed it was a pretty bad idea using NTFS. I had my drive as NTFS to be able to use it both in windows and mac os.. I guess it would have been safer to use a mac file system or even FAT 32. I believe FAT 32 is more supported in Mac OS and disk utility can repair issues."

No, no, no!

Again -- if the data on the drive is data you care about -- use ONLY a Mac-formatted drive (not partition, the entire DRIVE), and keep it away from PC's.

You've been burned once by this, burned right down to the ground.

Would you like to be burned again?
Click to expand...
 
Fishrrman said:
Again -- if the data on the drive is data you care about -- use ONLY a Mac-formatted drive (not partition, the entire DRIVE), and keep it away from PC's.
Click to expand...

This is a bit of FUD. Connecting a Mac-formatted drive to a Windows computer won't do anything, unless the user initiates an erase or something. Not that I recommend plugging your Mac-formatted HDD into every PC you see, but it won't hurt it.

HFS+ is certainly the best format to use if you have a Mac, but it's not because it's inherently safer than other file systems, it's just much better supported by OS X. NTFS and ext3/4 are good file systems in their own right.

NanoMeko said:
I'll get a drive just for my mac backups and maybe use time machine instead of just copying the folders.
Click to expand...

This is a very good idea.
 
"This is a bit of FUD. Connecting a Mac-formatted drive to a Windows computer won't do anything, unless the user initiates an erase or something. Not that I recommend plugging your Mac-formatted HDD into every PC you see, but it won't hurt it."

Not FUD.

Just spend some time browsing the postings here on macrumors.com. This thread is far from being the first one where a user who has a dual-formatted drive, connects it to a pc, and -- poof! -- something goes wrong with the mac-partitioned side. It may have been an inadvertent user error, it may have been something else, but once it happens, good luck on getting things back.

Again, to the original poster:

I would recommend that you DO NOT use Time Machine as your primary backup system.

You need a bootable backup with the files in "plain old Finder format".

Yes, Time Machine has its uses and value. But for an ordinary backup that in many ways will represent an "archive" of your precious files, you need something like CarbonCopyCloner (or SuperDuper).

It takes slightly more effort to create a bootable backup (also called a "clone") using CCC or SD. But the payoff comes that fateful day when you can't boot your Mac and need an "external source" from which to get booted up and running again.

For your precious files do this:
1. Format your backup drive as Mac-formatted only
2. Use CCC or SD instead of Time Machine
3. Backup at least once weekly, twice is better, thrice is better than that.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back