Frank's Blog

Once upon a day… there was an Apple Imac with OS 10.5 that denied to startup.
The grey screen with the apple logo and the circulating little thing just didn’t disappear.
So I was called.
I started the system while pressing cmd-v between the “taaa”-chime and the apple logo appearing. So the system switch to text mode and gave me some more informations. It stucked with an hd error. So, the problem was found.
I started the Mac again with an appropiate install cd and pressing “c” to boot the little system with the helper tools.
After selecting the language I ignored the installation dialog and started the disk utility from the menu bar.
But disk utiliy didn’t find partition, just the whole harddisc without any information.
I quit the graphical disk utility and started a Terminal in which I typed:
“diskutil list”. This tool was able to show the lost partitions.
So, there was some information left, but how recover them ?
I searched for a tool for recovering the partition table on OSX.
testdisk should do this, but I cannot bring it to run on the install system quickly so I decided to give it a try with the Linux distribution CAINE. It’s a live system to do forensics analysis and also contains the testdist tool.
Booting from the fresh burned CAINE disc took some time but finally I had a Linux desktop (which I not really needed for now) and started testdisk within terminal.

Testdisk found the lost partitions and let me write them back to the EFI sector.
So far so good.
I started the diskutility from the install cd again and now it listed the partitions but kindda incomplete (marked in light grey) and verify and repair fails.

Now I changed my strategy. There is a harddisc problem anyway, so I have to replace it. But I would like to recover the user data on it. Therefore I don’t have to start the installed OSX. Instead I started again CAINE which let me mount the partition without any problems and I copied the home folder via network and rsync to another Mac.
Problem solved for this time (what took me so long ?).