Can’t see external HDD partition in Disk Utility

disk-utilityhard driventfspartition

I have a TB external HDD divided in 2 partition:

First partition: 280 GB
Second partition: 1720 GB

Initially, both partitions were NTFS.

Then, I formatted the first partition to macOS Extended FS, and then to FAT32,
and the second partition vanished. I can't see it in Disk Utilities nor in Paragon NTFS 15.

I tried to revert first partition to NTFS, but the second one is still not showing… What should I do?

here is the result of diskutil list

~ diskutil list
  /dev/disk0 (internal, physical):
     #:                       TYPE NAME                    SIZE       IDENTIFIER
     0:      GUID_partition_scheme                        *250.1 GB   disk0
     1:                        EFI EFI                     209.7 MB   disk0s1
     2:                 Apple_APFS Container disk1         249.8 GB   disk0s2

  /dev/disk1 (synthesized):
     #:                       TYPE NAME                    SIZE       IDENTIFIER
     0:      APFS Container Scheme -                      +249.8 GB   disk1
                                   Physical Store disk0s2
     1:                APFS Volume Macintosh HD            119.9 GB   disk1s1
     2:                APFS Volume Preboot                 20.5 MB    disk1s2
     3:                APFS Volume Recovery                503.9 MB   disk1s3
     4:                APFS Volume VM                      5.4 GB     disk1s4

  /dev/disk2 (external, physical):
     #:                       TYPE NAME                    SIZE       IDENTIFIER
     0:     FDisk_partition_scheme                        *2.0 TB     disk2
     1:               Windows_NTFS HDD1                    228.4 GB   disk2s1

Here is the result of sudo fdisk /dev/disk2

~ sudo fdisk /dev/disk2
    Disk: /dev/disk2    geometry: 243201/255/63 [3907029167 sectors]
    Signature: 0xAA55
             Starting       Ending
     #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
    ------------------------------------------------------------------------
    *1: 07 1023 254  63 - 1023 254  63 [    206848 -  446126158] HPFS/QNX/AUX
     2: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
     3: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
     4: 00    0   0   0 -    0   0   0 [         0 -          0] unused

EDIT:

$ sudo dd if=/dev/disk2 bs=512 skip=446333006 count=150000000 | grep -o -a -b "BOOTMGR"

71010552671:BOOTMGR
71010552692:BOOTMGR
150000000+0 records in
150000000+0 records out
76800000000 bytes transferred in 11355.441546 secs (6763277 bytes/sec)

Best Answer

There is only one partition on your external drive. I suspect that instead of erasing the first partition, you erased the entire drive. But if this were true, then the new partition would span the entire drive. So at this point, it would be best to try and find the missing partition.

The correct function to find the header of a missing NTFS partitions is given below. To use this function, you will need to first copy this function and then paste as a command in a Terminal application window.

findntfs() { sudo bash -c "for i in {$1..$2};do xxd -a -s \$[\$i*1000000] -l 1000000 $3|fgrep -a -b 'NTFS    ';echo -en '\r'\$i:;done";echo done;}

Below is a example of its use. I have a 4 GB NTFS formatted flash drive. The output from sudo fdisk /dev/disk1 is given below.

Disk: /dev/disk1    geometry: 968/128/63 [7811072 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: 07    1   0   1 -  967  81  18 [      8064 -    7803008] HPFS/QNX/AUX
 2: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 3: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 4: 00    0   0   0 -    0   0   0 [         0 -          0] unused

Since the flash drive contains 7811072 sectors and the sector size is 512 bytes, the drive size is exactly 3999268864 bytes, which is the product of the two numbers. If wanted to search the entire flash drive for a NTFS partition, I would need to search from 0 MB to 3999 MB of data. An example of using findntfs to do this is shown below.

Marlin:~ davidanderson$ findntfs 0 3999 /dev/disk1
Password:
3:70:003f0000: eb52 904e 5446 5320 2020 2000 0208 0000  .R.NTFS    .....
3998:1125334:ee5ffe00: eb52 904e 5446 5320 2020 2000 0208 0000  .R.NTFS    .....
3999:done
Marlin:~ davidanderson$

Note: While this function is executing, you will see values being updated. This is current megabyte being searched. From these values, you can determine the progress of the search.

The important information to extract from this output are the hexadecimal values 003f0000 and ee5ffe00. These values are the offset in bytes for the first and last sectors of the NTFS partition.

Below is the compute value of the byte location of the first sector based on the value shown from the output of fdisk.

8064 * 512 = 4128768 = 0x3F0000

Below is the compute value of the byte location of the last sector based on the value shown from the output of fdisk.

(8064 + 7803008 - 1) * 512 =  3999268352  = 0xEE5FFE00

Both of these values match the output from findntfs.

In your case, I would suggest looking for the beginning of your missing partition somewhere around 270 GB to 290 GB. For this, the command would be as shown below.

findntfs 270000 290000 /dev/disk2

Of course, this may take a while. If you feel lucky, you can try narrowing your search.

I would suggest looking for the ending of your missing partition somewhere around 1980398 GB to 2000398 GB. For this, the command would be as shown below.

findntfs 1980398 2000398 /dev/disk2

The function below looks into the found sector and prints out the number of sectors occupied by the candidate NTFS partition. The input is the offset of the partition in bytes and the drive name.

ntfssectors() {(n=$(sudo hexdump -e '1/8 "%u"' -s $((0x$1+40)) -n 8 $2); echo $(($n+1)))}

Below is an example where this function is used.

Note: The input is assumed to be hexadecimal.

Marlin:~ davidanderson$ ntfssectors2 003F0000 /dev/disk1
7803008
Marlin:~ davidanderson$ ntfssectors2 ee5ffe00 /dev/disk1
7803008
Marlin:~ davidanderson$

The output from both functions is the same as from fdisk.

Related Question