Restore a deleted Mac partition table

Last Friday, I was attempting to install Windows on my partners iMac without a DVD/CD drive, and I had set up the drive in bootcamp, and committed the system to reboot. The Windows setup started, however when selecting the installation directory, Windows did not like the formatting that Bootcamp had setup, so it offered to delete the partition and recreate it's own NTFS partition - which I opted to do.

Still, Windows setup didn't like something about the disk - spitting out and error and not being able to proceed. A bit of (in hindsight amateurish) Google'ing and I found a solution to "clean the disk" which I accidentally interpreted as cleaning the partition. This was my downfall. What made the situation worse is that the TimeMachine backup which I thought was complete was in fact not complete, and hadn't been backing up for some time.

Crisis!

Having had a little experience with data recovery in the past, I straight away jumped on the data recovery search train and started my search for software which I could use to rebuild the partition table. The problem I found was that many sites and software packages were offering solutions based on disks which were either external drives or secondary to the operating system, which were useless to me, as the entire boot drive's partition table had been deleted.

Many hours of searching and looking at possible solutions included a number of data recovery programs which promised to recover partition tables or extract files from the hard disk but none prevailed. All I could do is boot from a USB stick or use the inbuilt Internet Recovery feature which comes with all Macs. This was dangerous as I didn't want to write to the hard disk, and I wanted maximise my recovery chances by avoiding any writing at all.

The hardest part was finding software which could look at HFS+ data recovery, or rebuilding partitions. Many programs promised the world, but even the trial versions did not deliver. In the end I found a completely free solution which I am happy to share with you now, so you can enjoy my happiness at being able to recover all that data by rebuilding the partition table.

In order to follow my guide, this only applies to Macs which don't have an optical drive.

You'll need:

• Another computer to download install and use some software to help with this recovery.
• A USB stick/thumb drive of at least 1gb in size (I used a 4gb stick)
• A copy of an Ubuntu iso file (I used ubuntu-13.10-desktop-amd64+mac.iso - note the amd64+mac component of this file)
• Download a copy of the freeware software "unetbootin"
• A (relatively) fast internet connection with an ethernet connect to your modem - wifi won't work.
• A USB keyboard and mouse - any should do. The bluetooth wireless mouse and keyboard that comes with most macs won't work throughout the whole process.

The guide:

1. Once you've downloaded Ubuntu and unetbootin, insert your USB stick and burn a copy of Ubuntu to the USB stick so that you can boot from the USB stick (you can browse to the .iso file you downloaded which I would recommend instead of downloading on the fly).
2. Plug the USB stick, keyboard and mouse into the damaged Mac and hold the option key when powering up. If you're using a non-mac keyboard, hold ALT on the left.
3. Choose the USB icon to boot from and the unetbootin menu should appear, follow the menu to boot into Ubuntu which is the live version of ubuntu which you can use to test the OS, rather than install it.
4. Within a few minutes you should be in the ubuntu desktop environment. Once there, go into the settings (cog icon on the left menu bar)
5. Open software settings and enable all software from all repositories.
6. Open a terminal window (click the ubuntu menu, then type terminal) and type "sudo apt-get update". This will update your software repositories which is necessary for the next step.
7. Install a software program called TestDisk by typing: "sudo apt-get install testdisk". This will download and install testdisk on your system which we will use to interpret the damaged hard drive.
8. Once complete, type sudo testdisk to open the program.
9. The next few parts will be a bunch of questions asked by the software before it can begin scanning.
• Decide if you want a log created (I didn't care)
• Select the disk which relates to your Mac's Drive
• Then it asks about the partition type - select Mac
• The next choice should be analyse
• And then quick search.
• It will start scanning with items in green lines indicating partitions the software has found.
10. After it has finished you should get some results showing the missing partitions!!
11. At this screen, do not touch the keyboard yet. Grab the mouse and select the results and copy them. Then either write them down (not recommended as you could make a mistake which could cause SERIOUS problems later) or email them to yourself.
12. My results looked like this: 
    
13. You can now reboot your Mac.
14. Once it restarts take out the Ubuntu USB stick and hold down command (or the windows key if a non-mac keyboard) and R
15. This will start Internet recovery. Once at the Internet recovery menu, you can open a terminal window using the utilities menu.
16. With the terminal window type ls (to LiSt the files of the directory you're in)
17. Type "cd .." to navigate up one level in the folder structure.
18. Type ls again
19. Continue to do this until you reach the root directory, which will show "dev" when you do a ls command. Then type cd /dev/
20. This will move you to the dev directory. At this point ensure your terminal window is as big as possible, use full screen if you can. Type ls again
21. This will list all the devices on the mac. This is also where it becomes a bit difficult, so it's important to focus on what you are doing otherwise you could damage your disk even more.
22. Type pdisk - this opens the pdisk program within terminal which allows you to make changes to your computers hard disk.
23. Type L (note the capital) and hit enter - this will list the disks attached to your computer and should indicate which disk is required - this will be the disk we are looking for. For me, it was rdisk0 or rdisk1 (I can't remember which).
24. Quit the program, by typing q, and then reopen the program by typing "pdisk /dev/rdisk0" (CAREFUL: your rdisk number could be different based on your result in step 23)
25. Type c (lowercase). It should tell you that no partition map exists - which is correct - it doesn't yet, but we are about to recreate it.
26. Type i (also lowercase). It will tell you some stuff about block sizes and the size of your hard disk in blocks.
27. Type c again. Before anything else - get your info from step 12 above.
28. In my example the first block was 409640 and the length was the "size in sectors" part, which for me was 1756533456. So type your first block part, hit enter then type your length. Then hit enter again and name it anything just don't use spaces - I just typed the word: one 
29. Repeat this process for as many partitions that you had - I had 2. So I then typed c again to tell the program I had another partition to create, then 1756943096 and 1269536 and named it: two
30. Then once you've typed in all your partitions, instead of typing c again, type w
31. It might prompt you to confirm you want to write the changes, say that you do (y)
32. Then type q to quit the program. Now restart your mac, holding down the option key.
33. Your hard drive should appear. And you can boot back into OSX.
34. First thing you should do now is setup a Time Machine Backup

I hope this has saved you from a sticky situation like it did for me. If you want to share the incredible moment I had yelling like Boris did in James Bond's Goldeneye feel free to buy me a drink:

If you liked this post, or found it useful, please feel free to share with your friends to pass the info on using the buttons below. Alternatively, if you're stuck, feel free to post your comments - chances are you are not the only one who got stuck at some point!