Win7-damaged Mac GPT partition map on 4TB external HDD

Question

I recently did a not-so-intelligent thing: I was installing Win 7 64bit on a new PC and I took my old Mac-formatted 4TB external HDD and mounted it internally on the PC.

What I did not realize was that Win 7 cannot recognize HDD's with more than 3TB capacity. While I was installing Win 7, it destroyed the original GPT partition map of the 4TB drive and replaced it with a MBR. Now I am left with an unrecognizable disk, both by Windows and by my MacBook Pro with Mavericks on.

Here is some of the info that I got from Terminal:

Rians-MacBook-Pro:~ RVL$ sudo gpt -r -vvv show -l /dev/disk1
gpt show: /dev/disk1: mediasize=4000787025920; sectorsize=4096; blocks=976754645
gpt show: /dev/disk1: MBR at sector 0
gpt show: /dev/disk1: Pri GPT at sector 1
gpt show: /dev/disk1: GPT partition: type=48465300-0000-11AA-AA11-00306543ECAC, 
start=6, size=51200
gpt show: /dev/disk1: GPT partition: type=48465300-0000-11AA-AA11-00306543ECAC, 
start=51206, size=976670666
gpt show: /dev/disk1: Sec GPT at sector 976754644
      start       size  index  contents
          0          1         MBR
          1          1         Pri GPT header
          2          4         Pri GPT table
          6      51200      1  GPT part - "EFI System Partition"
      51206  976670666      2  GPT part - "Mac Ext 6"
  976721872      32768         
  976754640          4         Sec GPT table
  976754644          1         Sec GPT header

Is there any way that I can restore the original GPT map and of course the data on the disk? What was particularly troubling was the following:

Rians-MacBook-Pro:~ RVL$ sudo fdisk /dev/disk1
Password:
Disk: /dev/disk1    geometry: 60800/255/63 [976754645 sectors]
Sector size: 4096 bytes
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 2: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 3: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 4: 00    0   0   0 -    0   0   0 [         0 -          0] unused 

Does the above mean all the data is destroyed or is there a ray of hope. Is there anybody out there who can help? Thanks!

Answer 1

There is hope if Windows didn't write anything to disk (except the MBR). The steps below overwrite the bogus MBR and replaces it by a proper PMBR and a GUID partition table. All previous entries will be restored.

• Attach the external drive to a Mac
• Open Terminal and enter diskutil list and sudo gpt -r show /dev/diskX with X the disk identifier of the 4 TB drive (e.g. if you find that the disk identifier is disk1, replace in the commands above and below diskX by disk1).
• Unmount the disk with diskutil umountDisk /dev/diskX
• Enter sudo dd if=/dev/random of=/dev/diskX count=1 bs=512 to overwrite the MBR
• Unmount the disk again with diskutil umountDisk /dev/diskX
• Enter sudo gpt destroy /dev/diskX #just in case, this might fail
• Then enter sudo gpt create /dev/diskX
• if the last command fails you may overwrite the MBR again with sudo dd if=/dev/random of=/dev/diskX count=1 bs=4096 and reenter the last command: sudo gpt create /dev/diskX

• Enter sudo gpt -r show /dev/diskX and check if PMBR and GUID partition header/table occupy the first six blocks (block0-block5). This is the case if the disk controller reports a block size of 4096 Bytes instead of 512 bytes.*

  In case of a 4096 logical block size the GUID partition table should look like this now:

  gpt show: /dev/diskX: Sec GPT at sector 976754644
        start       size  index  contents
            0          1         MBR
            1          1         Pri GPT header
            2          4         Pri GPT table
            6  976754634           
    976754640          4         Sec GPT table
    976754644          1         Sec GPT header
  

• Then re-populate the GUID partition table with the above data (the type of the EFI partition is different though):

  sudo gpt add -b 6 -i 1 -s 51200 -t C12A7328-F81F-11D2-BA4B-00A0C93EC93B /dev/diskX
  sudo gpt add -b 51206 -i 2 -s 976670666 -t 48465300-0000-11AA-AA11-00306543ECAC /dev/diskX
  

• Check the disk and the volume with

  diskutil verifyDisk /dev/diskX
  diskutil verifyVolume /dev/diskXs2
  

---

* Add a comment if you get a different list after the steps sudo gpt create /dev/diskX -> sudo gpt -r show /dev/diskX e.g the PMBR and the GUID partition table occupy the first 34 blocks (block0-block33). Then the disk controller reports a block size of 512 Bytes.