a client brought in an 160GB external HDD and wanted to get the files off it, there appeared to be no partitions on the disk but i thought it may have been formatted to use the whole disk. I tried to mount it as the various FS types the client thought it may have been to no avail.

I ran testdisk on it which told me that it previously had a mac partition table and a 210GB partition on it (which is larger than the disk) could anyone enlighten me as to whether or not this is even possible, and if so how could i retrieve the data?

I think the First Law of forensics / recovery should read THINK WITH YOUR HEAD, NOT WITH YOUR HANDS because if you don't know a disk then you don't know the condition it's in and you don't know how whatever you (think your should) do alters the contents of the disk. For instance blithely mounting a partition with a journalling file system without "-o ro,norecovery,noload" to prohibit it from loading and replaying the journal may cause irreparable damage. If there's one reflex you should have it's to make a bit copy backup before doing anything else.


Did you try adjusting the C/H/S values inside testdisk to what HW specs are listed on the enclosure?

the fact of the matter is that the data was not important data, i did not ask for a lecture, the only specifications on the enclosure is USB 2.0, and at which point did i say there was no verbatim backups?