Recreate MacBook Pro's overwritten GPT partition table

Question

Already, neither Testdisk not GParted's rescue option have been able to recover the original partitions, so I think I have to recreate them manually.

I'm on a late 2011 MacBook Pro with the stock 500GB Toshiba HD, and this is what I remember of the table:

• sda1: the 200MB EFI partition
• sda2: my ~400GB FileVault-encrypted OS X 10.9 partition
• sda3: the 650MB Recovery partition
• sda4: a ~254.4MB Linux boot partition
• sda5: a ~98.6GB physical volume for encryption of Linux partitions with LVM

I only care to recover data from the FileVault partition. And I'm thinking that must go one of two ways:

1. Try to decrypt the entire disk (or the first 401GB) according to how sda2 had been encrypted by FileVault, if that's even possible and anyone here knows how I could go about that. I have my password and the recovery key created when I encrypted OS X.

2. Try to recreate the FileVault partition exactly as it was. And I can imagine 2 ways to potentially do that:

a. Somehow scan to determine where the non-encrypted EFI and Recovery Partitions end & begin, respectively. Then, given their exact sizes, I should be able to recreate the first three partitions and be back in business.

b. "Work backwards" to determine the exact space it had occupied on the drive. Someone on a similar machine might be able to help here. I used OS X's (graphical) Disk Utility to resize the FileVault partition from 500GB to ~400GB to accommodate the Linux machine. It initially presented the (parent, sda) drive as containing one partition, Macintosh HD (EFI and Recovery were hidden), and gave me the option to shrink it using the minus icon under the Partition tab. When I did so, I used the slider to get as close to 400GB as possible, but that meant going with "400.01", I think, as the slider seemed to actually be predictably jumping to certain values, the next of which was 399 point something. If someone with the same disk as me who also had FileVault enabled (and more than 100GB free space on their disk) was able to reproduce that slider selection, temporarily partition their disk accordingly, and provide a readout of their partition table, that would be tremendously helpful. that person would forever be my hero. :)

Or, are there any other ideas? Thanks in advance to anyone who has a go at this.

Answer 1

How did you lose the partitions? It's possible that GPT fdisk (gdisk) will be able to help, by recovering data from the backup partition table at the end of the disk. I can't promise this, though.

If not, and if TestDisk and GParted can't find your filesystems, then recovering anything else will be very difficult. On a Mac, the ESP most likely begins on sector 40 and is probably about 200MiB in size. You could start there and move forwards, but I make no promises that you'll be able to recover anything.