Partition recoverability with APFS in the mix (was: gpart destroy, in depth)

On 18/04/2023 19:22, Dan Langille wrote:
> Graham Perrin wrote on 4/11/23 1:46 PM:
>> On 11/04/2023 14:32, Dmitry Morozovsky wrote:
>>>> …
>>> I suppose sysutils/testdisk will be useful for recovering, as most of actual
>>> file systems are left intact
>>
>>
>> Thanks, I forgot that the utility has this capability.
>>
>> This reignites hope of recovery without a third party.
>>
>> …
>>
>> Also, thanks to the people who responded privately.
>>
> Any update on this please?


Thanks for asking.

<https://markmail.org/message/tjc6owwbq37nojad> recalls that the drive 
is in an iMac. At the time, I didn't know which version of macOS ran 
before I used gpart to destroy the partition table.

I found a 2020 record of an upgrade to Mojave. Then, from 
<https://en.wikipedia.org/wiki/MacOS_Mojave#Changes>:

"… When Mojave is installed, it will convert solid-state drives (SSDs), 
hard disk drives (HDDs), and Fusion Drives, from HFS Plus to APFS. …"

With the content of the original drive cloned to an external HDD, I ran 
four utilities for short periods (not long enough to scan every block):

a) the testdisk-7.1 port of CGSecurity TestDisk 
<https://www.cgsecurity.org/wiki/TestDisk>

b) Disk Drill <https://www.cleverfiles.com/>

c) Stellar Data Recovery 
<https://www.stellarinfo.com/free-mac-data-recovery.php>

d) EaseUS Data Recovery Wizard 
<https://www.easeus.com/mac-data-recovery-software/> for macOS.

TestDisk quickly detected an HFS Plus partition alone. No surprise; HFS 
Plus is amongst the explicitly supported file systems, APFS is not. 
Allowing TestDisk to write the detected table produced a partition with 
no useful content (Disk Utility detected no file system and, of course, 
the Mac could not boot from the drive).

Disk Drill very quickly detected a few volumes, which was encouraging, 
however I saw nothing that might equate to the APFS volume/filesystem 
that includes /Users.

Stellar Data Recovery seemed to lack the ability to quickly detect 
partitions/volumes.

EaseUS Data Recovery Wizard (free edition): early results were *very* 
encouraging, so I *did* allow it to scan the entire drive. The end 
result is comparable to what pictured in the second screenshot on page 7 
of the user guide 
<https://www.easeus.com/support/download/docs/pdf/Data_Recovery_Wizard_for_Mac_User_Guide.pdf>. 


I'm to meet the end user on Monday afternoon.

In the meantime: tomorrow, I might run an outdated (circa 2020?) version 
of Outlook, on another iMac, to tell how it stores local-only email. 
(I'll not need help with this – I'm familiar enough with hidden 
application support directories, group containers and so on.) Also, I 
might save the result of the EaseUS scan, then rerun Disk Drill and 
allow a full scan.