Sample Header Ad - 728x90

Plugged USB stick into macbook and all data was wiped

1 vote
1 answer
237 views
I plugged a 32GB usb stick into a 2019 macbook pro and all data was automatically and immediately removed. OSX shows no data on the stick. There used to be data on the stick. I went back to my linux box and checked. Sure enough, OSX had done something to the filesystem so it was empty and then it created the normal hidden files (.fseventsd, .Spotlight-V100). On linux, I started a file recovery tool to get my data back and that worked fine but I lost the file names. What I'd like to know is wtf did OSX do to my drive and how to reverse it? This also happened once before a long time ago with a 1TB ntfs external hdd that I forgot about so I'm sure this is a common problem. Here is the flashdrive filsystem info after OSX changed it: >sudo file -s /dev/sdh /dev/sdh: DOS/MBR boot sector MS-MBR XP english at offset 0x12c "Invalid partition table" at offset 0x144 "Error loading operating system" at offset 0x163 "Missing operating system", disk signature 0x6f55f075; partition 1 : ID=0xc, start-CHS (0x0,63,1), end-CHS (0x270,96,1), startsector 8064, 60559488 sectors FAT32 Before, it was probably something like this (different usb flashdrive): >sudo file -s /dev/sdh /dev/sdi: DOS/MBR boot sector; partition 1 : ID=0xb, start-CHS (0x3ff,254,63), end-CHS (0x3ff,254,63), startsector 2, 121065982 sectors, extended partition table (last) FAT32 (LBA) Looks like the filesystems are slightly different now. Does anyone know if there is a simple fsck command I can run to just repair the filesystem on the stick (and get the file names/dir structure back)? I know all the data is still there after running a recovery util. I'm not too familiar with filesystem implementation details. **Edit**: I tried to reproduce this by repartitioning+reformatting the stick with fdisk (extended 0xb and norm 0xc) and mkfs.vfat but no luck. I did manage to reproduce it when using mkfs.ntfs (mkntfs v2015.3.14AR.1 (libntfs-3g)). Maybe the flashdrive was formatted with ntfs? It was so long ago I can't be sure. At least with that all I can say is DON'T PLUG A NTFS STICK INTO A MAC! I'm happy to get more details if you need.
Asked by extracrispy (111 rep)
Feb 13, 2021, 01:41 AM
Last activity: Feb 15, 2021, 05:24 PM