Wednesday, 29 July 2009

Apple hfs+ filesystem recovery (or lack of)

Attach a removed disk via a USB->SATA convertor to an Apple. Nothing shows up on the Desktop, so we need to find out what it is doing:


ibook-g4:/var/log root# ps -auxwww | grep fsck
root 161 2.1 0.2 32176 3528 ?? R 4:41PM 0:01.36 /System/Library/Filesystems/hfs.fs/Contents/Resources/../../../../../../sbin/fsck_hfs -y /dev/disk1s2


Disk and slice is identified as /dev/disk1s2


After the fsck_hfs finishes, a quick check of /var/log/system.log :

Jul 29 16:46:55 ibook-g4 diskarbitrationd[39]: unable to repair /dev/disk1s2 (status code 0x00000008).
Jul 29 16:46:55 ibook-g4 diskarbitrationd[39]: disk1s2 hfs 154DC182-5D68-3AA3-A9FD-6E4BE476EDA1 Macintosh HD [not mounted]


Disk manager shows that the disk can be correctly identified, but that it needs repairing.

















Verify disk gives us the following:




Invalid Node Structure
Rebuilding Catalog B-tree.
Invalid key length
The volume Macintosh HD could not be repaired.

Error: The underlying task reported failure on exit



ibook-g4:/var/log root# fsck -y /dev/disk1s2
** /dev/rdisk1s2
BAD SUPER BLOCK: MAGIC NUMBER WRONG

LOOK FOR ALTERNATE SUPERBLOCKS? yes

SEARCH FOR ALTERNATE SUPER-BLOCK FAILED. YOU MUST USE THE
-b OPTION TO FSCK TO SPECIFY THE LOCATION OF AN ALTERNATE
SUPER-BLOCK TO SUPPLY NEEDED INFORMATION; SEE fsck(8).

ibook-g4:/var/log root# fsck -b32 -y /dev/disk1s2
Alternate super block location: 32
** /dev/rdisk1s2
BAD SUPER BLOCK: MAGIC NUMBER WRONG


Oh - all the superblocks have gone bad. This is not good news.

Looking at the disk using the same USB->SATA convertor on an Ubuntu box:


tail -40 /var/log/syslog

Jul 29 19:33:46 marwood kernel: [81890.988175] usb 1-3: new high speed USB device using ehci_hcd and address 11
Jul 29 19:33:46 marwood kernel: [81891.127530] usb 1-3: configuration #1 chosen from 1 choice
Jul 29 19:33:46 marwood kernel: [81891.128938] scsi23 : SCSI emulation for USB Mass Storage devices
Jul 29 19:33:46 marwood kernel: [81891.129314] usb-storage: device found at 11
Jul 29 19:33:46 marwood kernel: [81891.129320] usb-storage: waiting for device to settle before scanning
Jul 29 19:33:49 marwood chipcardd[3651]: devicemanager.c: 3373: Changes in hardware list
Jul 29 19:33:51 marwood kernel: [81896.128548] usb-storage: device scan complete
Jul 29 19:33:51 marwood kernel: [81896.129669] scsi 23:0:0:0: Direct-Access WDC WD32 00AAJS-40RYA0 1B03 PQ: 0 ANSI: 2 CCS
Jul 29 19:33:51 marwood kernel: [81896.134243] sd 23:0:0:0: [sdc] 625142448 512-byte hardware sectors: (320 GB/298 GiB)
Jul 29 19:33:51 marwood kernel: [81896.135014] sd 23:0:0:0: [sdc] Write Protect is off
Jul 29 19:33:51 marwood kernel: [81896.135021] sd 23:0:0:0: [sdc] Mode Sense: 00 38 00 00
Jul 29 19:33:51 marwood kernel: [81896.135027] sd 23:0:0:0: [sdc] Assuming drive cache: write through
Jul 29 19:33:51 marwood kernel: [81896.135763] sd 23:0:0:0: [sdc] 625142448 512-byte hardware sectors: (320 GB/298 GiB)
Jul 29 19:33:51 marwood kernel: [81896.138147] sd 23:0:0:0: [sdc] Write Protect is off
Jul 29 19:33:51 marwood kernel: [81896.138154] sd 23:0:0:0: [sdc] Mode Sense: 00 38 00 00
Jul 29 19:33:51 marwood kernel: [81896.138159] sd 23:0:0:0: [sdc] Assuming drive cache: write through
Jul 29 19:33:51 marwood kernel: [81896.138168] sdc: sdc1 sdc2
Jul 29 19:33:51 marwood kernel: [81896.205175] sd 23:0:0:0: [sdc] Attached SCSI disk
Jul 29 19:33:51 marwood kernel: [81896.205342] sd 23:0:0:0: Attached scsi generic sg3 type 0
Jul 29 19:33:52 marwood kernel: [81897.007131] hfs: Filesystem was not cleanly unmounted, running fsck.hfsplus is recommended. mounting read-only.
Jul 29 19:33:52 marwood hald: mounted /dev/sdc2 on behalf of uid 1000

tng@marwood:/var/log$ df | tail -1
/dev/sdc2 312235312 154942252 157293060 50% /media/disk-1



The filesystem is mounted, but unclean. try running fsck.hfsplus (installed from an apt-get install hfstools):


root@marwood:~# fsck.hfsplus /dev/sdc2
** /dev/sdc2
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
Invalid node structure
(4, 15585)
** Volume check failed.

root@marwood:~# ls -l /sbin/*hfs*
lrwxrwxrwx 1 root root 12 2009-07-29 08:44 /sbin/fsck.hfs -> fsck.hfsplus
-rwxr-xr-x 1 root root 172604 2008-11-06 06:01 /sbin/fsck.hfsplus
lrwxrwxrwx 1 root root 12 2009-07-29 08:44 /sbin/mkfs.hfs -> mkfs.hfsplus
-rwxr-xr-x 1 root root 36528 2008-11-06 06:01 /sbin/mkfs.hfsplus


Looks like I'm stuck.:


root@marwood:~# fsck.hfsplus -d /dev/sdc2
** /dev/sdc2
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
Invalid node structure
(4, 15585)
** Rebuilding Catalog B-tree.
hfs_UNswap_BTNode: invalid node height (1)
hfs_swap_BTNode: record #36 invalid offset (0x000D)
Invalid node structure
(4, 15584)
hfs_swap_BTNode: offsets 28 and 29 out of order (0x0000, 0x0000)
Invalid node structure
(4, 15668)
hfs_swap_BTNode: record #-1 invalid offset (0xFFFF)
Invalid node structure
(4, 15675)
hfs_swap_BTNode: invalid forward link (0xFFFFFFFF)
hfs_swap_BTNode: invalid backward link (0x7FFFFFFF)
hfs_swap_BTNode: invalid node kind (-3)
hfs_swap_BTNode: invalid node height (255)
hfs_swap_BTNode: invalid record count (0xEFFF)
Invalid record count
(4, 15676)
hfs_swap_BTNode: invalid forward link (0xFFFFFFFF)
hfs_swap_BTNode: invalid backward link (0xFFFFFFFF)
hfs_swap_BTNode: invalid node height (255)
hfs_swap_BTNode: invalid record count (0xFFFF)
Invalid record count
(4, 15677)
hfs_swap_BTNode: invalid forward link (0xFFFFFFC0)
hfs_swap_BTNode: invalid backward link (0x007FFFFF)
hfs_swap_BTNode: invalid node kind (-2)
hfs_swap_BTNode: invalid node height (255)
hfs_swap_BTNode: invalid record count (0xFFFF)
Invalid record count
(4, 15678)
hfs_swap_HFSPlusBTInternalNode: catalog key #27 invalid length (0)
Invalid key length
(4, 15752)
** The volume Macintosh HD could not be repaired.
volume type is pure HFS+
primary MDB is at block 0 0x00
alternate MDB is at block 0 0x00
primary VHB is at block 2 0x02
alternate VHB is at block 624470622 0x2538aa5e
sector size = 512 0x200
VolumeObject flags = 0x07
total sectors for volume = 624470624 0x2538aa60
total sectors for embedded volume = 0 0x00

However, it can still be mounted (and the data copied off). This is what I decided to do. The filesystem on the disk is toast.


root@marwood:~# mount /dev/sdc2 /mnt
root@marwood:~# df -h |tail -1
/dev/sdc2 298G 148G 151G 50% /mnt

2 comments:

mm said...

So you managed to put the iMac back together?

tng said...

Yes, Mac back together and data provided on an external caddy.