vendredi 6 mars 2015

Recover corrupted Mac HFS+ drive (image) under Linux


I'm trying to recover an apparently corrupted disk. It appears that through improper shutdown the drive has been somehow killed. It's the main partition of a Macbook Pro.


I've used dd to copy the drive to an external hard drive, and now I'm trying to mount it under linux (Ubuntu) to retrieve whatever I can. (I can also try from another Mac.)


Info on the disk image from file image.dmg



image.dmg: Macintosh HFS Extended version 4 data (mounted) last mounted by: 'FSK!', created: Wed Nov 18 08:21:40 2144, last modified: Mon Mar 6 18:54:12 2147, block size: 4096, number of blocks: 121886744, free blocks: 69886793



Trying mount -t hfsplus -o loop image.dmg /mnt resulted in



mount: wrong fs type, bad option, bad superblock on /dev/loop0,

missing codepage or helper program, or other error

In some cases useful info is found in syslog - try

dmesg | tail or so



from dmesg



hfsplus: Filesystem was not cleanly unmounted, running fsck.hfsplus is recommended. mounting read-only.

hfsplus: invalid extent max_key_len 53348

hfsplus: failed to load extents file



running fsck.hfsplus -dr image.dmg yields



** image.dmg (NO WRITE)

Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.

CheckForClean - found bad journal signature

Invalid Volume Header

** Checking HFS Plus volume.

Invalid B-tree node size

(3, 0)

** The volume needs to be repaired.

volume type is pure HFS+

primary MDB is at block 0 0x00

alternate MDB is at block 0 0x00

primary VHB is at block 2 0x02

alternate VHB is at block 975093950 0x3a1ec0be

sector size = 512 0x200

VolumeObject flags = 0x07

total sectors for volume = 975093952 0x3a1ec0c0

total sectors for embedded volume = 0 0x00



Something is wrong with the superblock or with the B-node tree. I've seen recommendations for DiskWarrior out there, but I it has a high price for no guarantee that it will work, so I thought I'd try my hand at it with free approaches first.


Any any any (useful) info would be greatly appreciated! Thanks!





Aucun commentaire:

Enregistrer un commentaire