----Synopsis----

A hard disk from a Macintosh computer failed resulting in a white screen at boot time. The owners were told that the drive was damaged and it was replaced. The faulty drive was imaged, the hfsplus boot block was repaired using the alternate boot block and the filesystem was repaired, allowing for the recovery of all of the owners personal data.

----Imaging----

The 2.5 inch hard disk was connected to a power supply and a USB to SATA interface which was then connected to a computer running Ubuntu linux.

$tail -f /var/log/messages

The view of the /var/log/messages showed numerous read errors as the drive was being recognized by the kernel. After several attempts at power cycling the drive, it was recognized in /proc/partitions as the correct devices (/dev/sdc /dev/sdc1 and /dev/sdc2). Imaging of /dev/sdc2 was started several times, but the drive failed after a few moments. The imaging of the entire drive (/dev/sda) was started and much more data was recovered in the first few hours. The output was at an average speed of 12 MB/s.

$sudo ddrescue -v /dev/sdc image log

The drive powered off intermittently over the first 8 hours of imaging. Recovery was restarted in reverse and using direct disk access, resulting is a much slower rate of 368 Kb/s.

sudo ddrescue -vRDd -r 99 /dev/sdc image log

However, the drive sustained this without powering off over the remaining recovery. Most of the 120 gigs were recovered in the first five days of recovery. About 50 Mb of the remaining 800 Mb to be imaged were recovered over two more subsequent days. Only about 750 Kb of the total 120 Gigs were unrecovered.

----Partition table----

The partition table on the image was intact.

$sudo parted image unit b print
Model: (file)
Disk /media/disk-1/doug1/image: 120034123776B
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number Start End Size File system Name Flags
1 20480B 209735679B 209715200B fat32 EFI System Partition boot
2 209735680B 119899885567B 119690149888B Apple_HFS_Untitled_1

The filesystem was not mountable.

$ sudo mount -o loop,offset=209735680 image mnt/
mount: you must specify the filesystem type
$ sudo mount -o loop,offset=209735680 image mnt/ -t hfsplus
mount: wrong fs type, bad option, bad superblock on /dev/loop0,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so

-----Filesystem Repair----

The image was backed up and all work was performed on the copy. Testdisk was run on the image:

$ sudo testdisk image

The advanced filesystem utilities were used and the Volume Header (superblock) was found to be bad.

Volume header
Bad

Backup volume header
HFS+ OK

Sectors are not identical.

[ Quit ] [Backup BS] [ Dump ]
Return to Advanced menu

The backup Boot Sector was used to correct the problem.

Testdisk was then quit and the filesystem was mounted.

$sudo mount -o loop,offset=209735680 image mnt/ -t hfsplus
$ ls mnt

ls: reading directory mnt: Input/output error
Applications bin Desktop DB dev eBookUSBDriver 2.pkg eBookUSBDriver 4.pkg eBookUSBDriver.tar etc mach
automount cores Desktop DF Developer eBookUSBDriver 3.pkg eBookUSBDriver.pkg EndNote X1 Library mach.sym

The /home folder was absent. The image was unmounted and the loop device was associated with the partition on the image:

sudo losetup /dev/loop0 image -o 209735680

The filesystem was repaired using fsck from the hfsprogs package:

$ sudo fsck.hfsplus -f /dev/loop0
** /dev/loop0
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
Invalid node structure
(4, 15221)
** Rebuilding Catalog B-tree.
** The volume Macintosh HD could not be repaired.

$ sudo fsck.hfsplus -fy /dev/loop0
** /dev/loop0
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
Invalid node structure
(4, 15221)
** Rebuilding Catalog B-tree.
Invalid key length
(4, 15446)
Invalid key length
(4, 15449)
Invalid key length
(4, 15488)
Invalid node structure
(4, 26487)
Invalid key length
(4, 27098)
Invalid node structure
(4, 27645)
Invalid key length
(4, 27648)
** Rechecking volume.
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
Missing thread record (id = 16)
** Checking Catalog file.
Missing thread record (id = 16)
Missing thread record (id = 547002)
Missing thread record (id = 1112972)
Missing thread record (id = 1112980)
Missing thread record (id = 1113016)
Missing thread record (id = 1113031)
Missing thread record (id = 1113360)
Missing thread record (id = 1113615)
Missing thread record (id = 1114428)
Incorrect number of thread records
(4, 216)
Incorrect number of thread records
(4, 216)
** Checking multi-linked files.
** Checking Catalog hierarchy.
Invalid directory item count
(It should be 27 instead of 43)
Invalid volume directory count
(It should be 92432 instead of 131923)
Invalid volume file count
(It should be 417731 instead of 529038)
** Checking Extended Attributes file.
** Checking volume bitmap.
Volume Bit Map needs minor repair
** Checking volume information.
Invalid volume free block count
(It should be 23031363 instead of 23403608)
Volume Header needs minor repair
(2, 0)
** Repairing volume.
Missing directory record (id = 1114428)
Missing directory record (id = 1113615)
Missing directory record (id = 1113360)
Missing directory record (id = 1113031)
Missing directory record (id = 1113016)
Missing directory record (id = 1112980)
Missing directory record (id = 1112972)
Missing directory record (id = 547002)
Missing directory record (id = 16)
** Look for missing items in lost+found directory.
** Rechecking volume.
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
** Checking Catalog hierarchy.
Invalid directory item count
(It should be 0 instead of 16)
Invalid directory item count
(It should be 0 instead of 1)
Invalid directory item count
(It should be 0 instead of 1)
Invalid directory item count
(It should be 24 instead of 27)
Invalid directory item count
(It should be 0 instead of 4)
Invalid directory item count
(It should be 56 instead of 85)
Invalid volume file count
(It should be 529041 instead of 529038)
** Checking Extended Attributes file.
** Checking volume bitmap.
** Checking volume information.
** The volume Macintosh HD could not be repaired after 3 attempts.

$sudo fsck.hfsplus -r /dev/loop0
** /dev/loop0
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
** Rebuilding Catalog B-tree.
** Rechecking volume.
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
Incorrect number of thread records
(4, 208)
** Checking multi-linked files.
** Checking Catalog hierarchy.
Invalid directory item count
(It should be 0 instead of 16)
Invalid directory item count
(It should be 0 instead of 1)
Invalid directory item count
(It should be 0 instead of 1)
Invalid directory item count
(It should be 24 instead of 27)
Invalid directory item count
(It should be 0 instead of 4)
Invalid directory item count
(It should be 56 instead of 85)
Invalid volume file count
(It should be 529041 instead of 529038)
** Checking Extended Attributes file.
** Checking volume bitmap.
** Checking volume information.
** Repairing volume.
** Rechecking volume.
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
Incorrect number of thread records
(4, 208)
** Checking multi-linked files.
** Checking Catalog hierarchy.
Invalid volume file count
(It should be 529041 instead of 529038)
** Checking Extended Attributes file.
** Checking volume bitmap.
** Checking volume information.
** Repairing volume.
** Rechecking volume.
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
Incorrect number of thread records
(4, 208)
** Checking multi-linked files.
** Checking Catalog hierarchy.
Invalid volume file count
(It should be 529041 instead of 529038)
** Checking Extended Attributes file.
** Checking volume bitmap.
** Checking volume information.
** The volume Macintosh HD could not be repaired after 3 attempts.

The filesystem was mounted and the pertinent files were recovered from the lost+found directory. The owners of the drive report that 100 per cent of their data was recovered.

$ sudo mount /dev/loop0 mnt/
$ ls -sh1t mnt/
total 784K
0 lost+found
0 Applications
4.0K mach
604K mach.sym
0 bin
20K Desktop DB
52K Desktop DF
0 Library
0 Developer
100K eBookUSBDriver.tar
0 automount
4.0K etc
0 EndNote X1
0 cores
0 dev
0 eBookUSBDriver 2.pkg
0 eBookUSBDriver 3.pkg
0 eBookUSBDriver 4.pkg
0 eBookUSBDriver.pkg

$ ls mnt/lost+found/547057/iPhoto\ Library/Originals/
2005 2006 2007 2008 2009

----Kernel HFSPlus driver bug?----

The accessing of certain files within the repaired filesystem caused the loop device to hang. Subsequent attempts to access the loop device including attempts to detach it resulted in unkillable hung processes. Subsequent loop devices were attached to the image, though, and the data was copied with care to avoid the files which caused this problem.

Bug Report: Process hangs when accessing some files in repaired hfsplus filesystem

----Add your case!----

Do you have an interesting Data Recovery experience using Free/libre tools?

Log in or register and add it to the list of Ubuntu-Rescue-Remix.org case studies.