Revision of Case Study: Repair mac filesystem from Wed, 12/02/2009 - 14:17

Submitted by andrew on Wed, 12/02/2009 - 13:33.

----Synopsis----

A hard disk from a macintosh computer failed resulting in a white screen at boot time. The owners were told that the drive was damaged and it was replaced. The faulty drive was imaged, the hfsplus boot block was repaired using the alternate boot block and the filesystem was repaired, allowing for the recovery of all of the owners personal data.

----Imaging----

A computer running Ubuntu linux and GNU ddrescue was turned on and the 2.5 inch drive was connected using a SATA to USB cable and external power supply.

$tail -f /var/log/messages

The view of the /var/log/messages showed numerous read errors as the drive was being recognized. After several attempts at power cycling the drive, it was recognized in /proc/partitions as the correct devices (/dev/sdc /dev/sdc1 and /dev/sdc2). Imaging of /dev/sdc2 was started several times, but the drive failed. The imaging of /dev/sda was started and much more data was recovered in the first few hours. The output was an average of 12 MB/s.

$sudo ddrescue -v /dev/sdc image log

The drive powered off intermittently over the first 8 hours of imaging. Recover was restarted in reverse and using direct disk access, resulting is a rate of 368 Kb/s.

sudo ddrescue -vRDd -r 99 /dev/sdc image log

However, the drive sustained this without powering off over the remaining recovery. Most of the 120 gigs were recovered in the first five days of recovery. About 50 Mb of the remaining 800 Mb to be imaged were recovered over two more subsequent days. Only 750 Kb of the total 120 Gigs were unrecovered.

----Partition table----

The partition table on the image was intact.

$sudo parted image unit b print
Model: (file)
Disk /media/disk-1/doug1/image: 120034123776B
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number Start End Size File system Name Flags
1 20480B 209735679B 209715200B fat32 EFI System Partition boot
2 209735680B 119899885567B 119690149888B Apple_HFS_Untitled_1

The filesystem was not mountable.

$ sudo mount -o loop,o=209735680 image mnt/
mount: you must specify the filesystem type
$ sudo mount -o loop,o=209735680 image mnt/ -t hfsplus
mount: wrong fs type, bad option, bad superblock on /dev/loop0,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so

The image was backed up and all work was performed on the copy. Testdisk was run on the image:

$ sudo testdisk image
TestDisk 6.10, Data Recovery Utility, July 2008
Christophe GRENIER
http://www.cgsecurity.org
TestDisk 6.10, Data Recovery Utility, July 2008
Christophe GRENIER
http://www.cgsecurity.org

TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.

Select a media (use Arrow keys, then press Enter):
Disk image - 120 GB / 111 GiB

[Proceed ] [ Quit ]

Note: Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has incorrect size, check HD jumper settings, BIOS
detection, and install the latest OS patches and disk drivers.