Plop Forum

General Category => HFS+ Rescue => Topic started by: dtom on September 08, 2020, 20:25:42 PM

Title: Volume Header is not correct — Not sure where to go next!
Post by: dtom on September 08, 2020, 20:25:42 PM
My computer got fried a few weeks ago and ever since I've been trying to restore an external backup hard drive.

Since the enclosure was dead, I bought an external enclosure and pulled the drive.

Anytime I insert, I get a "Could not read, initialize?" error.

I've looked at the drive with a bunch of different tools — and it looks like the data is all there — but that the partition is "lost."

From testdisk, it appears as if volume headers are available:

Scanned 300 MB.
============================================
A Volume Header has been found.

Partition start:     314597376 (Byte), 0x12c06000, 614448 (LBA Sector), at 300 MB
Volume Header start: 314598400 (Byte), 0x12c06400, 614450 (LBA Sector), at 300 MB

Signature:                                      0x2b48, H+
LastMountedVersion:                       HFSJ, last mount by Mac OS X.
FileCount:                                      14375770
DirCount:                                       1452607
BlockSize:                                      8192
TotalBlocks:                                    488318330
AllocationFile StartBlock:                 1
ExtentsOverflowFile StartBlock:        46366
CatalogFile StartBlock:                    524318


—————————————


Using HFSPRESCUE, I get this basic sequence on the drive:


>> sudo hfsprescue -s1 /dev/disk2s1
>> Warning: Unusual block size! Use -b 557843968 to force this block size.



>> sudo hfsprescue -s1 /dev/disk1s1 -b 4096
>> 100.00% scanned (465.75 GB). Found: 1436358 directories, 13923483 files.
>> *** Force block size: 4096
>> Signature: 0x00,  (Unknown)
>> LastMountedVersion:             , last mount was not done by Mac OS X.
>> FileCount:                                    0
>> DirCount:                                     0
>> BlockSize:                                    4096
>> TotalBlocks:                                  0
>> AllocationFile StartBlock:                0
>> ExtentsOverflowFile StartBlock:      0
>> CatalogFile StartBlock:                   0
>> Total size:                                     465 GB



>> sudo hfsprescue -s2 /dev/disk1s1
>> Fresh database created with 13711253 entries. 163422 duplicate entries removed.


(At this point, I copied the HFSPRESCUE data onto a different external drive ("Restore") as I didn't have space on my internal drive for the restore and wanted to avoid messing up the drive I was working with.)



>>sudo /Volumes/Restore/hfsprescue/MacOSX/hfsprescue -s3 /dev/disk1s1 -b 4096 --force -d /Volumes/Restore/
>> You are forcing the block size. I assume, the Volume Header is not correct.
>> Automatic extracting of the ExtentsOverflowFile has been disabled! This means
>> strong fragmented files will not be restored! When you want to use the
>> ExtentsOverflowFile, then you have to restore it manually with '--extract-eof'.
>> Use '--ignore-eof' to restore without ExtentsOverFlowFile.


I then ran:
>> sudo /Volumes/Restore/hfsprescue/MacOSX/hfsprescue -s3 /dev/disk1s1 -b 4096 --force -d /Volumes/Restore/ --ignore-eof

I let this run for a little bit, but it looked like everything returned a "Invalid start block for..."


—————————————


I'm not exactly sure where to go from here!

Any help would be appreciated as I really believe this data can be recovered — and that the partition has just gone "missing."
Title: Re: Volume Header is not correct — Not sure where to go next!
Post by: Elmar on September 11, 2020, 05:38:36 AM
Hello,

maybe, there are only wrong partition values in the partition table.

Are you able to print the partition start, end and similar values with a tool on OSX?
If not, boot up Linux and use "gfdisk" or "gparted" or similar.

Regards
Elmar