Print Page - All recovered files seem corrupt

Title: All recovered files seem corrupt
Post by: wout on September 23, 2020, 16:45:38 PM

Hi,

I've been trying to "rescue" a disk that's quite important to someone.
As HFS+ Rescue looked interesting, I spent some time with it.

I managed to find a volume header, and eventually I went through all steps successfully. I also have a file list which looks very promising, as in, it has many recognizable filenames.

Recovering the files works, too (no errors), but it seems like ALL of them are corrupt after getting them from the disk. Office docs, images, sound files, text files. I've found one video file which, although very garbled, showed part of a familliar face, but that's it.

The same happens with per-file restores. Any file I try, it will restore successfully but it will be a useless, corrupted file.

As I'm fresh out of ideas, I'm hoping maybe one of you guys might have an idea on how to proceed. I'm obviously more than willing to provide any info you'd require.

Thanks in advance!

Title: Re: All recovered files seem corrupt
Post by: Elmar on September 25, 2020, 08:24:02 AM

Hello,

what was the initial hfsprescue command?

Best Regards
Elmar

Title: Re: All recovered files seem corrupt
Post by: wout on September 29, 2020, 16:51:13 PM

Thanks for your message, Elmar.

After finding the volume header, the initial command was:
# ./hfsprescue_x64 -s1 /dev/sdb -o 1437184 -d /mnt/plek

EDIT - maybe I should post the results of step 1, as well:

hfsprescue 3.5-rc1 2020/04/26 by Elmar Hanlhofer https://www.plop.at

Start: 2020/09/15 12:41:54

*** Using offset 1437184 (1 MB)
Signature: 0x2b48, H+
LastMountedVersion: 10.0, last mount by Mac OS X.
FileCount: 9
DirCount: 3
BlockSize: 4096
TotalBlocks: 7680
AllocationFile StartBlock: 1
ExtentsOverflowFile StartBlock: 2
CatalogFile StartBlock: 62
Total size: 931 GB

100.00% scanned (931.51 GB). Found: 274447 directories, 386992 files.d

End: 2020/09/17 11:55:04
Elapsed time: 47 hours, 13 minutes.
Done.

(I'm running hfsprescue on linux)

Cheers,
Wout

Title: Re: All recovered files seem corrupt
Post by: Elmar on September 29, 2020, 17:36:11 PM

Did you use -o 1437184 with the per-file restore too?

Title: Re: All recovered files seem corrupt
Post by: wout on September 30, 2020, 22:55:51 PM

Yep, I did. The command for step 3 was:
# ./hfsprescue_x64 -s3 /dev/sdb -o 1437184 -d '/mnt/plek/'

and my latest single-file attempt went like this:
# ./hfsprescue --one-file /dev/sdb 2664 -o 1437184 -d /mnt/plek --vh-file /mnt/plek/VolumeHeader --eof-file /mnt/plek/restored/ExtentsOverflowFile

.. where I thought I'd "hardcode" as much as possible.

Thanks again!

Plop Forum

General Category => HFS+ Rescue => Topic started by: wout on September 23, 2020, 16:45:38 PM