Stuck while try to restore files with hfsprescue-3.4

Started by bnc, April 14, 2018, 09:47:18 AM

Previous topic - Next topic
Print
Go Down Pages1
User actions

bnc

April 14, 2018, 09:47:18 AM
Hello,

before my questions starts: Thanks a lot for this great tool! :-)

I have trouble to restore some files from a SSD. Maybe i can find here some help. This is some information I have about the state of the drive.

Code Select
$ sudo diskutil verifyVolume "/Volumes/OWC Aura SSD"
...
Checking catalog file
Invalid node structure
The volume OWC Aura SSD could not be verified completely
File system check exit code is 8
Restoring the original state found as mounted
Problem -69842 occurred while restoring the original mount state
Error: -69845: File system verify or repair failed
Underlying error: 8: Exec format error

I try to get some files from the drive restored, but the MacOS tool, as well as some others failed up to now.

This looks good:

Code Select
$ sudo ./hfsprescue_x64 -s1 /dev/sdb2 -b 512
hfsprescue 3.4 2018/02/16 by Elmar Hanlhofer https://www.plop.at

Start: 2018/04/14 07:49:54

*** Force block size: 512
Signature:                      0x2b48, H+
LastMountedVersion:             fsck, last mount was not done by Mac OS X.
FileCount:                      1338812
DirCount:                       233272
BlockSize:                      512
TotalBlocks:                    116874016
AllocationFile StartBlock:      1
ExtentsOverflowFile StartBlock: 165124
CatalogFile StartBlock:         562420
Total size:                     446 GB

100.00% scanned (446.18 GB). Found: 268835 directories, 1083746 files.

End: 2018/04/14 09:02:12
Elasped time: 1 hour, 12 minutes.
Done.

and also
Code Select
sudo ./hfsprescue_x64 -s2 worked well

but when I check the file catalog, the entries look not so promising.

Code Select
$ sudo ./hfsprescue_x64 --list | grep IMG
856855: IMG_4389.JPG, 0 bytes, 1512918652, Sun Dec 10 16:10:52 2017, Start block 0 _F_INVALID_START_BLOCK_
856856: IMG_4390.JPG, 0 bytes, 1512918670, Sun Dec 10 16:11:10 2017, Start block 0 _F_INVALID_START_BLOCK_
856857: IMG_4393.JPG, 0 bytes, 1512918750, Sun Dec 10 16:12:30 2017, Start block 0 _F_INVALID_START_BLOCK_
856858: IMG_4394.JPG, 0 bytes, 1512918762, Sun Dec 10 16:12:42 2017, Start block 0 _F_INVALID_START_BLOCK_
856859: IMG_4395.JPG, 0 bytes, 1512918790, Sun Dec 10 16:13:10 2017, Start block 0 _F_INVALID_START_BLOCK_
856861: IMG_4398.JPG, 0 bytes, 1512918826, Sun Dec 10 16:13:46 2017, Start block 0 _F_INVALID_START_BLOCK_
856863: IMG_4400.JPG, 0 bytes, 1512918872, Sun Dec 10 16:14:32 2017, Start block 0 _F_INVALID_START_BLOCK_
856864: IMG_4401.JPG, 0 bytes, 1512918906, Sun Dec 10 16:15:06 2017, Start block 0 _F_INVALID_START_BLOCK_
856866: IMG_4402.JPG, 0 bytes, 1512918912, Sun Dec 10 16:15:12 2017, Start block 0 _F_EOF_ _F_INVALID_START_BLOCK_
856870: IMG_4405.JPG, 2 bytes, 1512918946, Sun Dec 10 16:15:46 2017, Start block 0 _F_INVALID_START_BLOCK_
857298: IMG_4252_kleiner.jpg, 0 bytes, 1513934625, Fri Dec 22 10:23:45 2017, Start block 23197

The entries have _F_INVALID_START_BLOCK_ and/or the file size is incorrect.

Consequently when I try to restore single files, I get an error message File xyz not restored.
 or a file is created but the content is not correct.

What can I do at this point?

Best Regards and thanks again for this tool.
Christian

Elmar

#1
April 14, 2018, 10:17:43 AM
Hello,

you are using "-b 512".  This set the block size to 512 bytes, which is definitely wrong. Run again step 1, but without "-b 512".

Best regards
Elmar

bnc

#2
April 14, 2018, 13:24:31 PM
Hello Elmar,

thanks a lot for your reply.

I tried it again without the -b flag but the result is the same.

Code Select
$ sudo ./hfsprescue_x64 -s1 /dev/sdb2
hfsprescue 3.4 2018/02/16 by Elmar Hanlhofer https://www.plop.at

Start: 2018/04/14 11:48:49

Signature:                      0x2b48, H+
LastMountedVersion:             fsck, last mount was not done by Mac OS X.
FileCount:                      1338812
DirCount:                       233272
BlockSize:                      4096
TotalBlocks:                    116874016
AllocationFile StartBlock:      1
ExtentsOverflowFile StartBlock: 165124
CatalogFile StartBlock:         562420
Total size:                     446 GB

100.00% scanned (446.18 GB). Found: 268619 directories, 1084165 files.

End: 2018/04/14 12:54:01
Elasped time: 1 hour, 5 minutes.
Done.


Code Select
$ sudo ./hfsprescue_x64 -s2


Code Select
$ sudo ./hfsprescue_x64 --list  | grep IMG
...
856989: IMG_4389.JPG, 0 bytes, 1512918652, Sun Dec 10 16:10:52 2017, Start block 0 _F_INVALID_START_BLOCK_
856990: IMG_4390.JPG, 0 bytes, 1512918670, Sun Dec 10 16:11:10 2017, Start block 0 _F_INVALID_START_BLOCK_
856991: IMG_4393.JPG, 0 bytes, 1512918750, Sun Dec 10 16:12:30 2017, Start block 0 _F_INVALID_START_BLOCK_
856992: IMG_4394.JPG, 0 bytes, 1512918762, Sun Dec 10 16:12:42 2017, Start block 0 _F_INVALID_START_BLOCK_
856993: IMG_4395.JPG, 0 bytes, 1512918790, Sun Dec 10 16:13:10 2017, Start block 0 _F_INVALID_START_BLOCK_
856995: IMG_4398.JPG, 0 bytes, 1512918826, Sun Dec 10 16:13:46 2017, Start block 0 _F_INVALID_START_BLOCK_
856997: IMG_4400.JPG, 0 bytes, 1512918872, Sun Dec 10 16:14:32 2017, Start block 0 _F_INVALID_START_BLOCK_
856998: IMG_4401.JPG, 0 bytes, 1512918906, Sun Dec 10 16:15:06 2017, Start block 0 _F_INVALID_START_BLOCK_
857000: IMG_4402.JPG, 0 bytes, 1512918912, Sun Dec 10 16:15:12 2017, Start block 0 _F_EOF_ _F_INVALID_START_BLOCK_
857004: IMG_4405.JPG, 2 bytes, 1512918946, Sun Dec 10 16:15:46 2017, Start block 0 _F_INVALID_START_BLOCK_
857439: IMG_4252_kleiner.jpg, 0 bytes, 1513934625, Fri Dec 22 10:23:45 2017, Start block 0 _F_INVALID_START_BLOCK_
...

Is there anything I can try to fix this?

Best Regards
   Christian

Elmar

#3
April 14, 2018, 13:58:11 PM
For example, are there more files in the list with the name "IMG_4395.JPG"?

bnc

#4
April 14, 2018, 16:05:07 PM
For most files from my example output, no duplicates exist.

Code Select
$ sudo ./hfsprescue_x64 --list  | grep IMG_4395.JPG
856993: IMG_4395.JPG, 0 bytes, 1512918790, Sun Dec 10 16:13:10 2017, Start block 0 _F_INVALID_START_BLOCK_

Code Select
$ sudo ./hfsprescue_x64 --one-file /dev/sdb2  856993
hfsprescue 3.4 2018/02/16 by Elmar Hanlhofer https://www.plop.at

Start: 2018/04/14 15:58:56

Signature:                      0x2b48, H+
LastMountedVersion:             fsck, last mount was not done by Mac OS X.
FileCount:                      1338812
DirCount:                       233272
BlockSize:                      4096
TotalBlocks:                    116874016
AllocationFile StartBlock:      1
ExtentsOverflowFile StartBlock: 165124
CatalogFile StartBlock:         562420
Total size:                     446 GB

Extracting the ExtentsOverflowFile to 'restored/ExtentsOverflowFile'.

*** The ExtentsOverflowFile exists. Skipping extracting.

Allocating 10 MB for the ExtentsOverflowFile.
'restored/ExtentsOverflowFile' loaded into RAM. :)

Invalid entry for IMG_4395.JPG
File IMG_4395.JPG not restored.

But from some files, there are duplicates. One example:

Code Select
$ sudo ./hfsprescue_x64 --list  | grep IMG_4405.JPG
857004: IMG_4405.JPG, 2 bytes, 1512918946, Sun Dec 10 16:15:46 2017, Start block 0 _F_INVALID_START_BLOCK_
858009: IMG_4405.JPG, 4603859 bytes, 1512918946, Sun Dec 10 16:15:46 2017, Start block 0 _F_INVALID_START_BLOCK_

These two files entries also cannot be restored.

Code Select
$ sudo ./hfsprescue_x64 --one-file /dev/sdb2  857004
hfsprescue 3.4 2018/02/16 by Elmar Hanlhofer https://www.plop.at

Start: 2018/04/14 16:02:09

Signature:                      0x2b48, H+
LastMountedVersion:             fsck, last mount was not done by Mac OS X.
FileCount:                      1338812
DirCount:                       233272
BlockSize:                      4096
TotalBlocks:                    116874016
AllocationFile StartBlock:      1
ExtentsOverflowFile StartBlock: 165124
CatalogFile StartBlock:         562420
Total size:                     446 GB

Extracting the ExtentsOverflowFile to 'restored/ExtentsOverflowFile'.

*** The ExtentsOverflowFile exists. Skipping extracting.

Allocating 10 MB for the ExtentsOverflowFile.
'restored/ExtentsOverflowFile' loaded into RAM. :)

Invalid entry for IMG_4405.JPG
File IMG_4405.JPG not restored.

$ sudo ./hfsprescue_x64 --one-file /dev/sdb2  858009
hfsprescue 3.4 2018/02/16 by Elmar Hanlhofer https://www.plop.at

Start: 2018/04/14 16:02:20

Signature:                      0x2b48, H+
LastMountedVersion:             fsck, last mount was not done by Mac OS X.
FileCount:                      1338812
DirCount:                       233272
BlockSize:                      4096
TotalBlocks:                    116874016
AllocationFile StartBlock:      1
ExtentsOverflowFile StartBlock: 165124
CatalogFile StartBlock:         562420
Total size:                     446 GB

Extracting the ExtentsOverflowFile to 'restored/ExtentsOverflowFile'.

*** The ExtentsOverflowFile exists. Skipping extracting.

Allocating 10 MB for the ExtentsOverflowFile.
'restored/ExtentsOverflowFile' loaded into RAM. :)

Invalid entry for IMG_4405.JPG
File IMG_4405.JPG not restored.

Elmar

#5
April 14, 2018, 18:05:41 PM
How has the fie system became defect?

Is it possible that the file entries are old entries of files that have been deleted when the file system was fine?

bnc

#6
April 14, 2018, 20:00:01 PM
The files have not been erased by myself.

The SSD (OWC Aura) is approx. 6 Months old. I bought it because the storage capacity of the old SSD of the MacBook Air (2 years old) was not sufficient any more.

During the last few weeks, the laptop sometimes (approx. 1-2 times per day) did crash and needed a reboot.
Two days ago, after a crash, the operating system did not start any more.
I switched the SSDs again and the laptop works with the old SSD => drive or file system issue

I have an enclosure (OWC Envoy Pro) which allows to connect the SSD via USB.
I also was able to copy the SSD to an HDD via dd.

Now I try to restore restore some files from the drive.  :)

Do you have any idea what I can try as next steps?

Elmar

#7
April 15, 2018, 09:05:53 AM
Continue with step 3 and the other steps and see what files are restored.

bnc

#8
April 15, 2018, 11:14:22 AM
Ok. I see.
Thanks that for your help!
:)
Print
Go Up Pages1
User actions