Volume Header is not correct — Not sure where to go next!

Started by dtom, September 08, 2020, 20:25:42 PM

Previous topic - Next topic


My computer got fried a few weeks ago and ever since I've been trying to restore an external backup hard drive.

Since the enclosure was dead, I bought an external enclosure and pulled the drive.

Anytime I insert, I get a "Could not read, initialize?" error.

I've looked at the drive with a bunch of different tools — and it looks like the data is all there — but that the partition is "lost."

From testdisk, it appears as if volume headers are available:

Scanned 300 MB.
A Volume Header has been found.

Partition start:     314597376 (Byte), 0x12c06000, 614448 (LBA Sector), at 300 MB
Volume Header start: 314598400 (Byte), 0x12c06400, 614450 (LBA Sector), at 300 MB

Signature:                                      0x2b48, H+
LastMountedVersion:                       HFSJ, last mount by Mac OS X.
FileCount:                                      14375770
DirCount:                                       1452607
BlockSize:                                      8192
TotalBlocks:                                    488318330
AllocationFile StartBlock:                 1
ExtentsOverflowFile StartBlock:        46366
CatalogFile StartBlock:                    524318


Using HFSPRESCUE, I get this basic sequence on the drive:

>> sudo hfsprescue -s1 /dev/disk2s1
>> Warning: Unusual block size! Use -b 557843968 to force this block size.

>> sudo hfsprescue -s1 /dev/disk1s1 -b 4096
>> 100.00% scanned (465.75 GB). Found: 1436358 directories, 13923483 files.
>> *** Force block size: 4096
>> Signature: 0x00,  (Unknown)
>> LastMountedVersion:             , last mount was not done by Mac OS X.
>> FileCount:                                    0
>> DirCount:                                     0
>> BlockSize:                                    4096
>> TotalBlocks:                                  0
>> AllocationFile StartBlock:                0
>> ExtentsOverflowFile StartBlock:      0
>> CatalogFile StartBlock:                   0
>> Total size:                                     465 GB

>> sudo hfsprescue -s2 /dev/disk1s1
>> Fresh database created with 13711253 entries. 163422 duplicate entries removed.

(At this point, I copied the HFSPRESCUE data onto a different external drive ("Restore") as I didn't have space on my internal drive for the restore and wanted to avoid messing up the drive I was working with.)

>>sudo /Volumes/Restore/hfsprescue/MacOSX/hfsprescue -s3 /dev/disk1s1 -b 4096 --force -d /Volumes/Restore/
>> You are forcing the block size. I assume, the Volume Header is not correct.
>> Automatic extracting of the ExtentsOverflowFile has been disabled! This means
>> strong fragmented files will not be restored! When you want to use the
>> ExtentsOverflowFile, then you have to restore it manually with '--extract-eof'.
>> Use '--ignore-eof' to restore without ExtentsOverFlowFile.

I then ran:
>> sudo /Volumes/Restore/hfsprescue/MacOSX/hfsprescue -s3 /dev/disk1s1 -b 4096 --force -d /Volumes/Restore/ --ignore-eof

I let this run for a little bit, but it looked like everything returned a "Invalid start block for..."


I'm not exactly sure where to go from here!

Any help would be appreciated as I really believe this data can be recovered — and that the partition has just gone "missing."



maybe, there are only wrong partition values in the partition table.

Are you able to print the partition start, end and similar values with a tool on OSX?
If not, boot up Linux and use "gfdisk" or "gparted" or similar.