English / Deutsch | HTTPS | Print version

HFS+ Rescue - hfsprescue




Note: Release date for hfsprescue 1.2 stable is begin of june 2015. Call me if you have files that are not recovered to improve the program.

The create file error will be fixed in 1.2.

The 1.2 release will have a lot of new features. Strong fragmented files will be supported too. There will be also a new feature to find the Extents Overflow File.


Introduction
Download latest version
Recover your files
Example
Searching unicode strings and/or bytes from a file
Program parameters
Additional files created by hfsprescue
Directories
Unicode file names
Personal notes
Downloads

Introduction


HFS+ (HFS Plus, Hierarchical File System Plus) is a file system, developed and used by Apple.

hfsprescue is a linux program. It scans a damaged image file or partition that is formatted with HFS+. You can restore your files and directories, even when it's not possible to mount it with your operating system. Your files and directories will be stored in the directory './restored' in your current directory. The HFS+ file or partition will not be changed. So you need enough space to copy out the files from the HFS+ file system.

hfsprescue supports HFS+ compression (resource fork).


Download latest version


HFS+ Rescue recovered your data and you want to support the development of the software with a few dollars or euros? Simply use Paypal.
Number of donations in this month: 3

hfsprescue-1.2-test4.tar.gz (2015/05/28) - Latest test version
hfsprescue-1.2-test.tar.gz (2015/02/10) - Step 3 segfault fix

hfsprescue-1.1.tar.gz (2015/02/02)


Recover your files


You have to complete 5 steps to restore your files:

  1. Scan for your files.
    hfsprescue -s1 <device node|image file> [-b <block size>] [-f] [-o <offset>]

  2. Restore your files.
    hfsprescue -s2 <device node|image file> [-b <block size>] [-c <file number>] [-o <offset>]

  3. Restore your directory structure.
    hfsprescue -s3

  4. Move the restored files to the correct directories.
    hfsprescue -s4

  5. Last step, finalize and cleanup.
    hfsprescue -s5 [-k]

hfsprescue will guide you through every step and is telling you the command for the next step.


Example


5 Steps to complete:

hfsprescue -s1 /dev/sdb1
hfsprescue -s2 /dev/sdb1
hfsprescue -s3
hfsprescue -s4
hfsprescue -s5


Searching unicode strings and/or bytes from a file


An additional debug/search feature is to find unicode strings and/or bytes from a file. This can be used to find the file name in a sector with a directory entry. It's also possible to find the bytes of a file. The search mode tells you the location when it finds something. With this information and the infos of fileinfo.txt it is possible to calculate the offset to a partition when there is no valid partition table or boot sector and the start of the partition is unknown.

hfsprescue -fi <device node|image file> [-fs <string>] [-ff <file> <num bytes>]


Program parameters


-h Print help.

OPTIONS FOR STEP 1: Scan for your files.
-s1 <device node|image file> Run step 1. You have to tell the device node or image file.
-b <block size> Set block size. Useful when the boot sector has been lost.
-f Overwrite current log files.
-o <offset> Set offset of partition. Usefull when the partition table is lost.

OPTIONS FOR STEP 2: Restore your files.
-s2 <device node|image file> Run step 2. You have to tell the device node or image file.
-b <block size> Set block size. Useful when the boot sector has been lost.
-c <file number> Continue the file restore and skip the files before <file number>.
-o <offset> Set offset of partition. Usefull when the partition table is lost.

OPTIONS FOR STEP 3: Restore your directory structure.
-s3 Run step 3.

OPTIONS FOR STEP 4: Move the restored files to the correct directories.
-s4 Run step 4.

OPTIONS FOR STEP 5: Last step, finalize and cleanup.
-s5 Run step 5.
-k Keep mkdir.sh and hfsprescue_dir_id.tmp files.

OPTIONS TO FIND A UNICODE STRING AND/OR FILE BYTES: Find data on sectors.
-fi <device node|image file> Find data. You have to tell the device node or image file.
-fs <string> Find a given string. The string will be converted to unicode.
-ff <file> <num bytes> Find number of bytes from a file.
-o <offset> Start search from offset

Additional files created by hfsprescue


fileinfo.txt  Detail infos about recoverable files.
foldertable.txt  Detail infos about recoverable directory structure.
hfsprescue-s1.log Log file of step 1.
hfsprescue-s2.log Log file of step 2.
hfsprescue-s3.log Log file of step 3.
hfsprescue-s4.log Log file of step 4.
hfsprescue-fi.log Log file of searching.


Directories


restored/newroot/recoveredYou find your recovered files here.
restored/newroot/x_directory_problem It was not possible to link the files and directories to their parent directory. You will find here files too.
restored/newroot/x_unknown No valid parent directory has been found. Maybe you will find here already deleted files. The files in this directories can be invalid.

Unicode file names


If you have unicode file names and you want to copy the files to a HFS+ or NTFS file system then convert the file names with convmv.
https://www.j3e.de/linux/convmv/

Example: convmv -f iso-8859-1 -t utf8 -r restored/*


Personal notes


I wrote this tool for my neighbour. He was unable to mount the HFS+ partition. He got the error hfs: failed to load catalog file and some other errors about the B-Tree. I was able to restore the most files. Maybe it helps other people too.


Downloads


hfsprescue-1.1.tar.gz (2015/02/02)
hfsprescue-1.0.tar.gz (2015/01/12)
hfsprescue-0.3.tar.gz (2013/01/30)
hfsprescue-0.2.tar.gz (2011/11/25)
hfsprescue-0.1-patched.tar.gz (2011/10/05)
hfsprescue-0.1.tar.gz (2010/11/30)



© 2015 by Elmar Hanlhofer
This page was last modified on 10/Feb/2015