English / Deutsch | HTTPS | Print version

HFS+ Rescue - Hfsprescue


Release date for Hfsprescue 2.0 stable is planed for end of august 2015. Contact me if you have files that are not recovered to improve the program.

TODO: Check typos.

Hfsprescue 2.0-rc2 is available for download.



1. Introduction
2. Download latest version
3. Recover your files
4. Additional features
5. Example command sequence
6. Command line parameters
6.1. Options
6.2. --alternative parameter
6.3. Find bytes from a file and/or a unicode string
6.4. List files
6.5. CSV export of file list
6.6. Restore one file
6.7 Find the Extents Overflow File
6.8. Find the HFS+ Volume Header and the partiton start offset
7. Files used by Hfsprescue
8. Directories & Files
9. Problems / FAQs
9.1. Partition table damaged, lost or not usable! How do I find the correct partition offset?
9.2. How do I find the correct partition offset with a reference file
9.3. Restored files are invalid/defect! Why?
9.4. Unusual block size
9.5. Extents Overflow File problems
9.6. Permission denied
9.7. Precompiled - FATAL: kernel too old
10. Mac OS X notes
11. Personal notes
12. Downloads

1. Introduction


HFS+ (HFS Plus, Hierarchical File System Plus) is a file system, developed and used by Apple®.

Hfsprescue is a program to recover files from a HFS+ formatted partition. You can restore your files and directories even when it's not possible to mount it with your operating system. As side effect, the program also restores deleted files. Your files and directories will be recovered to the directory 'restored/' in the directory where you start Hfsprescue. The damaged HFS+ file system will be opened as read only to not change the data on the damaged drive. So you need enough space to copy out the files from the HFS+ file system.

Hfsprescue runs under Linux, Mac OS X and FreeBSD.

Hfsprescue supports HFS+ compression (resource fork).


2. Download latest version


HFS+ Rescue recovered your data and you want to support the development of the software with a few dollars or euros? Simply use Paypal.
Number of donations in this month: 1

hfsprescue-2.0-rc2.tar.gz (2015/08/14) Source code
hfsprescue-2.0-rc2-precompiled.zip (2015/08/14) Precompiled for Linux x86 32/64, Linux armv6l, Mac OS X and FreeBSD 32/64

hfsprescue-1.1.tar.gz (2015/02/02) - Its better to use 2.0-rc2.


3. Recover your files


You have to complete 6 steps to restore your files:

  1. Scan for your files.
    hfsprescue -s1 <device node|image file> [-b <block size>] [-o <offset in bytes>] [-f|--force]

  2. Remove duplicate entries from the file database.
    hfsprescue -s2 [same parameter of -s1]

  3. Restore your files.
    hfsprescue -s3 <device node|image file> [-b <block size>] [-o <offset in bytes>] [-e <start block>] [-c <file number>] [--alternative]

  4. Restore your directory structure.
    hfsprescue -s4

  5. Move the restored files to the correct directories.
    hfsprescue -s5

  6. Last step, finalize and cleanup.
    hfsprescue -s6 [-k]

Hfsprescue will guide you through every step and is telling you the command for the next step.


4. Additional features


• Search unicode string (useful on damaged/lost partition table).
• Search bytes from a file (useful on damaged/lost partition table).
• List files that have been found.
• CSV export of the list of files that have been found.
• Recover one file instead of the whole list of files.
• Find possible positions of the Extents Overflow File.
• Find HFS+ Volume Header and partition start.


5. Example command sequence


6 Steps to complete:

hfsprescue -s1 /dev/sdb2
hfsprescue -s2 /dev/sdb2
hfsprescue -s3 /dev/sdb2
hfsprescue -s4
hfsprescue -s5
hfsprescue -s6


6. Command line parameters


hfsprescue [-h|--help]

hfsprescue -s1 <device node|image file> [-b <block size>] [-o <offset in bytes>] [-f|--force]

hfsprescue -s2 [same parameter of -s1]

hfsprescue -s3 <device node|image file> [-b <block size>] [-o <offset in bytes>] [-e <start block>] [-c <file number>] [--alternative]

hfsprescue -s4

hfsprescue -s5

hfsprescue -s6 [-k]

hfsprescue --find <device node|image file> [-ff <file> <num bytes>] [-fs <string>] [-o <offset in bytes>]

hfsprescue --list

hfsprescue --csv <file name>

hfsprescue --one-file <device node|image file> <file number> [-b <block size>] [-o <offset in bytes>] [-e <start block>] [--alternative]

hfsprescue --find-eof [-b <block size>] [-o <offset in bytes>]

hfsprescue --find-vh [-o <offset in bytes>] [--first] [-f|--force] [-v|--verbose]


6.1 Options


  -h, --helpDisplay help and exit.

STEP 1: Scan for your files.
  -s1 <device node|image file> Run step 1. You have to tell the device node or image file.
  -b <block size> Set the block size in bytes. Useful when the boot sector has been lost.
  -f, --force Overwrite current log files.
  -o <offset> Set the start offset of the partition in bytes. Usefull when the partition table is lost or damaged. See here for a description how to calculate the offset.

STEP 2: Remove duplicate entries from the file database.
  -s2 [same parameter of -s1] Run step 2. Basically, this step needs no additional parameters. But when you want that Hfsprescue guides you through the process, then use the parameters you used for step 1 (except -s1).

STEP 3: Restore your files.
  -s3 <device node|image file> Run step 3. You have to tell the device node or image file.
  -b <block size> Set the block size in bytes. Useful when the boot sector has been lost.
  -c <file number> Continue the file restore and skip the files before <file number>.
  -e <start block> Start block of the Extents Overflow File.
  -o <offset> Set the start offset of the partition in bytes. Usefull when the partition table is lost or damaged. See here for a description how to calculate the offset.
  --alternative Find a new name when the file already exists in it's directory. Can happen with older versions or deleted files. See here for details.

STEP 4: Restore your directory structure.
  -s4 Run step 4.

STEP 5: Move the restored files to the correct directories.
  -s5 Run step 5.

STEP 6: Last step, finalize and cleanup.
  -s6 Run step 6.
  -k Keep mkdir.sh and hfsprescue_dir_id.tmp files.

FIND FILE BYTES AND/OR A UNICODE STRING: Find data on sectors. See here for details.
  --find <device node|image file> Find data. You have to tell the device node or image file.
  -ff <file> <num bytes> Find number of bytes from a file.
  -fs <string> Find a given string. The string will be converted to unicode.
  -o <offset in bytes> Start search from offset.

LIST FILES: List found files. See here for details.
  --list This parameter lists all files that have been found. You can run this after you completed Step 2.

CSV EXPORT OF FILE LIST: Export list to a CSV file. See here for details.
  --csv Export the file list to a CSV file. You can run this after you completed Step 2.

RESTORE ONE FILE: Restore just one file instead of all files that have been found. You can run this after you completed Step 2. See here for details.
  --one-file
  <device node|image file>
  <file number>
You have to tell the device node or image file and the file number of the requested file. Both parameters are required.
  -b <block size> Set the block size in bytes. Useful when the boot sector has been lost.
  -e <start block> Start block of the Extents Overflow File.
  -o <offset> Set the start offset of the partition in bytes. Usefull when the partition table is lost or damaged. See here for a description how to calculate the offset.
  --alternative Find a new name when the file already exists in it's directory. Can happen with older versions or deleted files. See here for details.

FIND EXTENTS OVERFLOW FILE: Scan the device for possible start blocks. See here for details.
  --find-eof <device node|image file> You have to tell the device node or image file.
  -b <block size> Set the block size in bytes. Useful when the boot sector has been lost.
  -o <offset> Set the start offset of the partition in bytes. Usefull when the partition table is lost or damaged. See here for a description how to calculate the offset.

FIND HFS+ VOLUME HEADER: Scan the device for possible Volume Headers and shows the start of the partition. See here for details.
  --find-vh <device node|image file> You have to tell the device node or image file.
  -o <offset in bytes> Start search from offset.
  --first Just show the first HFS+ Volume Header and quit.
  -f, --force Show Volume Header even when the lastMountVersion field reports another OS than Mac OS X or Linux.
  -v, --verbose Display detailed informations.


6.2. --alternative parameter


During the restore process, it's possible that files have the same name in the same directory. This happens because of deleted files or older versions of files. The default behaviour is, that Hfsprescue will keep only the latest version of the file, depending on the file date/time. But sometimes its needed to restore deleted and older versions of a file too. You can do this with the --alternative parameter.

With this parameter, Hfsprescue creates an alternative name, which is a combination of the original name and the Catalog ID of the file (+ if needed an additional number), when there is already a file in the directory.

Note: Older versions of a file or deleted files may be corrupted.



An additional debug/search feature is to find bytes from a file and/or unicode strings. -ff and -fi can be used with the same command.

hfsprescue --find <device node|image file> [-ff <file> <num bytes>] [-fs <string>] [-o <offset in bytes>]


Find bytes of a file -ff

You can find the bytes of a file. This can be very useful when you lost the partition table and you have to calculate the offset of the partition. It makes no sense to search for the whole file. It can be fragmented and you will never get a hit. The file size of the source file is not limited by Hfsprescue. Regardless to the file size is the maximum search buffer size 1MB. This this is really large. I suggest to use the bock size as maximum search length.

The result of the search will be logged in the file hfsprescue-data/find.log.

When you use [-o <offset in bytes>] then the search begins at the offset and skips the bytes before.

Find bytes example:

Command: hfsprescue --find /dev/sdb2 -ff PerfectPicture.jpg 4096

Sample output:

File bytes found at offset 746586112 + 28672 = 746614784 (0x2c800000 + 0x7000 = 0x2c807000)


Find string -fs

This can be used to find a unicode string. File names are encoded in unicode. Its possible to find directory entries with this feature. The search string will be converted to unicode by Hfsprescue.

The result of the search will be logged in the file hfsprescue-data/find.log.

When you use [-o <offset in bytes>] then the search begins at the offset and skips the bytes before.

Find string example:

Command: hfsprescue --find /dev/sdb2 -fs myimportantfile.doc

Sample output:

String "myimportantfile.doc" found at offset 1048576 + 326870 = 1375446 (0x100000 + 0x4fcd6 = 0x14fcd6)
String "myimportantfile.doc" found at offset 1048576 + 494446 = 1543022 (0x100000 + 0x78b6e = 0x178b6e)


6.4. List files


After you completed Step 2 you can display a list of files that have been found.

List fields: File Number: File Name, File Size, File RAW Time, File Date/Time, File Start Block

Command: hfsprescue --list

Sample output:

1: permStore, 66097 bytes, 1438688944, Tue Aug  4 13:49:04 2015, Start block 360458
2: reverseDirectoryStore, 65536 bytes, 1438688940, Tue Aug  4 13:49:00 2015, Start block 48344
3: reverseDirectoryStore.shadow, 3136 bytes, 1435230435, Thu Jun 25 13:07:15 2015, Start block 48375
4: reverseStore.updates, 1 bytes, 1438688946, Tue Aug  4 13:49:06 2015, Start block 557113
5: shutdown_time, 4 bytes, 1438067146, Tue Jul 28 09:05:46 2015, Start block 393216
6: store.db, 118784 bytes, 1438688947, Tue Aug  4 13:49:07 2015, Start block 48294
7: store.updates, 3 bytes, 1438688946, Tue Aug  4 13:49:06 2015, Start block 557112
8: store_generation, 4 bytes, 1435230434, Thu Jun 25 13:07:14 2015, Start block 48361
9: tmp.Cab, 0 bytes, 1435230434, Thu Jun 25 13:07:14 2015, Start block 0
10: tmp.Lion, 0 bytes, 1435230434, Thu Jun 25 13:07:14 2015, Start block 0
11: tmp.SnowLeopard, 0 bytes, 1435230434, Thu Jun 25 13:07:14 2015, Start block 0
12: tmp.spotlight.loc, 9961 bytes, 1438141713, Wed Jul 29 05:48:33 2015, Start block 458757
13: tmp.spotlight.state, 4096 bytes, 1438688947, Tue Aug  4 13:49:07 2015, Start block 622598
14: fseventsd-uuid, 36 bytes, 1438141708, Wed Jul 29 05:48:28 2015, Start block 393217
15: reverseStore.updates, 1 bytes, 1438688947, Tue Aug  4 13:49:07 2015, Start block 622602
16: store.updates, 3 bytes, 1438688947, Tue Aug  4 13:49:07 2015, Start block 622601
17: live.1.shadowIndexGroups, 6 bytes, 1438688945, Tue Aug  4 13:49:05 2015, Start block 163913
18: live.1.shadowIndexHead, 4096 bytes, 1438688946, Tue Aug  4 13:49:06 2015, Start block 589824
19: live.2.directoryStoreFile, 4096 bytes, 1438688943, Tue Aug  4 13:49:03 2015, Start block 524338
20: live.2.directoryStoreFile.shadow, 1088 bytes, 1438688947, Tue Aug  4 13:49:07 2015, Start block 524374
21: live.2.indexArrays, 4096 bytes, 1438688947, Tue Aug  4 13:49:07 2015, Start block 524322
22: live.2.indexCompactDirectory, 1024 bytes, 1438688947, Tue Aug  4 13:49:07 2015, Start block 524321
==== CUT =====


Use this parameter with grep to get the file number when you want to restore a single file.

Command: hfsprescue --list | grep mynotes.txt

Sample output:

2023: mynotes.txt, 966097 bytes, 1438688944, Tue Aug  4 13:49:04 2015, Start block 560458

The file number is 2023.


6.5. CSV export of file list


After you completed Step 2 you can export a list of files that have been found to a CSV file. The files are separated by semicolon (;).

Fields: Number, File Name, Parent ID, Catalog ID, File Size, File RAW Time, File Time, Start block, HFS+ Compressed

Command: hfsprescue --csv files.csv

Sample file:

"Number";"File Name";"Parent ID";"Catalog ID";"File Size";"File RAW Time";"File Time";"Start block";"HFS+ Compressed"
1;"permStore";26;106;66097;1438688944;"Tue Aug  4 13:49:04 2015";"360458";"No"
2;"reverseDirectoryStore";26;62;65536;1438688940;"Tue Aug  4 13:49:00 2015";"48344";"No"
3;"reverseDirectoryStore.shadow";26;78;3136;1435230435;"Thu Jun 25 13:07:15 2015";"48375";"No"
4;"reverseStore.updates";26;96;1;1438688946;"Tue Aug  4 13:49:06 2015";"557113";"No"
5;"shutdown_time";26;108;4;1438067146;"Tue Jul 28 09:05:46 2015";"393216";"No"
6;"store.db";26;60;118784;1438688947;"Tue Aug  4 13:49:07 2015";"48294";"No"
7;"store.updates";26;95;3;1438688946;"Tue Aug  4 13:49:06 2015";"557112";"No"
8;"store_generation";26;65;4;1435230434;"Thu Jun 25 13:07:14 2015";"48361";"No"
9;"tmp.Cab";26;33;0;1435230434;"Thu Jun 25 13:07:14 2015";"0";"No"
10;"tmp.Lion";26;31;0;1435230434;"Thu Jun 25 13:07:14 2015";"0";"No"
11;"tmp.SnowLeopard";26;30;0;1435230434;"Thu Jun 25 13:07:14 2015";"0";"No"
12;"tmp.spotlight.loc";26;98;9961;1438141713;"Wed Jul 29 05:48:33 2015";"458757";"No"
13;"tmp.spotlight.state";26;63;4096;1438688947;"Tue Aug  4 13:49:07 2015";"622598";"No"
14;"fseventsd-uuid";28;29;36;1438141708;"Wed Jul 29 05:48:28 2015";"393217";"No"
15;"reverseStore.updates";26;96;1;1438688947;"Tue Aug  4 13:49:07 2015";"622602";"No"
16;"store.updates";26;95;3;1438688947;"Tue Aug  4 13:49:07 2015";"622601";"No"
17;"live.1.shadowIndexGroups";26;132;6;1438688945;"Tue Aug  4 13:49:05 2015";"163913";"No"
18;"live.1.shadowIndexHead";26;221;4096;1438688946;"Tue Aug  4 13:49:06 2015";"589824";"No"
19;"live.2.directoryStoreFile";26;194;4096;1438688943;"Tue Aug  4 13:49:03 2015";"524338";"No"
==== CUT =====


6.6. Restore one file


Restore just one file instead of all files that have been found. You can run this after you completed Step 2.

hfsprescue --one-file <device node|image file> <file number> [-b <block size>] [-o <offset in bytes>] [-e <start block>] [--alternative]

You need the file number to restore a file. You get this number with using hfsprescue --list or from the CSV export file.

Example to restore a file called mynotes.txt:

Command 1: hfsprescue --list | grep mynotes.txt

Sample output:

2023: mynotes.txt, 966097 bytes, 1438688944, Tue Aug  4 13:49:04 2015, Start block 560458

The file number is 2023.

Command 2: hfsprescue --one-file /dev/sdb2 2023

On success, you find the file mynotes.txt in the restored/ directory.


6.7. Find the Extents Overflow File


The Extents Overflow File is used to store the postitions of file fragments when a file is splitted into more that 8 fragments on the file system. When the boot sector is destroyed or has a wrong entry for the Extents Overflow File, then its not possible to restore strong framented files. You can use --find-eof to search for possible positions of the Extents Overflow File. Hfsprescue will report a possible start blocks. I found no way to reduce the possible positions and exactly identify the Extents Overflow File. It should be one of the first 7 values. When you have strong fragmented files, then those files will be reported in the log file of step 3. Search for the text "Extents". You have to test the reported start blocks with restoring the affected file. Restore it with --one-file and set the -e <start block> parameter. When the affected file is restored correct, then you can use the -e parameter for the Step 3 too. But rename or delete the current restored/ directory to get a fresh new restored/ directory.

When you use the -o <offset in bytes> parameter, then the reported start blocks are relative to the offset value.

hfsprescue --find-eof [-b <block size>] [-o <offset in bytes>]

Example:

Command: hfsprescue --find-eof /dev/sdb2

Sample output:

Searching block positions of the Extents Overflow File...

Possible block: 217 | File position: 0xd9000
Possible block: 487 | File position: 0x1e7000
Possible block: 1023 | File position: 0x3ff000
Possible block: 1149 | File position: 0x47d000
Possible block: 2108 | File position: 0x83c000
Possible block: 3132 | File position: 0xc3c000
Possible block: 25660 | File position: 0x643c000
==== CUT =====

In this case, the correct start block was 2108.

A Step 3 command would look like hfsprescue -s3 /dev/sdb2 -e 2108


6.8. Find the HFS+ Volume Header and the partiton start offset


When you lost the partition table or you are working with a hard disk image then it's required to know the start offset of the partition with your HFS+ file system. One solution to get the partition start offset is to find the HFS+ Volume Header with the --find-vh parameter. A HFS+ file system has backups of the Volume Header. This means that Hfsprescue will report a few hits. When you had only one HFS+ partition on the drive, then the first hit should be the right one. You can use the --first paameter to limit the output to the first detected HFS+ Volume Header. A valid HFS+ Volume Header criteria of Hfsprescue is the lastMountedVersion field. This field is set by the operating system that mounts the partition. Only Mac OS X and Linux is seen as valid by Hfsprescue. When the last mount of the partition has been done by another OS, then use -f to ignore the OS limitation. If you need more informations then use the -v verbose parameter.

When you use [-o <offset in bytes>] then the search begins at the offset and skips the bytes before.

The result of the search will be logged in the file hfsprescue-data/find-vh.log.

hfsprescue --find-vh [-o <offset in bytes>] [--first] [-f|--force] [-v|--verbose]

Example, show only the first HFS+ Volume Header:

Command: hfsprescue --find-vh /dev/sdb --first

Sample output:

*** Stop searching after the first Volume Header has been found.

A Volume Header has been found.
Partition start:     209735680 (Byte), 0xc805000, 409640 (LBA Sector), at 200 MB
Volume Header start: 209736704 (Byte), 0xc805400, 409642 (LBA Sector), at 200 MB

The partition start offset is 209735680.

Use this value for the -o <offset in bytes> parameter in combination with -s3 and --one-file.

Example: hfsprescue -s3 /dev/sdb -o 209735680


7. Files used by Hfsprescue


Hfsprescue stores it's files in the directory ./hfsprescue-data/

filesfound.db Detail infos about recoverable files, duplicate entries not removed.
fileinfo.db Detail infos about recoverable files, duplicate entries removed.
fileinfo.sha Helper file to remove duplicate entries.
foldertable.db Detail infos about recoverable directory structure.
s1.log Log file of Step 1.
s2.log Log file of Step 2.
s3.log Log file of Step 3.
s4.log Log file of Step 4.
s5.log Log file of Step 5.
onefile.log Log file when recovering one file.
find.log Log file of byte and/or unicode search.
find-eof.log Log file of Extents Overflow Files search.
find-vh.log Log file of Volume Header / partition search.


8. Directories & Files


restored/newroot/recovered/Directory: You find your recovered files here.
restored/newroot/x_directory_problem/ Directory: It was not possible to link the files and directories to their parent directory. You will find here files too.
restored/newroot/x_unknown/ Directory: No valid parent directory has been found. Maybe you will find here already deleted files. The files in this directories can be invalid.
Files in restored/newroot/
INFO.TXT Just an info file for you.
recovered-files.txt
x_directory_problem-files.txt
x_unknown-files.txt
The contents of those files is just a list of the files in the corresponding directory. Useful when you need an overview of the restored files.

9. Problems / FAQs


You find here informations why files are defect recovered. Mostly its a problem because of a wrong access to the partition data. You will also see how you can find the start of a partition.

Overview:

• Partition table damaged, lost or not usable! How do I find the correct partition offset?
• How do I find the correct partition offset with a reference file.
• Restored files are invalid/defect! Why?
• Unusual block size.
• Extents Overflow File problems.
• Permission denied.
• Precompiled - FATAL: kernel too old.


9.1. Partition table damaged, lost or not usable! How do I find the correct partition offset?


Hfsprescue can help you to find the correct partition offset when

• you are working with a real drive and

- the partition table has been damaged
- the partition table has been overwritten with new partition data
- the partition table doesn't exists anymore
OR

• you are working with a complete hard disk image and
- you are unable to use the program kpartx
- the partition table has been damaged
- the partition table has been overwritten with new partition data
- the partition table doesn't exists anymore


When do I need the partition start offset?

When you are unable to access the partition then Hfsprescue cannot read the block size and the start block of the Extents Overflow File. Also it's not possible to successful restore the files, because they are stored relative to the partition start.

There are 2 ways to find the partition start offset with Hfsprescue.

1. When your HFS+ Volume Header is ok, then see Find the HFS+ Volume Header and the partiton start offset.

2. When you have a reference file, then see How do I find the correct partition offset with a reference file.


9.2. How do I find the correct partition offset with a reference file


Before you can start, it's required that you completed the file restore Steps 1 & 2. When you did that some time ago then continue.

You should know the block size of the damaged file system. Usually it's 4096.

You need a file that was on the drive. It can be any type of file. Maybe the executable file of a program (get it from another computer) or a picture file (maybe from an old backup). I prefere a picture file. Choose a file that was nearly only once on the drive to reduce false hits.


1) At first, check if the file has been found. For this example I am using a picture file called "PerfectPicture.jpg".

hfsprescue --list | grep PerfectPicture.jpg

Sample output:

77: PerfectPicture.jpg, 892187 bytes, Sun May 10 18:21:18 2015, Start block 131074

Great, the PerfectPicture.jpg file has been found. And we have luck, it was only once on the drive ;). When you have a file that has been found more than once, then either choose another file or you have to test various offset values at the end of the process until you have the right one.

2) The next step is to do a byte search for the file on the drive.

hfsprescue --find /dev/sdb -ff PerfectPicture.jpg 2000

Sample output:

File bytes found at offset 746586112 + 28672 = 746614784 (0x2c800000 + 0x7000 = 0x2c807000)

Great, our file has been found and what a surprise, the bytes have been found also only once. When the bytes have been found more than once, then you have to calculate offset values with the other found offsets too.

3) The formular.

offset = byte_search_result - list_start_block * block_size

With our values it looks like

offset = 746614784 - 131074 * 4096

When you doesn't have a calculator then use the shell for the calculation.

echo $((746614784 - 131074 * 4096))

The result is 209735680

A simple check if it could be a correct result is to modulo the value with 512. echo $((209735680 % 512)) the result must be 0.

4) Check if the calculated offset is correct.

Restore the file with --one-file and the file number from --list and the calculated offset value.

hfsprescue --one-file /dev/sdb 77 -b 4096 -o 209735680

This command restored the file to restored/PerfectPicture.jpg.

Now compare the two picture files. diff PerfectPicture.jpg restored/PerfectPicture.jpg

When diff doesn't report a difference, then the offset value for the partition is correct.

Remove the old restored/ directory and restart with Step 3 -s3 and use the calculated offset value with -o.

Example: hfsprescue -s3 /dev/sdb -b 4096 -o 209735680


9.3. Restored files are invalid/defect! Why?


The reasons can be

- you are using a wrong partition start (because of a corrupt partition table or you working with a complete hard disk image, and so on).

- the file has been deleted and overwritten on the damaged file system.

- you are using a wrong block size.

- you are using a wrong start of the Extents Overflow File.

- the Extents Overflow File is damaged.

The most cases are a wrong partition start. See here how to get the correct partition start offset.


9.4. Unusual block size


The correct block size is required to restore files. The block size is stored in the HFS+ Volume Header. When this header is corrupt or not available, then its not possible for Hfsprescue to determine the correct block size. There can be many reasons for a corrupt header. Either it is really overwritten by some data or you do not access the partition from it's beginning (Common mistake when you work with a complete hard disk image).

Solutions:

On overwritten/corrupt Volume Header: Use a common block size value (usually 4096) and set it with -b 4096.

When you work with a hard disk image: Use kpartx or set the partition start offset with -o.

On lost partition table: Set the partition start offset with -o.


9.5. Extents Overflow File problems


When you have strong fragmented files, then its required to access the Extents Overflow File which is an area on the HFS+ partition. When this area has been overwritten, then there is no chance to restore files that have informations stored in the affected area.

When the Extents Overflow File is ok, then maybe you are using the wrong partition start or you have to set the correct Extents Overflow File start block with the -e parameter.

With --find-eof you can search for possible start blocks of the Extents Overflow File.


9.6. Permission denied


When you try to access a device, then you need root permissions. Just use sudo.

Example: sudo hfsprescue -s1 /dev/sdb2

or change to the root user with su.

It's also possible that the device is mounted. Unmount the device before you run Hfsprescue.


9.7. Precompiled - FATAL: kernel too old


The Linux versions are compiled against LibC 2.20. When your Linux distribustion is using an older version then you will see the error FATAL: kernel too old. You have to compile the source code on your computer. You need GCC (GNU Compiler Collection) installed to compile Hfsprescue.


10. Mac OS X notes


When you try to restore data from a drive that is automatically mounted when you connect it, then unmount it with diskutil. This situation can happen when you connect a drive with a valid file system. Maybe after an unwanted fresh formatting.

Just figure out the device name with mount.

Sample output:

/dev/disk0s2 on / (hfs, local, journaled)
devfs on /dev (devfs, local, nobrowse)
map -hosts on /net (autofs, nosuid, automounted, nobrowse)
map auto_home on /home (autofs, automounted, nobrowse)
/dev/disk6s2 on /Volumes/Untitled (hfs, local, nodev, nosuid, journaled, noowners)
The affected device is /dev/disk6s2 (/Volumes/Untitled).

Unmount it with sudo diskutil umount /dev/disk6s2

Now you are able to access the drive.

Example: sudo hfsprescue -s1 /dev/disk6s2


11. Personal notes


I wrote this tool for my neighbour. He was unable to mount the HFS+ partition. He got the error hfs: failed to load catalog file and some other errors about the B-Tree. I was able to restore the most files. Maybe my program helps other people too.

Meanwhile, my program became very sophisticated with many features. When there are still problems then just contact me, but don't forget a friendly "hello".


12. Downloads


hfsprescue-2.0-rc2.tar.gz (2015/08/14) Source code
hfsprescue-2.0-rc2-precompiled.zip (2015/08/14) Precompied for Linux, Mac OS X, FreeBSD

hfsprescue-1.1.tar.gz (2015/02/02)
hfsprescue-1.0.tar.gz (2015/01/12)
hfsprescue-0.3.tar.gz (2013/01/30)
hfsprescue-0.2.tar.gz (2011/11/25)
hfsprescue-0.1-patched.tar.gz (2011/10/05)
hfsprescue-0.1.tar.gz (2010/11/30)



© 2015 by Elmar Hanlhofer
This page was last modified on 14/Aug/2015