| English / Deutsch | Print version |  |
<< Previous |
Table of Contents | Next >> |
Extract the Extents Overflow File
The Extents Overflow File is required to restore heavy fragmented files. The Extents Overflow File is extracted automatically to a file by hfsprescue when the Volume Header is valid and you use '-s3' or '--one-file'.
You can extract the Extents Overflow File on demand with '--extract-eof'.
hfsprescue --extract-eof <device node|image file> [ [--start-block <number>] < [--last-block <number>] | [--num-blocks <number>] > ] [--eof-file <output file>] [--vh-file <file name>]
The default output file is './restored/ExtentsOverflowFile'. You can set another file name with '--eof-file <output file>'.
Note: When you formatted the partition, then the Extents Overflow File is lost in the most cases.
Valid Volume Header
When your Volume Header is valid, then '--extract-eof' does not need any additional parameters to extract the Extents Overflow File.
Example: 'hfsprescue --extract-eof /dev/sdb1'
Signature: 0x2b48, H+ LastMountedVersion: H+Lx, last mount by Linux. FileCount: 4362 DirCount: 144 BlockSize: 4096 TotalBlocks: 244190208 AllocationFile StartBlock: 1 ExtentsOverflowFile StartBlock: 7454 CatalogFile StartBlock: 10270 Total size: 931 GB Extracting the ExtentsOverflowFile to 'restored/ExtentsOverflowFile'. Size: 11534336 bytes, 11.00 MB Clump Size: 11534336 bytes Total Blocks: 2816 Extent 0: Start 7454, Num 2816 Extent 1: Start 0, Num 0 Extent 2: Start 0, Num 0 Extent 3: Start 0, Num 0 Extent 4: Start 0, Num 0 Extent 5: Start 0, Num 0 Extent 6: Start 0, Num 0 Extent 7: Start 0, Num 0 File created.
Extract with Volume Header problems
When your Volume Header is defect, then you can use '--find-eof' to locate possible positions of the Extents Overflow File. You can use those possible positions and try to extract the Extents Overflow File. When you extract with '--start-block' and '--last-block' / '--num-blocks' then only the given range will be extracted. When the Extents Overflow File itself has fragments, then its not possible to restore the whole file without a Volume Header. You can use a Volume Header file with '--vh-file <file name>' when the partition Volume Header is defect.
A simple example:
• At first, search for possible locations.
hfsprescue --find-eof /dev/sdb -b 4096
*** Force block size: 4096 Signature: 0x00, (Unknown) LastMountedVersion: , last mount was not done by Mac OS X. FileCount: 0 DirCount: 0 BlockSize: 4096 TotalBlocks: 0 AllocationFile StartBlock: 0 ExtentsOverflowFile StartBlock: 0 CatalogFile StartBlock: 0 Total size: 931 GB Searching block positions of the Extents Overflow File... 1. Possible block: 7710 | File position: 0x1e1e000 2. Possible block: 10526 | File position: 0x291e000 maybe ExtentsOverflowFile or CatalogFile
• Then extract the Extents Overflow File. We use as start block the first entry and as last block the second entry value -1.
hfsprescue --extract-eof /dev/sdb -b 4096 --start-block 7710 --last-block 10525
*** Force block size: 4096 Signature: 0x00, (Unknown) LastMountedVersion: , last mount was not done by Mac OS X. FileCount: 0 DirCount: 0 BlockSize: 4096 TotalBlocks: 0 AllocationFile StartBlock: 0 ExtentsOverflowFile StartBlock: 0 CatalogFile StartBlock: 0 Total size: 931 GB Extracting the ExtentsOverflowFile to 'restored/ExtentsOverflowFile'. *** Warning. No extents of the ExtentsOverflowFile will be restored. Extracting blocks from 7710 to 10525. 2816 blocks. File created.
You have to test the extracted Extents Overflow File with restoring a strong fragmented file.
Use 'hfsprescue --list | grep _F_EOF_' to find an affected file.
Use '--one-file' to restore the file. Then check the restored file.
When you find more possible positions, then you have to test them until you find the correct start/end of the Extents Overflow File.
<< Previous |
Table of Contents | Next >> |
© 2024 by
Elmar Hanlhofer