English / Deutsch | Print version
Twitter
twitter

<< Previous
Find the Extents Overflow File

Table of Contents

Next >>
Remove empty directories

Extract the Extents Overflow File


The Extents Overflow File is required to restore heavy fragmented files. The Extents Overflow File is extracted automatically to a file by Hfsprescue when the Volume Header is valid and you use '-s3' or '--one-file'.

You can extract the Extents Overflow File on demand with '--extract-eof'.

hfsprescue --extract-eof <device node|image file> [ [--start-block <number>] < [--last-block <number>] | [--num-blocks <number>] > ] [--eof-file <output file>] [--vh-file <file name>]

The default output file is './restored/ExtentsOverflowFile'. You can set another file name with '--eof-file <output file>'.

Note: When you formatted the partition, then the Extents Overflow File is lost in the most cases.


Valid Volume Header

When your Volume Header is valid, then '--extract-eof' does not need any additional parameters to extract the Extents Overflow File.

Example: 'hfsprescue --extract-eof /dev/sdb1'

Signature:                      0x2b48, H+
LastMountedVersion:             H+Lx, last mount by Linux.
FileCount:                      4362
DirCount:                       144
BlockSize:                      4096
TotalBlocks:                    244190208
AllocationFile StartBlock:      1
ExtentsOverflowFile StartBlock: 7454
CatalogFile StartBlock:         10270
Total size:                     931 GB

Extracting the ExtentsOverflowFile to 'restored/ExtentsOverflowFile'.

Size: 11534336 bytes, 11.00 MB
Clump Size: 11534336 bytes
Total Blocks: 2816
Extent 0: Start 7454, Num 2816
Extent 1: Start 0, Num 0
Extent 2: Start 0, Num 0
Extent 3: Start 0, Num 0
Extent 4: Start 0, Num 0
Extent 5: Start 0, Num 0
Extent 6: Start 0, Num 0
Extent 7: Start 0, Num 0

File created.

Extract with Volume Header problems

When your Volume Header is defect, then you can use '--find-eof' to locate possible positions of the Extents Overflow File. You can use those possible positions and try to extract the Extents Overflow File. When you extract with '--start-block' and '--last-block' / '--num-blocks' then only the given range will be extracted. When the Extents Overflow File itself has fragments, then its not possible to restore the whole file without a Volume Header. You can use a Volume Header file with '--vh-file <file name>' when the partition Volume Header is defect.

A simple example:

• At first, search for possible locations.

hfsprescue --find-eof /dev/sdb -b 4096

*** Force block size: 4096
Signature:                      0x00,  (Unknown)
LastMountedVersion:             , last mount was not done by Mac OS X.
FileCount:                      0
DirCount:                       0
BlockSize:                      4096
TotalBlocks:                    0
AllocationFile StartBlock:      0
ExtentsOverflowFile StartBlock: 0
CatalogFile StartBlock:         0
Total size:                     931 GB

Searching block positions of the Extents Overflow File...

1. Possible block: 7710 | File position: 0x1e1e000    
2. Possible block: 10526 | File position: 0x291e000    maybe ExtentsOverflowFile or CatalogFile

• Then extract the Extents Overflow File. We use as start block the first entry and as last block the second entry value -1.

hfsprescue --extract-eof /dev/sdb -b 4096 --start-block 7710 --last-block 10525

*** Force block size: 4096
Signature:                      0x00,  (Unknown)
LastMountedVersion:             , last mount was not done by Mac OS X.
FileCount:                      0
DirCount:                       0
BlockSize:                      4096
TotalBlocks:                    0
AllocationFile StartBlock:      0
ExtentsOverflowFile StartBlock: 0
CatalogFile StartBlock:         0
Total size:                     931 GB

Extracting the ExtentsOverflowFile to 'restored/ExtentsOverflowFile'.
*** Warning. No extents of the ExtentsOverflowFile will be restored.
Extracting blocks from 7710 to 10525. 2816 blocks.
File created.

You have to test the extracted Extents Overflow File with restoring a strong fragmented file.

Use 'hfsprescue --list | grep _F_EOF_' to find an affected file.
Use '--one-file' to restore the file. Then check the restored file.

When you find more possible positions, then you have to test them until you find the correct start/end of the Extents Overflow File.



<< Previous
Find the Extents Overflow File

Table of Contents

Next >>
Remove empty directories


© 2016 by Elmar Hanlhofer