Find the Extents Overflow File
The Extents Overflow File is used to store the positions of file fragments when a file is split into more that 8 fragments on the file system. When the Volume Header is destroyed or has a wrong entry for the Extents Overflow File, then its not possible to restore strong fragmented files. You can use '--find-eof' to search for possible positions of the Extents Overflow File. Hfsprescue will report possible start blocks. I found no way to reduce the possible positions and exactly identify the Extents Overflow File. It should be one of the first 7 values.
hfsprescue --find-eof [-b <block size>] [-o <offset in bytes>] [--vh-file <file name>]
Note: When you use the '-o <offset in bytes>' parameter, then the reported start blocks are relative to the offset value.
Note: When the Volume Header is defect and you have a backup, then specify the file name with '--vh-file'.
When you found positions, then you can extract the Extents Overflow File to a file. See Extract the Extents Overflow File.
Info: When you have strong fragmented files, then
• those files will be reported in the log file of Step 3. Search for the text '_has_extents_overflows_'.
© 2016 by Elmar Hanlhofer