<< Previous
Additional features

Next >>
List found files

Command line parameters

hfsprescue [-h|--help] [--version]

hfsprescue -s1 <device node|image file>
                 [-b <block size>]
                 [-o <offset in bytes>]
                 [-d <working / destination directory>]
                 [-f|--force]

hfsprescue -s2 [--utf8len <value 1 to 5>] [--future-days <days>]

hfsprescue -s3 <device node|image file>
                 [-b <block size>]
                 [-o <offset in bytes>]
                 [-d <working directory>]
                 [--vh-file <file name>]
                 [--eof-file <file name>]
                 [-c <file number>]
                 [--file-list <file name>]
                 [--file-list-csv <file name>]
                 [--alternative]
                 [--ignore-blocks]
                 [--ignore-file-error]

hfsprescue -s4 [-d <working directory>]

hfsprescue -s5 [-d <working directory>]

hfsprescue -s6 [-d <working directory>] [-k]

hfsprescue --find <device node|image file>
                 [-ff <num bytes> <file1> [file2] [...]]
                 [-fs <string>]
                 [-o <offset in bytes>]

hfsprescue --list [--slash] [-d <working directory>]

hfsprescue --csv <file name> [--slash] [-d <working directory>]

hfsprescue --one-file <device node|image file> <file number>
                 [-b <block size>]
                 [-o <offset in bytes>]
                 [-d <working directory>]
                 [--vh-file <file name>]
                 [--eof-file <file name>]
                 [--alternative]

hfsprescue --find-eof
                 [-b <block size>]
                 [-o <offset in bytes>]
                 [--vh-file <file name>]

hfsprescue --extract-eof <device node|image file>
                 [ [--start-block <number>] < [--last-block <number>] | [--num-blocks <number>] > ]
                 [--eof-file <output file>]
                 [--vh-file <file name>]

hfsprescue --find-vh
                 [-o <offset in bytes>]
                 [--first]
                 [-f|--force]
                 [-v|--verbose]

hfsprescue --find-avh
                 [--first]
                 [-f|--force]
                 [-v|--verbose]

hfsprescue --extract-vh <device node|image file> <LBA sector>
[--vh-file <output file>]

hfsprescue --remove-empty-dirs
[--dir <directory>]
[-f|--force]

Parameter description

Display help

	-h, --help	Display help and exit.
	--version	Show program version.

Step 1 '-s1'

Scan for your files.

	-s1 <device node\|image file>	Run step 1. You have to tell the device node or image file.
	-b <block size>	Set the block size in bytes. Useful when the Volume Header has been lost.
	-f, --force	Overwrite current log files.
	-o <offset>	Set the start offset of the partition in bytes. Useful when the partition table is lost or damaged. See here for a description how to calculate the offset.
	-d <working / destination directory>	Use this directory instead of current directory.

Step 2 '-s2'

Cleanup file database.

	-s2	Run step 2.
	--utf8len <value 1 to 5>	Used for false file name detection. When you don't have file names with asian chars, then you don't have to use this option. The default value 1. Use 2 when you have asian file names. The values 3 to 5 should not be used.
	--future-days <days>	Used for false file detection. Files with a creation date in the future are ignored. Default value is 7.
	-d <working directory>	Use working directory directory.

Step 3 '-s3'

Restore your files.

	-s3 <device node\|image file>	Run step 3. You have to tell the device node or image file.
	-b <block size>	Set the block size in bytes. Useful when the Volume Header has been lost.
	-c <file number>	Continue the file restore and skip the files before <file number>.
	-o <offset>	Set the start offset of the partition in bytes. Useful when the partition table is lost or damaged. See here for a description how to calculate the offset.
	-d <working directory>	Use working directory directory.
	--vh-file <file name>	Volume Header file. See also here
	--eof-file <file name>	Extents Overflow File. See also here
	--file-list <file name>	Restore files listed in file. See also here
	--file-list-csv <file name>	Restore files listed in a CSV file. See also here
	--alternative	Find a new name when the file already exists in it's directory. Can happen with older versions or deleted files. See here for details.
	--ignore-blocks	Do not skip file restore when more blocks are allocated as needed. This is related for files bigger than 1 GB. Affected files are marked with '_too_many_blocks_skipped_' in the log file of step 3.
	--ignore-file-error	Do not stop when there is a file creation error. Affected files are marked with '_file_create_error_' in the log file of step 3.

Step 4 '-s4'

Restore your directory structure.

	-s4	Run step 4.
	-d <working directory>	Use working directory directory.

Step 5 '-s5'

Move the restored files to the correct directories.

	-s5	Run step 5.
	-d <working directory>	Use working directory directory.

Step 6 '-s6'

Last step, finalize and cleanup.

	-s6	Run step 6.
	-d <working directory>	Use working directory directory.
	-k	Keep mkdir.sh and hfsprescue_dir_id.tmp files.

Find file bytes and/or an unicode string '--find'

Find data on sectors. See here for details.

	--find <device node\|image file>	Find data. You have to tell the device node or image file.
	-ff <num bytes> <file1> [file2] [...]	Find number of bytes from given files.
	-fs <string>	Find a given string. The string will be converted to Unicode.
	-o <offset in bytes>	Start search from offset.

List files '--list'

List found files. See here for details.

	--list	This parameter lists all files that have been found. You can run this after you completed Step 2.
	--slash	Mac OS X allows the char '/' in file names in the GUI. For directory compatibility, '/' is converted to ':'. Use --slash when you want to display the '/' in the file name instead of ':'. Maybe when you search a file name which has '/'.
	-d <working directory>	Use working directory directory.

CSV export of file list '--csv'

Export list to a CSV file. See here for details.

	--csv	Export the file list to a CSV file. You can run this after you completed Step 2.
	--slash	Mac OS X allows the char '/' in file names in the GUI. For directory compatibility, '/' is converted to ':'. Use --slash when you want to export the '/' in the file name instead of ':'.
	-d <working directory>	Use working directory directory.

Restore one file '--one-file'

Restore just one file instead of all files that have been found. You can run this after you completed Step 2. See here for details.

	--one-file <device node\|image file> <file number>	You have to tell the device node or image file and the file number of the requested file. Both parameters are required.
	-b <block size>	Set the block size in bytes. Useful when the Volume Header has been lost.
	-o <offset>	Set the start offset of the partition in bytes. Useful when the partition table is lost or damaged. See here for a description how to calculate the offset.
	-d <working directory>	Use working directory directory.
	--vh-file <file name>	Volume Header file. See also here
	--eof-file <file name>	Extents Overflow File. See also here
	--alternative	Find a new name when the file already exists in it's directory. Can happen with older versions or deleted files. See here for details.

Find the Extents Overflow File '--find-eof'

Scan the device for possible start blocks. See here for details.

	--find-eof <device node\|image file>	You have to tell the device node or image file.
	-b <block size>	Set the block size in bytes. Useful when the Volume Header has been lost.
	-o <offset>	Set the start offset of the partition in bytes. Useful when the partition table is lost or damaged. See for a description how to calculate the offset.

Extract the Extents Overflow File '--extract-eof'

See here for details.

	--extract-eof <device node\|image file>	You have to tell the device node or image file.
	--start-block <number>	Start block of the Extents Overflow File. Needs also '--last-block' or '--num-blocks'.
	--last-block <number>	Last block of the Extents Overflow File. Needs also '--start-block'.
	--num-blocks <number>	Number of blocks of the Extents Overflow File. Needs also '--start-block'.
	--eof-file <output file>	Save file as file name.
	--vh-file <file name>	Volume Header file name.

Find the HFS+ Volume Header '--find-vh'

Scan the device for possible Volume Headers and shows the start of the partition. See here for details.

	--find-vh <device node\|image file>	You have to tell the device node or image file.
	-o <offset in bytes>	Start search from offset.
	--first	Just show the first HFS+ Volume Header and quit.
	-f, --force	Show Volume Header even when the lastMountVersion field reports another OS than Mac OS X or Linux.
	-v, --verbose	Display detailed information.

Find the HFS+ Alternate Volume Header '--find-vh'

Scan the device for possible Alternate Volume Headers. See here for details.

	--find-avh <device node\|image file>	You have to tell the device node or image file.
	--first	Just show the first HFS+ Volume Header and quit.
	-f, --force	Show Volume Header even when the lastMountVersion field reports another OS than Mac OS X or Linux.
	-v, --verbose	Display detailed information.

Extract the Volume Header'--extract-vh'

See here for details.

	--extract-vh <device node\|image file>	You have to tell the device node or image file.
	LBA sector	Required input. LBA sector number of the Volume Header.
	--vh-file <output file>	Save as file name.

Remove empty directories '--remove-empty-dirs'

See here for details.

	--remove-empty-dirs	Without additional parameters, the directory './restored' is used.
	--dir <directory>	Use the given directory to scan for and remove empty directories.
	-f, --force	Don't ask a question to start.

The '--alternative' parameter

During the restore process, it's possible that files have the same name in the same directory. This happens because of deleted files or older versions of files. The default behavior is, that hfsprescue will keep only the latest version of the file, depending on the file date/time. But sometimes its needed to restore deleted and older versions of a file too. You can do this with the '--alternative' parameter.

With this parameter, hfsprescue creates an alternative name, which is a combination of the original name and the Catalog ID of the file (+ if needed an additional number), when there is already a file in the directory.

Note: Older versions of a file or deleted files may be corrupted.

<< Previous
Additional features

Table of Contents

Next >>
List found files