How do I find the correct partition offset with a reference file

Before you can start, it's required that you completed the file restore Steps 1 & 2. When you did that some time ago then continue.

You should know the block size of the damaged file system. Usually it's 4096. When the partition is bigger than 2 TB, then the usual block size is 8192.

You need a file that was on the drive. It can be any type of file. Maybe the executable file of a program (get it from another computer) or a picture file (maybe from an old backup). I prefer a picture file. Choose a file that was nearly only once on the drive to reduce false hits.

1) At first check if the file has been found during -s1 and -s2. For this example I am using a picture file called 'PerfectPicture.jpg'.

hfsprescue --list | grep PerfectPicture.jpg

Sample output:

77: PerfectPicture.jpg, 892187 bytes, Sun May 10 18:21:18 2015, Start block 131074

Great, the 'PerfectPicture.jpg' file has been found. And we have luck, it was only once on the drive ;). When you have a file that has been found more than once, then either choose another file or you have to test various offset values at the end of the process until you have the right one.

2) The next step is to do a byte search for the file on the drive.

hfsprescue --find /dev/sdb -ff 4096 PerfectPicture.jpg

Sample output:

File bytes found at offset 746586112 + 28672 = 746614784 (0x2c800000 + 0x7000 = 0x2c807000)

Great, the bytes of our file have been found and what a surprise, the bytes have been found also only once. When the bytes have been found more than once, then you have to calculate offset values with the other found offsets too.

3) The formula.

offset = byte_search_result - list_start_block * block_size

With our values it looks like

offset = 746614784 - 131074 * 4096

When you doesn't have a calculator then use the shell for the calculation.

echo $((746614784 - 131074 * 4096))

The result is 209735680

A simple check if it could be a correct result is to modulo the value with 512. echo $((209735680 % 512)) the result must be 0.

4) Check if the calculated offset is correct.

Restore the file with '--one-file' and the file number from '--list' and the calculated offset value.

hfsprescue --one-file /dev/sdb 77 -b 4096 -o 209735680

This command restored the file to restored/PerfectPicture.jpg.

Now compare the reference file with the restored file. diff PerfectPicture.jpg restored/PerfectPicture.jpg

When 'diff' doesn't report a difference, then the offset value for the partition is correct.

Remove the old 'restored/' directory and restart with Step 3 '-s3' and use the calculated offset value with '-o'.

Example: hfsprescue -s3 /dev/sdb -b 4096 -o 209735680

© 2024 by Elmar Hanlhofer