Reconstructing thread records in HFS+

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
fgyamauti
Posts: 3
Joined: 31 Jan 2018, 13:58

Reconstructing thread records in HFS+

#1 Post by fgyamauti »

Hi all,

First of all, I want to thank Christophe Grenier for making TestDisk open source.

For the sake of completeness, I will describe briefly my problem regarding the internal HDD corruption. I have a MacBook Pro (early 2011) which is unable to boot from the internal HDD called Macintosh HD. I believe that the internal HDD is not physically damaged. The problem started when I upgraded from last version of Sierra to High Sierra, which failed. Now, when using First Aid on Macintosh HD through Disk Utility, an error regarding uncountably many missing thread records appears, so as I understand the problem is in the catalog file data (there's nothing pointing to the parent folder due to the incorrect number of thread records). I'm currently booting from an external HDD with Sierra installed on it. As expected, I can't mount Macintosh HD.

I'm not sure if TestDisk is by design meant to solve my kind of problem.

My volumes are the following:

Code: Select all

/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *500.1 GB   disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:          Apple_CoreStorage Macintosh HD            499.2 GB   disk0s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

/dev/disk1 (internal, virtual):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS                        +498.9 GB   disk1
                                 Logical Volume on disk0s2
                                 D8811A76-851D-47F2-8025-A341C73D9D4C
                                 Unencrypted

/dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *999.5 GB   disk2
   1:                        EFI EFI                     209.7 MB   disk2s1
   2:                  Apple_HFS Untitled                998.6 GB   disk2s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk2s3

/dev/disk3 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:        CD_partition_scheme                        *804.4 MB   disk3
Further information about the physical and logical volume of the corrupted HDD:

Code: Select all

Device Identifier:        disk1
   Device Node:              /dev/disk1
   Whole:                    Yes
   Part of Whole:            disk1
   Device / Media Name:      TOSHIBA MK5065GSXF

   Volume Name:              
   Mounted:                  No

   Content (IOContent):      Apple_HFS
   File System Personality:  HFS+
   Type (Bundle):            hfs
   Name (User Visible):      Mac OS Extended
   Journal:                  Unknown (not mounted)
   Owners:                   Disabled

   OS Can Be Installed:      No
   Recovery Disk:            disk0s3
   Media Type:               Generic
   Protocol:                 SATA
   SMART Status:             Not Supported
   Disk / Partition UUID:    D8811A76-851D-47F2-8025-A341C73D9D4C

   Disk Size:                498.9 GB (498876809216 Bytes) (exactly 974368768 512-Byte-Units)
   Device Block Size:        512 Bytes

   Volume Total Space:       0 B (0 Bytes) (exactly 0 512-Byte-Units)
   Volume Available Space:   0 B (0 Bytes) (exactly 0 512-Byte-Units)

   Read-Only Media:          No
   Read-Only Volume:         Not applicable (not mounted)

   Device Location:          Internal
   Removable Media:          Fixed

   Solid State:              No
   Virtual:                  Yes
   OS 9 Drivers:             No
   Low Level Format:         Not supported

   This disk is a Core Storage Logical Volume (LV).  Core Storage Information:
   LV UUID:                  D8811A76-851D-47F2-8025-A341C73D9D4C
   LVF UUID:                 8B40412E-5901-4DDC-9B1D-B3794F00C573
   LVG UUID:                 ABA28B2D-813B-46A5-AD6D-002268C16BA8
   PV UUID (disk):           9C02BF30-5616-43F3-97CE-F4B4F296BB6C (disk0s2)
   Fusion Drive:             No
   Encrypted:                No

Code: Select all

   Device Identifier:        disk0s2
   Device Node:              /dev/disk0s2
   Whole:                    No
   Part of Whole:            disk0

   Volume Name:              Not applicable (no file system)
   Mounted:                  Not applicable (no file system)
   File System:              None

   Partition Type:           Apple_CoreStorage
   OS Can Be Installed:      No
   Recovery Disk:            disk0s3
   Media Type:               Generic
   Protocol:                 SATA
   SMART Status:             Verified
   Disk / Partition UUID:    2360AB4C-2924-41A0-AFD8-F342EF19699A

   Disk Size:                499.2 GB (499248103424 Bytes) (exactly 975093952 512-Byte-Units)
   Device Block Size:        512 Bytes

   Read-Only Media:          No
   Read-Only Volume:         Not applicable (no file system)

   Device Location:          Internal
   Removable Media:          Fixed

   Solid State:              No

   This disk is a Core Storage Physical Volume (PV).  Core Storage Information:
   PV UUID:                  9C02BF30-5616-43F3-97CE-F4B4F296BB6C
   LVG UUID:                 ABA28B2D-813B-46A5-AD6D-002268C16BA8
I have already performed Deep Search (I have never pressed the Write option) and I also have used PhotoRec (which was not able to recover any files that I was interested in saving). However after such actions, the Macintosh HD was not being detected by Disk Utility. Fortunately, it was visible in Disk Utility through the Recovery Mode. After applying First Aid in the Recovery Mode, I could make Disk Utility see it again outside of the Recovery Mode. Unfortunately, I forgot to save the 'testdisk.log' file.

For the above reason, I'm afraid of performing a Deep Search again unless it's strictly necessary.

I've just performed a Quick Search now. The 'testdisk.log' file contains the following:

Code: Select all

Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, January 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 16.7.0 (Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.7
Compiler: GCC 4.0
Compilation date: 2018-01-08T19:00:18
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 500 GB / 465 GiB - 976773168 sectors, sector size=512
Disk /dev/disk2 - 999 GB / 930 GiB - 1952151552 sectors (RO), sector size=512
Disk /dev/disk3 - 804 MB / 767 MiB - 342016 sectors (RO), sector size=2352
Disk /dev/rdisk0 - 500 GB / 465 GiB - 976773168 sectors, sector size=512
Disk /dev/rdisk2 - 999 GB / 930 GiB - 1952151552 sectors (RO), sector size=512
Disk /dev/rdisk3 - 804 MB / 767 MiB - 342016 sectors (RO), sector size=2352

Partition table type (auto): EFI GPT
Disk /dev/rdisk0 - 500 GB / 465 GiB
Partition table type: EFI GPT

Analyse Disk /dev/rdisk0 - 500 GB / 465 GiB - 976773168 sectors
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976773167 (expected 976773167)
hdr_lba_start=34
hdr_lba_end=976773134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
53746f72 6167 11aa aa 11 00 30 65 43 ec ac
Current partition structure:
 1 P EFI System                    40     409639     409600 [EFI System Partition]
 2 P Unknown                   409640  975503591  975093952 [Customer]
 3 P Mac Boot               975503592  976773127    1269536 [Recovery HD]

search_part()
Disk /dev/rdisk0 - 500 GB / 465 GiB - 976773168 sectors
FAT32 at 40/0/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
     EFI System                    40     409639     409600 [EFI System Partition] [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 409640/0/1

HFS+ magic value at 409640/0/1
part_size 974368768
     Mac HFS                   409640  974778407  974368768
     HFS+ blocksize=4096 + Backup, 498 GB / 464 GiB

HFS+ magic value at 975503592/0/1

HFS+ magic value at 975503592/0/1
part_size 1269536
     Mac HFS                975503592  976773127    1269536
     HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

Results
   P EFI System                    40     409639     409600 [EFI System Partition] [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
   P Mac HFS                   409640  974778407  974368768
     HFS+ blocksize=4096 + Backup, 498 GB / 464 GiB
   P Mac HFS                975503592  976773127    1269536
     HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

interface_write()
 1 P EFI System                    40     409639     409600 [EFI System Partition] [EFI]
 2 P Mac HFS                   409640  974778407  974368768
 3 P Mac HFS                975503592  976773127    1269536
simulate write!

TestDisk exited normally.
Thanks in advance,

Fernando

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Reconstructing thread records in HFS+

#2 Post by cgrenier »

What is the filesystem you are trying to fix ? You can try to fix it using a command similar to

Code: Select all

sudo fsck_hfs -r -d /dev/disk1s1

fgyamauti
Posts: 3
Joined: 31 Jan 2018, 13:58

Re: Reconstructing thread records in HFS+

#3 Post by fgyamauti »

cgrenier wrote: 02 Feb 2018, 07:01 What is the filesystem you are trying to fix ? You can try to fix it using a command similar to

Code: Select all

sudo fsck_hfs -r -d /dev/disk1s1
I want to fix disk0s2 or disk1. Hmm...Maybe you mean disk0s2 (Macintosh HD) or disk1 (Logical volume of Macintosh HD) since disk1s1 apparently does not exist. In this case, I get the following outputs:

Code: Select all

sudo fsck_hfs -r -d /dev/disk0s2
journal_replay(/dev/disk0s2) returned 0
** /dev/rdisk0s2
	Using cacheBlockSize=32K cacheTotalBlock=32768 cacheSize=1048576K.
   Executing fsck_hfs (version hfs-366.70.1).
	Block 975093950 is not an MDB or Volume Header 
** Checking Journaled HFS Plus volume.
** Checking extents overflow file.
** Checking catalog file.
** Rebuilding catalog B-tree.
hfs_UNswap_BTNode: invalid node height (1)
** The volume   could not be repaired.
	volume type is pure HFS+ 
	primary MDB is at block 0 0x00 
	alternate MDB is at block 0 0x00 
	primary VHB is at block 2 0x02 
	alternate VHB is at block 975093950 0x3a1ec0be 
	sector size = 512 0x200 
	VolumeObject flags = 0x03 
	total sectors for volume = 975093952 0x3a1ec0c0 
	total sectors for embedded volume = 0 0x00 
	CheckHFS returned 8, fsmodified = 0

Code: Select all

sudo fsck_hfs -r -d /dev/disk1
journal_replay(/dev/disk1) returned 0
** /dev/rdisk1
	Using cacheBlockSize=32K cacheTotalBlock=32768 cacheSize=1048576K.
   Executing fsck_hfs (version hfs-366.70.1).
** Checking Journaled HFS Plus volume.
** Checking extents overflow file.
** Checking catalog file.
** Rebuilding catalog B-tree.
hfs_UNswap_BTNode: invalid node height (1)
** The volume   could not be repaired.
	volume type is pure HFS+ 
	primary MDB is at block 0 0x00 
	alternate MDB is at block 0 0x00 
	primary VHB is at block 2 0x02 
	alternate VHB is at block 974368766 0x3a13affe 
	sector size = 512 0x200 
	VolumeObject flags = 0x07 
	total sectors for volume = 974368768 0x3a13b000 
	total sectors for embedded volume = 0 0x00 
	CheckHFS returned 8, fsmodified = 1
I'm actually not even sure if I'm in the correct section of this forum.

Best Regards.

fgyamauti
Posts: 3
Joined: 31 Jan 2018, 13:58

Re: Reconstructing thread records in HFS+

#4 Post by fgyamauti »

Hi Christophe,

Since you have not replied my last reply, I'm not sure if my problem indeed cannot be solved or whether you haven't seen my reply. I hope that I'm not sounding rude. I'm sure that you have a lot of other things to do, but, since it has been a while now, I suppose that you have forgotten about this thread. Could you please let me know if I'm really doomed to format my HDD and lose all my data?

Thanks in advance.

Joyce735
Posts: 1
Joined: 05 Jan 2019, 05:34

Re: Reconstructing thread records in HFS+

#5 Post by Joyce735 »

Hey,
thank you so far for your tutorial. I accidentely formated my HFS external hard drive with exfat4. now i try to get the data back. my problem is, the it needs a lot of time to scan the harddrive myprepaidcenter.
Last edited by Joyce735 on 25 Jan 2019, 05:46, edited 1 time in total.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Reconstructing thread records in HFS+

#6 Post by cgrenier »

Unless you have deleted and recreated a partition, you can try fsck_hfs as explained previously.

Locked