Development Linux

How to recover HFS+ Partition Catalog (Possible failing drive)

I have a 1TB External drive that was formatted HFS+ for use with a Macintosh Apple Computer. The drive is completely full.

I’m using Linux to try to recover all the files, or to repair the disk and then mount it and retrieve everything.

I tried gddrescue, but that was taking too long to finish. At 0.06% of the recovery, it slows down to bytes/second scanned, and eventually sped up a little, but still seemed too slow for my liking. To fully recover this 1TB, it had 41 years remaining. I ran it for a day, and decided that 41 years of ddrescue is longer than the data will have value.

I then started photorec, which seems to be recovering deleted files from the partition just fine. However, I would like to recover everything (including an intact directory structure, preferably) and not just the files that were deleted before the drive began to fail.

I tried fsck.hfsplus -d and got these results,

** /dev/sdd1
    Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
** Checking HFS Plus volume.
   Catalog file entry not found for extent
(4, 0)
** Volume check failed.
volume check failed with error 7 
    volume type is pure HFS+ 
    primary MDB is at block 0 0x00 
    alternate MDB is at block 0 0x00 
    primary VHB is at block 2 0x02 
    alternate VHB is at block 1953458172 0x746f67fc 
    sector size = 512 0x200 
    VolumeObject flags = 0x07 
    total sectors for volume = 1953458174 0x746f67fe 
    total sectors for embedded volume = 0 0x00 

Seeing the Catalog file entry not found for extent error, which I also get when trying to preen, I decided to rebuild the catalog with -r, but no success. I think a catalog must exist in order for it to be rebuilt or repaired.

fsck.hfsplus -q reports a DIRTY FILESYSTEM.

I tried using hsfprescue which seems like the perfect tool for my problem, but during the analyze step (hfsprescue -s1) it hangs at 0.06% just like ddrescue. Likewise testdisk hangs during analysis when it gets to cylindar 74.

I gave the drive to someone that has an iMac and he tried it’s GUI disk utility software to fix the drive, to no avail. (I do not know what error is produced, if any)

I have a backup of this drive from some time last year, but the backup has less than half of the amount of data that’s actually stored on the drive currently.

I’m looking for advice on how to either repair the disk so it can be mounted and all the data copied off, or perhaps another tool similar to photorec can be recommended, but one which can recover all files and folder structures. Basically, what I should do next, at this point.

Also, in your advice, feel free to refrain from “Lesson learned, constantly back up ur stuff!” lectures. The drive is not mine, and the backup that I do have was made without the owner’s knowledge, consent, permission, etc. and I’m unable to convince said owner of the value of backing up data, even after events such as drive failures.

Leave a Reply

Your email address will not be published. Required fields are marked *