jivanpal / drat Goto Github PK
View Code? Open in Web Editor NEWUtility for performing data recovery and analysis of APFS partitions/containers.
License: GNU General Public License v3.0
drat's People
Contributors
Stargazers
Watchers
Forkers
ggscott memecode itymarcel lornally turtlearm toroskae harveyfhn johnsonaugustine bigfoxses ldm0 haol666 shuzaei ink-splatters videovip kidscripto xleecoffee pwhiddy sdfguj wahello chiendhdrat's Issues
Cannot specify block size using argument `--block-size`
Greetings.
I'm trying release 0.1.3 on Mac Big Sur 11.6.4, and run across error related to block size. Any insights will be highly appreciated.
First, tried inspect:
sudo ./drat-0.1.3 inspect /dev/disk2
Opening file at `/dev/disk2` in read-only mode ... OK.
Simulating a mount of the APFS container.
Reading container superblock at address 0x0, assuming default block size of 4096 bytes ... Actual block size stated in container superblock is 0 bytes; re-reading block 0x0 using new block size ... ABORT: read_blocks: Unexpected beaviour --- `fread` read fewer blocks than expected, but `feof` did not report EOF and `ferror` did not detect an error.
Meanwhile, hdiutil stated the block size is 512. Not sure if it's the same block size.
hdiutil imageinfo /dev/disk2
Class Name: CRawDiskImage
Size Information:
Total Bytes: 253545676800
Compressed Ratio: 1
Sector Count: 495206400
Total Non-Empty Bytes: 253545676800
Compressed Bytes: 253545676800
Total Empty Bytes: 0
Checksum Type: None
Format: RAW*
partitions:
partition-scheme: fdisk
block-size: 512
partitions:
0:
partition-name: Master Boot Record
partition-start: 0
partition-synthesized: true
partition-length: 1
partition-hint: MBR
boot-code: 0x0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
1:
partition-name:
partition-start: 1
partition-synthesized: true
partition-length: 65535
partition-hint: Apple_Free
2:
partition-start: 65536
partition-number: 1
partition-length: 495140864
partition-hint: Apple_HFS
partition-filesystems:
HFS+:
burnable: false
Format Description: raw read/write
Checksum Value:
Properties:
Encrypted: false
Kernel Compatible: false
Checksummed: false
Software License Agreement: false
Partitioned: false
Compressed: no
Segments:
0: /dev/rdisk2
Backing Store Information:
URL: file:///dev/rdisk2
Name: rdisk2
Class Name: CDevBackingStore
Resize limits (per hdiutil resize -limits):
min cur max
495206400 495206400 495206400
Then, I want specify the block size when executing drat, but failed:
sudo ./drat-0.1.3 inspect /dev/disk2 --block-size 512
Incorrect number of arguments.
Usage: inspect <container>
Example: inspect /dev/disk0s2
Finally, I tried sub-container name:
sudo ./drat-0.1.3 inspect /dev/disk2s1
Opening file at `/dev/disk2s1` in read-only mode ... OK.
Simulating a mount of the APFS container.
Reading container superblock at address 0x0, assuming default block size of 4096 bytes ... Actual block size stated in container superblock is 1962963200 bytes; re-reading block 0x0 using new block size ... validating checksum ... FAILED.
!! APFS ERROR !! Checksum of block 0x0 should validate, but it doesn't. Proceeding as if it does.
Details of block 0x0:
--------------------------------------------------------------------------------
Stored checksum: 0x030000003400003b
OID: 0x140000000000acc4
XID: 0x2e006d006f006300
Storage type: Physical
Type flags: No-header, Encrypted
Type: Unknown value (0x6100)
Subtype: Unknown value (0x7000)
Keybag location: first block 0xd01400000000, spans 21674672718409734 (0x4d01000000f006) blocks (last block 0x4dd1140000f005)
Media keybag location: none (spans 0 blocks)
Magic string:
Latest version of Apple APFS software that mounted this container: 37632.0.0.12.9
Block size: 1962963200 bytes
Block count: 7926441998712594688 (last block 0x6e006100720060ff)
Supported features:
- No flags.
Supported read-only compatible features:
- No flags.
Backward-incompatible features:
- No flags.
UUID: 30303832-3B36-3163-3961-6237333B7068
Next OID: 0x796c616e616f746f
Next XID: 0x3400003b64736973
Space manager Ephemeral OID: 0x1000000065006e00
Object map Physical OID: 0x0
Reaper Ephemeral OID: 0x323830301d000000
Other flags:
- No flags.
--------------------------------------------------------------------------------
!! APFS ERROR !! Block 0x0 should be a container superblock, but it isn't. Proceeding as if it is.
!! APFS ERROR !! Container superblock at 0x0 doesn't have the correct magic number. Proceeding as if it does.
Locating the checkpoint descriptor area:
- Its length is 50331648 blocks.
- It is contiguous.
- The address of its first block is 0x6f00630014000000.
Loading the checkpoint descriptor area into memory ... read_blocks: Reached end-of-file after reading 0 blocks.
ABORT: Failed to read all blocks in the checkpoint descriptor area.
Inplace recovery options?
This tool is exactly what I was looking for, however I'm curious why some in-place means of recovery are N/A. In my case I've got a drive which I used along with paragon apfs, obviously 3rd party apfs adapter blahh, blahhh..
Well so I have a peculiar situation, when I mount ext apfs drive with paragon apfs once on windows and plug it back into osx, drive works. As soon as I replug in osx, it fails with spaceman errors and zeroed-out block error. I'm like uber certain this issues could be fixed by simply resetting space manager or something or relinking blocks (I'm assuming failed writes at some point in the past), however I see that the only solution is decent knowledge of apfs and hex editor.... (esp funny when all validations in drat are OK)
Like I think it would be nice to be able to mod mappings, unless I'm crazy, but saving a snapshot (of few MBs) of block device should be enough for safety and that would be useful in the sense tht one wouldn't have to offload terrabytes of data Xd
How to change the Volume to /dev/disk7?
Hello,
maybe an stupid question... but what are correct steps to change the Volume?
My Volume name is: /dev/disk7
Thank you
No records found with OID 0x2.
Hello. I need help with recoverting filesystem that was broken due to some strange incident.
My brother had a laptop with significant uptime with installed macOS. At some point of time it freezed during normal work, then it was rebooted and it was not booting at all. I tried to boot it from live linux flash, it booted successfully.
In conclusion to this, the main problem was that partition table was clean. I tried to restore partiton table and it was successful. There was a partition with GRUB (working flawlessly) and partition with macOS. Then I tried to boot macOS partiton, Apple logo appeared on screen and it just rebooted. Then, it stopped booting (Apple logo for short time and then reboot).
Then I did backup of internal ssd to a file on external ssd in order to recover it some time later and reinstalled the OS on that laptop.
So, I tried using this utility to restore, but I couldn't do anything valuable. As I said, I have a backup (of whole disk), so I did a little patch to read_blocks and write_blocks functions in order to skip blocks till the actual APFS filesystem.
Output of sudo fdisk -lu /mnt/i/disk.img:
Disk /mnt/i/disk.img: 223.58 GiB, 240057409536 bytes, 468862128 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 80312927-28A9-8031-441F-3180EF1D3180
Device Start End Sectors Size Type
/mnt/i/disk.img1 2048 391167 389120 190M EFI System
/mnt/i/disk.img2 1050624 1460223 409600 200M EFI System
/mnt/i/disk.img3 2099200 280119295 278020096 132.6G unknown
Modified code (functions read_blocks/write_blocks):
if (fseek(nx, 2099200 * 512 + start_block * nx_block_size, SEEK_SET) == -1) {
Output of ./drat read /mnt/i/disk.img 0:
Opening file at `/mnt/i/disk.img` in read-only mode ... OK.
Reading block 0x0 ... validating ... OK.
Details of block 0x0:
--------------------------------------------------------------------------------
Stored checksum: 0xbe7e7ebf4157b036
OID: 0x1
XID: 0x2ee68d
Storage type: Ephemeral
Type flags: (none)
Type: Container superblock
Subtype: (invalid type / no subtype)
Keybag location: first block 0x15aeaeb, spans 1 (0x1) blocks (last block 0x15aeaeb)
Media keybag location: none (spans 0 blocks)
Magic string: NXSB
Latest version of Apple APFS software that mounted this container: 1284.305.552.845.64
Block size: 4096 bytes
Block count: 34752512 (last block 0x21247ff)
Supported features:
- No feature flags are set.
Supported read-only compatible features:
- No read-only compatible feature flags are set.
Backward-incompatible features:
- No backward-incompatible feature flags are set.
UUID: 0xe35aafc02f3cffbe244bde8093a8a0d5
Next OID: 0x3ab99d
Next XID: 0x2ee68e
Space manager Ephemeral OID: 0x1ba2b
Object map Physical OID: 0x81494
Reaper Ephemeral OID: 0x401
Other flags:
- No other flags are set.
--------------------------------------------------------------------------------
END: All done.
Output of ./drat inspect /mnt/i/disk.img:
Opening file at `/mnt/i/disk.img` in read-only mode ... OK.
Simulating a mount of the APFS container.
Validating checksum of block 0x0 ... OK.
Details of block 0x0:
--------------------------------------------------------------------------------
Stored checksum: 0xbe7e7ebf4157b036
OID: 0x1
XID: 0x2ee68d
Storage type: Ephemeral
Type flags: (none)
Type: Container superblock
Subtype: (invalid type / no subtype)
Keybag location: first block 0x15aeaeb, spans 1 (0x1) blocks (last block 0x15aeaeb)
Media keybag location: none (spans 0 blocks)
Magic string: NXSB
Latest version of Apple APFS software that mounted this container: 1284.305.552.845.64
Block size: 4096 bytes
Block count: 34752512 (last block 0x21247ff)
Supported features:
- No feature flags are set.
Supported read-only compatible features:
- No read-only compatible feature flags are set.
Backward-incompatible features:
- No backward-incompatible feature flags are set.
UUID: 0xe35aafc02f3cffbe244bde8093a8a0d5
Next OID: 0x3ab99d
Next XID: 0x2ee68e
Space manager Ephemeral OID: 0x1ba2b
Object map Physical OID: 0x81494
Reaper Ephemeral OID: 0x401
Other flags:
- No other flags are set.
--------------------------------------------------------------------------------
Locating the checkpoint descriptor area:
- Its length is 280 blocks.
- It is contiguous.
- The address of its first block is 0xeb6e.
Loading the checkpoint descriptor area into memory ... OK.
Locating the most recent well-formed container superblock in the checkpoint descriptor area:
- !! APFS ERROR !! Block at index 90 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 91 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 92 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 93 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 94 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 95 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 96 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 97 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 98 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 99 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 100 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 102 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 103 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 104 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 105 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 106 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 107 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 108 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 109 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 110 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 111 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 112 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 113 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 114 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 115 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 116 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 117 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 118 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 119 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 120 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 121 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 122 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 124 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 125 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 126 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 128 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 129 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 130 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 131 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 132 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 134 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 135 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 136 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 138 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 139 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 140 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 141 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 142 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 144 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 145 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 146 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 147 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 148 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 150 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 151 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 152 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 153 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 154 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 155 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 156 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 157 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 158 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 159 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 160 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 162 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 163 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 164 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 165 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 166 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 167 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 168 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 169 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 170 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 171 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 172 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 173 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 174 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 175 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 176 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 177 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 178 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 180 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 181 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 182 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 183 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 184 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 185 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 186 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 187 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 188 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 190 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 191 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 192 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 193 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 194 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 196 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 198 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 199 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 200 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 201 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 202 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 203 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 204 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 206 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 207 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 208 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 209 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 210 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 211 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 212 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 214 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 215 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 216 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 217 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 218 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 219 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 220 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 221 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 222 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 223 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 224 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 226 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 228 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 229 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 230 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 231 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 232 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 234 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 235 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 236 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 237 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 238 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 239 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 240 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 241 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 242 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 243 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 244 within this area is not a container superblock or checkpoint map. Skipping it.
- It lies at index 257 within the checkpoint descriptor area.
Details of this container superblock:
--------------------------------------------------------------------------------
Stored checksum: 0x1e15440ae1a21c55
OID: 0x1
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: Container superblock
Subtype: (invalid type / no subtype)
Keybag location: first block 0x15aeaeb, spans 1 (0x1) blocks (last block 0x15aeaeb)
Media keybag location: none (spans 0 blocks)
Magic string: NXSB
Latest version of Apple APFS software that mounted this container: 1284.305.552.845.64
Block size: 4096 bytes
Block count: 34752512 (last block 0x21247ff)
Supported features:
- No feature flags are set.
Supported read-only compatible features:
- No read-only compatible feature flags are set.
Backward-incompatible features:
- No backward-incompatible feature flags are set.
UUID: 0xe35aafc02f3cffbe244bde8093a8a0d5
Next OID: 0x3b2cb2
Next XID: 0x2f7231
Space manager Ephemeral OID: 0x1ba2b
Object map Physical OID: 0x86e8d
Reaper Ephemeral OID: 0x401
Other flags:
- No other flags are set.
--------------------------------------------------------------------------------
- The corresponding checkpoint starts at index 256 within the checkpoint descriptor area, and spans 2 blocks.
Loading the corresponding checkpoint ... OK.
Details of each block in this checkpoint:
--------------------------------------------------------------------------------
Stored checksum: 0x8f5a4fc4afd76291
OID: 0xec6e
XID: 0x2f7230
Storage type: Physical
Type flags: (none)
Type: Checkpoint map
Subtype: (invalid type / no subtype)
Flags:
- Last checkpoint-mapping block in the corresponding checkpoint.
Number of mappings: 7
--------------------------------------------------------------------------------
Stored checksum: 0x1e15440ae1a21c55
OID: 0x1
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: Container superblock
Subtype: (invalid type / no subtype)
Keybag location: first block 0x15aeaeb, spans 1 (0x1) blocks (last block 0x15aeaeb)
Media keybag location: none (spans 0 blocks)
Magic string: NXSB
Latest version of Apple APFS software that mounted this container: 1284.305.552.845.64
Block size: 4096 bytes
Block count: 34752512 (last block 0x21247ff)
Supported features:
- No feature flags are set.
Supported read-only compatible features:
- No read-only compatible feature flags are set.
Backward-incompatible features:
- No backward-incompatible feature flags are set.
UUID: 0xe35aafc02f3cffbe244bde8093a8a0d5
Next OID: 0x3b2cb2
Next XID: 0x2f7231
Space manager Ephemeral OID: 0x1ba2b
Object map Physical OID: 0x86e8d
Reaper Ephemeral OID: 0x401
Other flags:
- No other flags are set.
--------------------------------------------------------------------------------
Details of each checkpoint-mapping in this checkpoint:
--------------------------------------------------------------------------------
Ephemeral OID: 0x401
Logical block address on disk: 0xa357
Object type: Container reaper
Object subtype: (invalid type / no subtype)
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
Ephemeral OID: 0x405
Logical block address on disk: 0xa358
Object type: B-tree (root node)
Object subtype: Space manager free-space queue
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
Ephemeral OID: 0x1ba2b
Logical block address on disk: 0xa359
Object type: Space manager
Object subtype: (invalid type / no subtype)
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
Ephemeral OID: 0x1ba2c
Logical block address on disk: 0xa35a
Object type: B-tree (root node)
Object subtype: Space manager free-space queue
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
Ephemeral OID: 0x1f31ce
Logical block address on disk: 0xa35b
Object type: Container reaper list
Object subtype: (invalid type / no subtype)
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
Ephemeral OID: 0x3b2c4c
Logical block address on disk: 0xa35c
Object type: B-tree (non-root) node
Object subtype: Space manager free-space queue
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
Ephemeral OID: 0x3b2cb1
Logical block address on disk: 0xa35d
Object type: B-tree (non-root) node
Object subtype: Space manager free-space queue
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
- There are 7 checkpoint-mappings in this checkpoint.
Reading the Ephemeral objects used by this checkpoint ... OK.
Validating the Ephemeral objects ... OK.
Details of the Ephemeral objects:
--------------------------------------------------------------------------------
Stored checksum: 0x3592977509ff0787
OID: 0x401
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: Container reaper
Subtype: (invalid type / no subtype)
--------------------------------------------------------------------------------
Stored checksum: 0x31179a253b7fcee7
OID: 0x405
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: B-tree (root node)
Subtype: Space manager free-space queue
--------------------------------------------------------------------------------
Stored checksum: 0x5f3da7a8cf940dba
OID: 0x1ba2b
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: Space manager
Subtype: (invalid type / no subtype)
--------------------------------------------------------------------------------
Stored checksum: 0x9be909fb8afb5e3a
OID: 0x1ba2c
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: B-tree (root node)
Subtype: Space manager free-space queue
--------------------------------------------------------------------------------
Stored checksum: 0x04ba53adb11307c8
OID: 0x1f31ce
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: Container reaper list
Subtype: (invalid type / no subtype)
--------------------------------------------------------------------------------
Stored checksum: 0x3e0ec125e13eb47f
OID: 0x3b2c4c
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: B-tree (non-root) node
Subtype: Space manager free-space queue
--------------------------------------------------------------------------------
Stored checksum: 0x5abfeca701b91ca8
OID: 0x3b2cb1
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: B-tree (non-root) node
Subtype: Space manager free-space queue
--------------------------------------------------------------------------------
The container superblock states that the container object map has Physical OID 0x86e8d.
Loading the container object map ... OK.
Validating the container object map ... OK.
Details of the container object map:
--------------------------------------------------------------------------------
Stored checksum: 0x4009e914ffb5c77b
OID: 0x86e8d
XID: 0x2f7230
Storage type: Physical
Type flags: (none)
Type: Object map
Subtype: (invalid type / no subtype)
Flags:
- No snapshot support
Object mappings tree:
- Storage type: Physical
- Type flags: (none)
- Type: B-tree (root node)
- Object ID: 0x86ea2
Snapshots tree:
- Storage type: Physical
- Type flags: (none)
- Type: B-tree (root node)
- Object ID: 0x0
- Number of snapshots: 0 snapshots
- Latest snapshot XID: 0x0
In-progress revert:
- Minimum XID: 0x0
- Maximum XID: 0x0
--------------------------------------------------------------------------------
Reading the root node of the container object map B-tree ... OK.
Validating the root node of the container object map B-tree ... OK.
Details of the container object map B-tree:
--------------------------------------------------------------------------------
Stored checksum: 0x78aa74943537cdd9
OID: 0x86ea2
XID: 0x2f7230
Storage type: Physical
Type flags: (none)
Type: B-tree (root node)
Subtype: Object map
Flags: Root node, Leaf node, Fixed size for keys and values
Number of child levels: 0
Number of keys in this node: 5
Location of table of contents:
- Offset from start of node data area: 0x0 = 0
- Length (bytes): 0x1c0 = 448
Location of key�value shared free space:
- Offset from start of keys area: 0x60 = 96
- Length (bytes): 0xd20 = 3360
Info relating to the entire B-tree:
- Flags:
- This B-tree is currently undergoing a series of sequential inserts --- optimise operations if possible
- Child nodes are referred to using Physical OIDs
- Node size: 4096 bytes
- Key size: 16 bytes
- Value size: 16 bytes
- Length of longest key: 16 bytes
- Length of longest value: 16 bytes
- Number of keys: 5
- Number of nodes: 1
--------------------------------------------------------------------------------
The container superblock lists 5 APFS volumes, whose superblocks have the following Virtual OIDs:
- 0x402
- 0x408
- 0x40a
- 0x40c
- 0x44c
Reading the APFS volume superblocks ... OK.
Validating the APFS volume superblocks ... OK.
Details of these volume superblocks:
--------------------------------------------------------------------------------
Stored checksum: 0xb2f848ccc24d0259
OID: 0x402
XID: 0x2f722f
Storage type: Virtual
Type flags: (none)
Type: APFS volume
Subtype: (invalid type / no subtype)
Magic string: APSB
Index within container volume array: 0
Volume name: ### macOS - Data ###
Role: Data (contains mutable data)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
- This volume supports mounting a system and data volume as a single user-visible volume.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.
- At least one snapshot with no data exists for this volume.
Last unmount time: Sun Jan 17 18:33:00 2021
Last modification time: Tue Jan 26 16:57:40 2021
Reserved blocks: 0 blocks
Block quota: 0 blocks
Allocated blocks: 27423593 blocks
Volume object map Physical OID: 0x832be
Root tree info:
- OID: 0x404
- Storage type: Virtual
- Type flags: (none)
- Object type: B-tree (root node)
Extent-reference tree info:
- OID: 0x821fc
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
Snapshot metadata tree info:
- OID: 0xd5446
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
On next mount, revert to:
- snapshot with this XID: 0x0
- APFS volume superblock with this Physical OID: 0x0
Next file-system object ID that will be assigned: 0x1e9c7d2
Next document ID that will be assigned: 0x9c
Number of:
- regular files: 1031200
- directories: 175840
- symbolic links: 42650
- other file-system objects: 74
- snapshots: 0
- block allocations ever made: 781445649
- block liberations ever made: 754153816
UUID: 0xe81812b2d15ac9a3674004f9f781f183
--------------------------------------------------------------------------------
Stored checksum: 0xd29310dd1db977fc
OID: 0x408
XID: 0x2365cf
Storage type: Virtual
Type flags: (none)
Type: APFS volume
Subtype: (invalid type / no subtype)
Magic string: APSB
Index within container volume array: 1
Volume name: ### Preboot ###
Role: Preboot (contains files needed to boot from an encrypted volumes)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.
Last unmount time: Sat Jul 4 13:27:02 2020
Last modification time: Sat Jul 4 13:27:02 2020
Reserved blocks: 0 blocks
Block quota: 0 blocks
Allocated blocks: 20644 blocks
Volume object map Physical OID: 0xeafdd
Root tree info:
- OID: 0x409
- Storage type: Virtual
- Type flags: (none)
- Object type: B-tree (root node)
Extent-reference tree info:
- OID: 0xeafd6
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
Snapshot metadata tree info:
- OID: 0x3a9c6
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
On next mount, revert to:
- snapshot with this XID: 0x0
- APFS volume superblock with this Physical OID: 0x0
Next file-system object ID that will be assigned: 0x4e0
Next document ID that will be assigned: 0x3
Number of:
- regular files: 63
- directories: 19
- symbolic links: 0
- other file-system objects: 0
- snapshots: 0
- block allocations ever made: 791584
- block liberations ever made: 770957
UUID: 0xc3b904e6ab5bd0941c4e662e9248c197
--------------------------------------------------------------------------------
Stored checksum: 0x05266ee88c8ca6bb
OID: 0x40a
XID: 0x2ee6cc
Storage type: Virtual
Type flags: (none)
Type: APFS volume
Subtype: (invalid type / no subtype)
Magic string: APSB
Index within container volume array: 2
Volume name: ### Recovery ###
Role: Recovery (contains a recovery system)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.
Last unmount time: Sun Jan 17 18:36:22 2021
Last modification time: Sat Jul 4 10:20:15 2020
Reserved blocks: 0 blocks
Block quota: 0 blocks
Allocated blocks: 128924 blocks
Volume object map Physical OID: 0xd4182
Root tree info:
- OID: 0x40b
- Storage type: Virtual
- Type flags: (none)
- Object type: B-tree (root node)
Extent-reference tree info:
- OID: 0x86d2b
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
Snapshot metadata tree info:
- OID: 0x3a9cd
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
On next mount, revert to:
- snapshot with this XID: 0x0
- APFS volume superblock with this Physical OID: 0x0
Next file-system object ID that will be assigned: 0xb1
Next document ID that will be assigned: 0x3
Number of:
- regular files: 38
- directories: 5
- symbolic links: 0
- other file-system objects: 0
- snapshots: 0
- block allocations ever made: 515466
- block liberations ever made: 386552
UUID: 0xb185c57b0f2931b557477d8852a55bb9
--------------------------------------------------------------------------------
Stored checksum: 0x1a170217e4c43227
OID: 0x40c
XID: 0x2ee90d
Storage type: Virtual
Type flags: (none)
Type: APFS volume
Subtype: (invalid type / no subtype)
Magic string: APSB
Index within container volume array: 3
Volume name: ### VM ###
Role: Virtual memory (used as swap space for virtual memory)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.
Last unmount time: Sun Jan 17 18:32:58 2021
Last modification time: Mon Jan 18 19:46:30 2021
Reserved blocks: 0 blocks
Block quota: 0 blocks
Allocated blocks: 262436 blocks
Volume object map Physical OID: 0x8df33
Root tree info:
- OID: 0x40d
- Storage type: Virtual
- Type flags: (none)
- Object type: B-tree (root node)
Extent-reference tree info:
- OID: 0x8faa6
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
Snapshot metadata tree info:
- OID: 0x3a988
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
On next mount, revert to:
- snapshot with this XID: 0x0
- APFS volume superblock with this Physical OID: 0x0
Next file-system object ID that will be assigned: 0x2f7
Next document ID that will be assigned: 0x3
Number of:
- regular files: 2
- directories: 0
- symbolic links: 0
- other file-system objects: 0
- snapshots: 0
- block allocations ever made: 165937152
- block liberations ever made: 165674752
UUID: 0x396d64c8eb1ed2aa3c41348f9159efa3
--------------------------------------------------------------------------------
Stored checksum: 0x48aa47a9e2f13984
OID: 0x44c
XID: 0x2f7230
Storage type: Virtual
Type flags: (none)
Type: APFS volume
Subtype: (invalid type / no subtype)
Magic string: APSB
Index within container volume array: 4
Volume name: ### macOS ###
Role: System (contains a root directory for the system)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
- This volume supports mounting a system and data volume as a single user-visible volume.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.
- At least one snapshot with no data exists for this volume.
Last unmount time: Wed Apr 22 18:14:44 2020
Last modification time: Fri Jan 29 21:35:12 2021
Reserved blocks: 0 blocks
Block quota: 0 blocks
Allocated blocks: 2756218 blocks
Volume object map Physical OID: 0x819fd
Root tree info:
- OID: 0x44d
- Storage type: Virtual
- Type flags: (none)
- Object type: B-tree (root node)
Extent-reference tree info:
- OID: 0x8687f
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
Snapshot metadata tree info:
- OID: 0xd5384
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
On next mount, revert to:
- snapshot with this XID: 0x0
- APFS volume superblock with this Physical OID: 0x0
Next file-system object ID that will be assigned: 0xfffffff000affd2
Next document ID that will be assigned: 0x3
Number of:
- regular files: 372740
- directories: 108851
- symbolic links: 6524
- other file-system objects: 0
- snapshots: 0
- block allocations ever made: 5391813
- block liberations ever made: 2684437
UUID: 0x6b89045f599234a5e84df68c9592fc86
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Simulating a mount of volume 0 (macOS - Data).
The volume object map has Physical OID 0x832be.
Reading the volume object map ... OK.
Validating the volume object map ... OK.
Details of the volume object map:
--------------------------------------------------------------------------------
Stored checksum: 0x3e3d32620182f222
OID: 0x832be
XID: 0x2f722f
Storage type: Physical
Type flags: (none)
Type: Object map
Subtype: (invalid type / no subtype)
Flags:
- No flags are set.
Object mappings tree:
- Storage type: Physical
- Type flags: (none)
- Type: B-tree (root node)
- Object ID: 0x8367f
Snapshots tree:
- Storage type: Physical
- Type flags: (none)
- Type: B-tree (root node)
- Object ID: 0x0
- Number of snapshots: 0 snapshots
- Latest snapshot XID: 0x0
In-progress revert:
- Minimum XID: 0x0
- Maximum XID: 0x0
--------------------------------------------------------------------------------
Reading the root node of the volume object map B-tree ... OK.
Validating the root node of the volume object map B-tree ... OK.
Details of the volume object map B-tree:
--------------------------------------------------------------------------------
Stored checksum: 0x86f7c9abb59b2762
OID: 0x8367f
XID: 0x2f722f
Storage type: Physical
Type flags: (none)
Type: B-tree (root node)
Subtype: Object map
Flags: Root node, Fixed size for keys and values
Number of child levels: 2
Number of keys in this node: 18
Location of table of contents:
- Offset from start of node data area: 0x0 = 0
- Length (bytes): 0x240 = 576
Location of key�value shared free space:
- Offset from start of keys area: 0x3e0 = 992
- Length (bytes): 0x790 = 1936
Info relating to the entire B-tree:
- Flags:
- This B-tree is currently undergoing a series of sequential inserts --- optimise operations if possible
- Child nodes are referred to using Physical OIDs
- Node size: 4096 bytes
- Key size: 16 bytes
- Value size: 16 bytes
- Length of longest key: 16 bytes
- Length of longest value: 16 bytes
- Number of keys: 114773
- Number of nodes: 1580
--------------------------------------------------------------------------------
The file-system tree root for this volume has Virtual OID 0x404.
Looking up this Virtual OID in the volume object map ... corresponding block address is 0x846d2.
Reading ... validating ... OK.
Details of the file-system B-tree root node:
--------------------------------------------------------------------------------
Stored checksum: 0x6eef9918862ccec8
OID: 0x404
XID: 0x2f722f
Storage type: Virtual
Type flags: (none)
Type: B-tree (root node)
Subtype: File-system records tree
Flags: Root node
Number of child levels: 3
Number of keys in this node: 17
Location of table of contents:
- Offset from start of node data area: 0x0 = 0
- Length (bytes): 0xc0 = 192
Location of key�value shared free space:
- Offset from start of keys area: 0x68d = 1677
- Length (bytes): 0x783 = 1923
Info relating to the entire B-tree:
- Flags:
- This B-tree is currently undergoing a series of sequential inserts --- optimise operations if possible
- 8-byte alignment of keys and values is not required
- Node size: 4096 bytes
- Key size: 0 bytes
- Value size: 0 bytes
- Length of longest key: 208 bytes
- Length of longest value: 2973 bytes
- Number of keys: 4807374
- Number of nodes: 114772
--------------------------------------------------------------------------------
0xa64b2:
ABORT: get_fs_records: Checksum of node at block 0xd326c did not validate.
Also, I tried using search command and I found out that there are references to files in data partition - I can find some source files. What about other filesystems - they're easily readable, but there are no any useful data.
So, there's the following APFS volumes:
Volume list
================
0: macOS - Data
1: Preboot
2: Recovery
3: VM
4: macOS
Volumes 4 is readable:
Records for file-system object 0x2 -- `/` --
- INODE
- DIR REC || Dirctry || target ID = 0xfffffff0007e5a3 || name = EFI-Backups
- DIR REC || Dirctry || target ID = 0xfffffff0000001f || name = usr
- DIR REC || RegFile || target ID = 0xfffffff00005837 || name = .DS_Store
- DIR REC || Dirctry || target ID = 0xfffffff00005838 || name = bin
- DIR REC || Dirctry || target ID = 0xfffffff00005881 || name = sbin
- DIR REC || RegFile || target ID = 0xfffffff000058e7 || name = .file
- DIR REC || Symlink || target ID = 0xfffffff000058e8 || name = etc
- DIR REC || Symlink || target ID = 0xfffffff0007e4db || name = var
- DIR REC || Dirctry || target ID = 0xfffffff0007e4dc || name = Library
- DIR REC || Dirctry || target ID = 0xfffffff0007e54d || name = .Trashes
- DIR REC || Dirctry || target ID = 0xfffffff000058e9 || name = System
- DIR REC || Symlink || target ID = 0xfffffff0007e4de || name = .VolumeIcon.icns
- DIR REC || Dirctry || target ID = 0xfffffff00000010 || name = .fseventsd
- DIR REC || Dirctry || target ID = 0xfffffff0007e4dd || name = private
- DIR REC || Dirctry || target ID = 0xfffffff0007e4df || name = .vol
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e6 || name = Users
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e4 || name = Applications
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e0 || name = opt
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e1 || name = dev
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e2 || name = Volumes
- DIR REC || Symlink || target ID = 0xfffffff0007e4e3 || name = tmp
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e5 || name = cores
END: All done.
But Volume 0 is not (./drat list /mnt/i/disk.img 0 /):
The volume object map has Physical OID 0x832be.
Reading the volume object map ... OK.
Validating the volume object map ... OK.
Reading the root node of the volume object map B-tree ... OK.
Validating the root node of the volume object map B-tree ... OK.
The file-system tree root for this volume has Virtual OID 0x404.
Looking up this Virtual OID in the volume object map ... corresponding block address is 0x846d2.
Reading ... validating ... OK.
No records found with OID 0x2.
I can't do literally anything with this volume. FileVault wasn't enabled.
Also, I used command search with custom filters and I found that there's files with names like index.js and etc that were stored on this volume. Trying recover-raw does not give anything useful.
Any suggestions? Thank you.
Implement a MAC(B) timeline
Take inspiration from #25.
Build fails on Linux
For offline recovery, it might be helpful to have this tool available on Linux.
Currently the build fails due to printf format string issues as well as relying on some non-portable C functions.
I managed to hack it and get it to build successfully on Ubuntu 20.04 on a branch on my fork: https://github.com/KMayne/drat/tree/ubuntu-build
Re-check B-tree implementation
The following comment in <drat/func/btree.c> (line 318, bold emphasis mine) is false:
However, if this is the first entry in this node, we only
descend it if its key's stated OID matches the desired OID;
else it exceeds the desired OID, and thus no records with the
desired OID exist in the whole tree.
The implementation thus needs to be fixed (again...) For non-leaf nodes, consider scanning the nodes in reverse instead, from largest to smallest (OID, XID) pair, then descend the first entry we see whose (OID, XID) is less than the desired (OID, XID). Doing this should get us to the leaf node that contains the first record we're looking for.
Also consider using binary search on each node rather than linear search. Get it working with linear search first, though!
Use standard exit codes from <sysexits.h>
ERROR: get_file_size: No file size found.
I get the error message ERROR: get_file_size: No file size found. when I try to recover a directory.
$ sudo ./drat list --container /dev/disk2s2 --volume 1 --path /Nagoya\ 2021-.photoslibrary/database
Opening `/dev/disk2s2` in read-only mode ... OK.
Determining block size ... 4096 bytes.
Finding most recent container superblock:
- Reading block 0x0 ... validating ... OK.
- Loading checkpoint descriptor area ... OK.
- Searching checkpoint descriptor area ... found most recent container superblock at index 159, its XID is 0x4921b.
Finding container's omap tree:
- Container's omap has Physical OID 0x624395.
- Reading block 0x624395 ... validating ... OK.
- Container's omap tree has Physical OID 0x624484.
- Reading block 0x624484 ... validating ...OK.
Finding volume 1's superblock:
- Volume 1 has Virtual OID 0x402 ... maps to block 0x624353 with XID 0x4921b.
- Reading block 0x624353 ... validating ... OK.
- Volume name: G-DRIVE
Finding volume's omap tree:
- Volume's omap has Physical OID 0x5d6493.
- Reading block 0x5d6493 ... validating ... OK.
- Volume's omap tree has Physical OID 0x5d7962.
- Reading block 0x5d7962 ... validating ... OK.
Finding volume's filesystem tree:
- Filesystem tree has Virtual OID 0x404 ... maps to block 0x5df33f.
- Reading block 0x5df33f ... validating ... OK.
Navigating to path `/Nagoya 2021-.photoslibrary/database` ... its FSOID is 0x678e8c.
Finding records for FSOID 0x678e8c ... OK.
Filesystem object has 18 records, as follows:
- INODE
- XATTR || name = com.apple.metadata:com_apple_backup_excludeItem
- XATTR || name = com.apple.quarantine
- DIR REC || RegFile || target ID = 0x83e207 || name = Photos.sqlite.lock
- DIR REC || RegFile || target ID = 0x678e8e || name = Photos.sqlite
- DIR REC || RegFile || target ID = 0x678e99 || name = photos.db
- DIR REC || Dirctry || target ID = 0x678e9a || name = search
- DIR REC || RegFile || target ID = 0x83e20d || name = Photos.sqlite.aside-shm
- DIR REC || RegFile || target ID = 0x678ea4 || name = Photos.sqlite.aside-wal
- DIR REC || RegFile || target ID = 0x678ea5 || name = protection
- DIR REC || Dirctry || target ID = 0x83e210 || name = .Photos_SUPPORT
- DIR REC || RegFile || target ID = 0x678ea8 || name = Photos.sqlite-wal
- DIR REC || RegFile || target ID = 0x678ea9 || name = DataModelVersion.plist
- DIR REC || RegFile || target ID = 0x678eaa || name = Photos.sqlite-shm
- DIR REC || Dirctry || target ID = 0x83e20b || name = .Photos.sqlite_SUPPORT
- DIR REC || RegFile || target ID = 0x678ead || name = metaSchema.db
- DIR REC || RegFile || target ID = 0x83e209 || name = rebuildHistory
- DIR REC || RegFile || target ID = 0x678eaf || name = Photos.sqlite.aside
$ sudo ./drat recover --container /dev/disk2s2 --volume 1 --path /Nagoya\ 2021-.photoslibrary/database/ --output /Volumes/TOSHIBA\ 8\ TB/
Creating file `/Volumes/TOSHIBA 8 TB/_com.dratapp.recover_` ... OK.
Opening `/dev/disk2s2` in read-only mode ... OK.
Determining block size ... 4096 bytes.
Finding most recent container superblock:
- Reading block 0x0 ... validating ... OK.
- Loading checkpoint descriptor area ... OK.
- Searching checkpoint descriptor area ... found most recent container superblock at index 159, its XID is 0x4921b.
Finding container's omap tree:
- Container's omap has Physical OID 0x624395.
- Reading block 0x624395 ... validating ... OK.
- Container's omap tree has Physical OID 0x624484.
- Reading block 0x624484 ... validating ...OK.
Finding volume 1's superblock:
- Volume 1 has Virtual OID 0x402 ... maps to block 0x624353 with XID 0x4921b.
- Reading block 0x624353 ... validating ... OK.
- Volume name: G-DRIVE
Finding volume's omap tree:
- Volume's omap has Physical OID 0x5d6493.
- Reading block 0x5d6493 ... validating ... OK.
- Volume's omap tree has Physical OID 0x5d7962.
- Reading block 0x5d7962 ... validating ... OK.
Finding volume's filesystem tree:
- Filesystem tree has Virtual OID 0x404 ... maps to block 0x5df33f.
- Reading block 0x5df33f ... validating ... OK.
Navigating to path `/Nagoya 2021-.photoslibrary/database/` ... its FSOID is 0x678e8c.
Finding records for FSOID 0x678e8c ... OK.
Filesystem object has 18 records, as follows:
- INODE
- XATTR || name = com.apple.metadata:com_apple_backup_excludeItem
- XATTR || name = com.apple.quarantine
- DIR REC || RegFile || target ID = 0x83e207 || name = Photos.sqlite.lock
- DIR REC || RegFile || target ID = 0x678e8e || name = Photos.sqlite
- DIR REC || RegFile || target ID = 0x678e99 || name = photos.db
- DIR REC || Dirctry || target ID = 0x678e9a || name = search
- DIR REC || RegFile || target ID = 0x83e20d || name = Photos.sqlite.aside-shm
- DIR REC || RegFile || target ID = 0x678ea4 || name = Photos.sqlite.aside-wal
- DIR REC || RegFile || target ID = 0x678ea5 || name = protection
- DIR REC || Dirctry || target ID = 0x83e210 || name = .Photos_SUPPORT
- DIR REC || RegFile || target ID = 0x678ea8 || name = Photos.sqlite-wal
- DIR REC || RegFile || target ID = 0x678ea9 || name = DataModelVersion.plist
- DIR REC || RegFile || target ID = 0x678eaa || name = Photos.sqlite-shm
- DIR REC || Dirctry || target ID = 0x83e20b || name = .Photos.sqlite_SUPPORT
- DIR REC || RegFile || target ID = 0x678ead || name = metaSchema.db
- DIR REC || RegFile || target ID = 0x83e209 || name = rebuildHistory
- DIR REC || RegFile || target ID = 0x678eaf || name = Photos.sqlite.aside
ERROR: get_file_size: No file size found.
But it looks that single files located under the same directory can be recovered one by one.
$ sudo ./drat recover --container /dev/disk2s2 --volume 1 --path /Nagoya\ 2021-.photoslibrary/database/Photos.sqlite.lock --output /Volumes/TOSHIBA\ 8\ TB/
Creating file `/Volumes/TOSHIBA 8 TB/_com.dratapp.recover_Photos.sqlite.lock` ... OK.
Opening `/dev/disk2s2` in read-only mode ... OK.
Determining block size ... 4096 bytes.
Finding most recent container superblock:
- Reading block 0x0 ... validating ... OK.
- Loading checkpoint descriptor area ... OK.
- Searching checkpoint descriptor area ... found most recent container superblock at index 159, its XID is 0x4921b.
Finding container's omap tree:
- Container's omap has Physical OID 0x624395.
- Reading block 0x624395 ... validating ... OK.
- Container's omap tree has Physical OID 0x624484.
- Reading block 0x624484 ... validating ...OK.
Finding volume 1's superblock:
- Volume 1 has Virtual OID 0x402 ... maps to block 0x624353 with XID 0x4921b.
- Reading block 0x624353 ... validating ... OK.
- Volume name: G-DRIVE
Finding volume's omap tree:
- Volume's omap has Physical OID 0x5d6493.
- Reading block 0x5d6493 ... validating ... OK.
- Volume's omap tree has Physical OID 0x5d7962.
- Reading block 0x5d7962 ... validating ... OK.
Finding volume's filesystem tree:
- Filesystem tree has Virtual OID 0x404 ... maps to block 0x5df33f.
- Reading block 0x5df33f ... validating ... OK.
Navigating to path `/Nagoya 2021-.photoslibrary/database/Photos.sqlite.lock` ... its FSOID is 0x83e207.
Finding records for FSOID 0x83e207 ... OK.
Filesystem object has 4 records, as follows:
- INODE
- XATTR || name = com.apple.quarantine
- DSTREAM ID || file ID = 0x83e207 || ref. count = 1
- FILE EXTENT || file ID = 0x83e207 || log. addr. = 0 || length = 4096 B = 0x1000 B = 1 blocks = 0x1 blocks || phys. block = 0xf24513
How do I smartly recover a directory? I tried several different directories, but I always get the same error message.
Help wanted for an is_cksum_valid failure case
First of all, thank you very much for developing this helpful tool. This is only the solution from the open-source side for APFS disk failures.
Due to a sudden power cut off at my home, one of my APFS external HDDs was broken. It is not a physical failure but it looks that something in the partition information got corrupted.
After posting a question on AskDifferent
https://apple.stackexchange.com/questions/437386/apfs-partition-cannot-be-read
I found your software, which is able to recover files on my HDD. I have not tried recovering the whole ~5 TB data, but at least on of movie files was successfully recovered by the recover command.
The detail of my disk failure is described at the link above. In addition to the above information, I tried the inspect command and I got the following error.
$ sudo ./drat inspect --container /dev/disk2s2
(snip)
--------------------------------------------------------------------------------
Ephemeral OID: 0xc9b3c
Logical block address on disk: 0x1aad
Object type: B-tree (non-root) node
Object subtype: Space manager free-space queue
Object size: 4096 bytes
Associated volume OID (virtual): 0
--------------------------------------------------------------------------------
- There are 27 checkpoint-mappings in this checkpoint.
Reading the Ephemeral objects used by this checkpoint ... OK.
Validating the Ephemeral objects ... FAILED.
An Ephemeral object used by this checkpoint is malformed. Going back to look at the previous checkpoint instead.
END: Handling of this case has not yet been implemented.
It looks that this message is emitted in line 271 of src/commands/inspect.c and so the recorded checksum in my disk got corrupted due to the aforementioned power failure. The disk has 27 checkpoints and the above message is shown at the 27th one.
I commented out return 0; at line 278 in the same file to see if any other problems are reported. However, very fortunately, I did not see any other obvious issues in the output.
$ sudo ./drat inspect --container /dev/disk2s2 | grep OK
Opening `/dev/disk2s2` in read-only mode ... OK.
Reading block 0 ... validating ... OK.
Loading the checkpoint descriptor area into memory ... OK.
Loading the corresponding checkpoint ... OK.
Reading the Ephemeral objects used by this checkpoint ... OK.
OK.
Loading the container object map ... OK.
Validating the container object map ... OK.
Reading the root node of the container object map B-tree ... OK.
Validating the root node of the container object map B-tree ... OK.
Reading the APFS volume superblocks ... OK.
Validating the APFS volume superblocks ... OK.
Reading the volume object map ... OK.
Validating the volume object map ... OK.
Reading the root node of the volume object map B-tree ... OK.
Validating the root node of the volume object map B-tree ... OK.
Reading ... validating ... OK.
If my disk failure is simply caused by the broken checksum, I would like to somehow fix the checksum. Is there any easy way to do it by Drat or any other tool? I would like to mount the disk again to easily save my files (but I have backup of >99% files).
Please help! Unknown error when apfs-inspect
Hi,
My file system got damaged when I was trying to copy large trunk of files from the drive (apfs encrypted MacBook Pro ssd, I put it inside a third-party ssd-to-usb external case). When I was copying, suddenly it says the directory doesn’t exist, and soon I found out the folder I was copying disappeared.
I tried to do ls in terminal, but no result, it disappeared. Then that night, I downloaded disk drill. Disk drill shows the missing folder but after I recovered the files I found out 50% of the files are garbled, not opening. The other 50% is okay, but anything before November 2017 is non openable.
Then I ran across this GitHub page and I tried to use apfs-inspect and apfs-read, but no success. I think both of these returned ABORT unknown error. I don’t know what happened because the message offers little detail.
I mean these files are not something too important, but are memorable things that I kept during college. I really want to recover these data. The garbled portion is around 35GB. Please help me diagnose the issue. Is it possible to get more detail of why apfs-inspect failed?
Also just FYI, the recovered non-openable files are the same size as the good files. I also have very small portion of the garbled data on another drive (known to be good and can be opened), like 1GB out of the garbled 35GB. I compared the folders that are in common. for example, file A (from the other drive) is 35MB, and the garbled file A (what I recovered) is also 35MB. I compared the hex, the hex has nothing in common, totally garbled in the recovered file.
I was reading the drive on another Mac machine, High Sierra, and the ssd is connected thru ssd-usb3.0 external dongle. This MacBook ssd is extracted out of my MacBook, since it got damaged in a recent incident.
Please help me! I don’t know what caused the data damage, and I don’t understand why Disk Drill recovered some good files and some garbled files. Also, why the apfs-inspect and apfs-read didn’t work at all? I will provide screenshots if needed.
Let me know what I should do next.
Thanks, God bless you all
Recover file metadata (Icon file cannot be recovered)
The special Icon\r files on macOS cannot be recovered maybe due to its special file name. It ends with \r.
Can I recover this file by drat?
$ sudo ./drat recover --container /dev/disk2s2 --volume 1 --path /movie/Megane.dvdmedia/Icon --output /Volumes/TOSHIBA_8TB/movie/Megane.dvdmedia/
Creating file `/Volumes/TOSHIBA_8TB/movie/Megane.dvdmedia/_com.dratapp.recover_Icon` ... OK.
Opening `/dev/disk2s2` in read-only mode ... OK.
Determining block size ... 4096 bytes.
Finding most recent container superblock:
- Reading block 0x0 ... validating ... OK.
- Loading checkpoint descriptor area ... OK.
- Searching checkpoint descriptor area ... found most recent container superblock at index 159, its XID is 0x4921b.
Finding container's omap tree:
- Container's omap has Physical OID 0x624395.
- Reading block 0x624395 ... validating ... OK.
- Container's omap tree has Physical OID 0x624484.
- Reading block 0x624484 ... validating ...OK.
Finding volume 1's superblock:
- Volume 1 has Virtual OID 0x402 ... maps to block 0x624353 with XID 0x4921b.
- Reading block 0x624353 ... validating ... OK.
- Volume name: G-DRIVE
Finding volume's omap tree:
- Volume's omap has Physical OID 0x5d6493.
- Reading block 0x5d6493 ... validating ... OK.
- Volume's omap tree has Physical OID 0x5d7962.
- Reading block 0x5d7962 ... validating ... OK.
Finding volume's filesystem tree:
- Filesystem tree has Virtual OID 0x404 ... maps to block 0x5df33f.
- Reading block 0x5df33f ... validating ... OK.
Navigating to path `/movie/Megane.dvdmedia/Icon` ... END: No dentry found for path `/movie/Megane.dvdmedia/Icon`.
This recover command results in an empty file.
$ ls -l /Volumes/TOSHIBA_8TB/movie/Megane.dvdmedia/_com.dratapp.recover_Icon
-rw------- 1 oxon staff 0 Feb 24 23:37 /Volumes/TOSHIBA_8TB/movie/Megane.dvdmedia/_com.dratapp.recover_Icon
$ sudo ./drat list --container /dev/disk2s2 --volume 1 --path /movie/Megane.dvdmedia/
Opening `/dev/disk2s2` in read-only mode ... OK.
Determining block size ... 4096 bytes.
Finding most recent container superblock:
- Reading block 0x0 ... validating ... OK.
- Loading checkpoint descriptor area ... OK.
- Searching checkpoint descriptor area ... found most recent container superblock at index 159, its XID is 0x4921b.
Finding container's omap tree:
- Container's omap has Physical OID 0x624395.
- Reading block 0x624395 ... validating ... OK.
- Container's omap tree has Physical OID 0x624484.
- Reading block 0x624484 ... validating ...OK.
Finding volume 1's superblock:
- Volume 1 has Virtual OID 0x402 ... maps to block 0x624353 with XID 0x4921b.
- Reading block 0x624353 ... validating ... OK.
- Volume name: G-DRIVE
Finding volume's omap tree:
- Volume's omap has Physical OID 0x5d6493.
- Reading block 0x5d6493 ... validating ... OK.
- Volume's omap tree has Physical OID 0x5d7962.
- Reading block 0x5d7962 ... validating ... OK.
Finding volume's filesystem tree:
- Filesystem tree has Virtual OID 0x404 ... maps to block 0x5df33f.
- Reading block 0x5df33f ... validating ... OK.
Navigating to path `/movie/Megane.dvdmedia/` ... its FSOID is 0x18f3.
Finding records for FSOID 0x18f3 ... OK.
Filesystem object has 6 records, as follows:
- INODE
- XATTR || name = com.apple.FinderInfo
- XATTR || name = com.apple.lastuseddate#PS
- DIR REC || RegFile || target ID = 0x18f4 || name = .DS_Store
- DIR REC || RegFile || target ID = 0x18f5 || name = Icon
- DIR REC || Dirctry || target ID = 0x18f7 || name = VIDEO_TS
Create spec for `modify`
Release version 0.2.0
Release tasks tracked here: https://github.com/users/jivanpal/projects/3/views/1
Check compilation success on all platforms (macOS, Ubuntu, Debian) before providing binaries.
Write up changelog, provide binaries for both Intel macOS and Linux.
Update `explore-omap-tree` for v0.2
Homebrew packaging
Hi @jivanpal ! Your utility might be useful in a middle of APFS volume corruption.
Is there any plan to have that utility packaged into homebrew?
If not I can make a try but I need to have it revisionned and released. Would you consider adding a version number and tag it? So I can have the Homebrew's formula point to a stable release.
Implement `explore-fs`
Re-implement `inspect` as filesystem checker (fsck)
Change the inspect command so that it is a filesystem checker similar to, but more comprehensive than, Apple's fsck_apfs.
Add recursive recover/undelete
Handling of this case has not yet been implemented.
...
- There are 10 checkpoint-mappings in this checkpoint.
Reading the Ephemeral objects used by this checkpoint ... OK.
Validating the Ephemeral objects ... FAILED.
An Ephemeral object used by this checkpoint is malformed. Going back to look at the previous checkpoint instead.
END: Handling of this case has not yet been implemented.
Update documentation for `explore-*` commands
The currently spec'd interactive explore-* commands should be changed to non-interactive list* commands, and the interactive exploration functionality should instead be accessible via an --interactive option for each command. That is:
- Abandon
explore-fs, retainlist(renameexplore-fstolistin the docs) - Rename
explore-omap-treetolist-omap-tree - Rename
explore-fs-treetolist-fs-tree
Implementation of the --interactive functionality is deferred to this task: Add interactive modes to list commands
Update `read` for v0.2
error compiling for Apple M2
hi there
I followed your install instructions. Make seems to go well until I get this error:
OBJECTS +++ src/commands/inspect.c +++ out/src/commands/inspect.o
gcc -std=c99 -D _GNU_SOURCE -Werror -Wall -Wextra -Wno-incompatible-pointer-types -Wno-multichar -Wno-unused-variable -Wno-unused-parameter -Wno-missing-field-initializers -I./include -I/usr/local/Cellar/argp-standalone/1.3/include/ -c "src/commands/inspect.c" -o "out/src/commands/inspect.o"
src/commands/inspect.c:536:20: error: variable 'num_records' set but not used [-Werror,-Wunused-but-set-variable]
size_t num_records = 0;
^
1 error generated.
gmake: *** [Makefile:59: out/src/commands/inspect.o] Error 1
I'm at a loss, have no idea how to fix this.
May I ask for hlep?
many thanks and regards
Documentation is unsync with code
Hi!
I have cloned repo and find out that source code for version 1.x but documentation for 2.x
Tried to checkout branch and can't compile it
Any hints?
Segmentation fault in drat list
I got a segmentation fault in drat list for one of directories.
$ sudo ./drat list --container /dev/disk2s2 --volume 1 --path /Nagoya\ 2021-.photoslibrary/resources/derivatives
Opening `/dev/disk2s2` in read-only mode ... OK.
Determining block size ... 4096 bytes.
Finding most recent container superblock:
- Reading block 0x0 ... validating ... OK.
- Loading checkpoint descriptor area ... OK.
- Searching checkpoint descriptor area ... found most recent container superblock at index 159, its XID is 0x4921b.
Finding container's omap tree:
- Container's omap has Physical OID 0x624395.
- Reading block 0x624395 ... validating ... OK.
- Container's omap tree has Physical OID 0x624484.
- Reading block 0x624484 ... validating ...OK.
Finding volume 1's superblock:
- Volume 1 has Virtual OID 0x402 ... maps to block 0x624353 with XID 0x4921b.
- Reading block 0x624353 ... validating ... OK.
- Volume name: G-DRIVE
Finding volume's omap tree:
- Volume's omap has Physical OID 0x5d6493.
- Reading block 0x5d6493 ... validating ... OK.
- Volume's omap tree has Physical OID 0x5d7962.
- Reading block 0x5d7962 ... validating ... OK.
Finding volume's filesystem tree:
- Filesystem tree has Virtual OID 0x404 ... maps to block 0x5df33f.
- Reading block 0x5df33f ... validating ... OK.
Navigating to path `/Nagoya 2021-.photoslibrary/resources/derivatives` ... its FSOID is 0x6793a5.
Finding records for FSOID 0x6793a5 ... OK.
zsh: segmentation fault sudo ./drat list --container /dev/disk2s2 --volume 1 --path
Here is the output of the parent directory.
$ sudo ./drat list --container /dev/disk2s2 --volume 1 --path /Nagoya\ 2021-.photoslibrary/resources/
Opening `/dev/disk2s2` in read-only mode ... OK.
Determining block size ... 4096 bytes.
Finding most recent container superblock:
- Reading block 0x0 ... validating ... OK.
- Loading checkpoint descriptor area ... OK.
- Searching checkpoint descriptor area ... found most recent container superblock at index 159, its XID is 0x4921b.
Finding container's omap tree:
- Container's omap has Physical OID 0x624395.
- Reading block 0x624395 ... validating ... OK.
- Container's omap tree has Physical OID 0x624484.
- Reading block 0x624484 ... validating ...OK.
Finding volume 1's superblock:
- Volume 1 has Virtual OID 0x402 ... maps to block 0x624353 with XID 0x4921b.
- Reading block 0x624353 ... validating ... OK.
- Volume name: G-DRIVE
Finding volume's omap tree:
- Volume's omap has Physical OID 0x5d6493.
- Reading block 0x5d6493 ... validating ... OK.
- Volume's omap tree has Physical OID 0x5d7962.
- Reading block 0x5d7962 ... validating ... OK.
Finding volume's filesystem tree:
- Filesystem tree has Virtual OID 0x404 ... maps to block 0x5df33f.
- Reading block 0x5df33f ... validating ... OK.
Navigating to path `/Nagoya 2021-.photoslibrary/resources/` ... its FSOID is 0x678eb0.
Finding records for FSOID 0x678eb0 ... OK.
Filesystem object has 8 records, as follows:
- INODE
- XATTR || name = com.apple.quarantine
- DIR REC || Dirctry || target ID = 0x678eb1 || name = renders
- DIR REC || Dirctry || target ID = 0x6793a5 || name = derivatives
- DIR REC || Dirctry || target ID = 0x67cedf || name = streams
- DIR REC || Dirctry || target ID = 0x67cee0 || name = journals
- DIR REC || Dirctry || target ID = 0x67cf02 || name = cpl
- DIR REC || Dirctry || target ID = 0x67cf0f || name = caches
Please let me know if I can check anything more.
Update `explore-fs-tree` for v0.2
Implement `create-index`
Proper error handling; don't use `exit()`, cascade errors with `errno`
How to recover entire directory of files
First off, what a great tool 🙇 Thanks for building this! I'm trying to recover a set of files from a dead external drive. I was already able to use it to recover the most important files individually. 🎉
Currently I'm using the latest released version drat-0.1.3. With it I'm able to recover single files, but not directories of files. The documentation seems to direct me to use --output for this, but 0.1.3 doesn't seem to support this yet.
What I've tried so far:
drat-0.1.3-darwin-amd64 list /dev/disk3 0 /path_to_the_directory/shows the files in the directorydrat-0.1.3-darwin-amd64 recover /dev/disk3 0 /path_to_the_directory/a_file >> /recovery/a_filecorrectly copies the file's contents into the new filedrat-0.1.3-darwin-amd64 recover /dev/disk3 0 /path_to_the_directory >> /recovery_dir/prints the same list of files as above, but ends with[1] 79239 segmentation fault drat-0.1.3-darwin-amd64 recover /dev/disk3 0
I thought about grepping the output of list to find the specific filenames to recover them iteratively in a script, but the output cannot be piped.
Any help would be appreciated.
Functions Do Not Match with Documentation
Thank you for your tool.
My APFS disk failed when I tried to make a backup for it and Google led me here.
I tried the Drat 0.1.3 release on a Ubuntu 22 PC and it looks quite different with what the document described. For example, the argument --container is not supported in the binary I downloaded. However, in the source code, the argument --container appears in print_usage()!
Another thing is, when I tried to recover a directory or a file, I could not specified where the files to be saved.
Should I use the pre-built binary or compile one myself?
Add support for header-less and hashed B-trees
See APFS specification for details on btree_index_node_val_t, BTREE_HASHED, and BTREE_NOHEADER.
Implement `search`
No container superblock with an XID that doesn't exceed 0xffffffffffffffff
Hi,
I am trying to recover a partition from a drive /dev/disk8. The partition is at /dev/disk9s3 but when I run
drat recover /dev/disk9s3 0 ~/recovered_stuff
I get:
Opening file at `/dev/disk9s3` in read-only mode ... OK.
Simulating a mount of the APFS container.
FAILED: read_blocks: An unknown error occurred whilst reading from the stream.
ABORT: Failed to successfully read block 0x0.
When I do
drat inspect /dev/disk9s3
I get ABORT:
Simulating a mount of the APFS container.
Reading container superblock at address 0x0, assuming default block size of 4096 bytes ... FAILED: read_blocks: An unknown error occurred whilst reading from the stream.
ABORT: Failed to successfully read block 0x0.
(BTW the online documentation is not up to date, as the command syntax is different)
So then I go directly for the entire drive /dev/disk8:
drat recover /dev/disk8 2 ~/recovered_stuff
And I get this:
Opening file at `/dev/disk8` in read-only mode ... OK.
Simulating a mount of the APFS container.
Validating checksum of block 0x0 ... FAILED.
!! APFS ERROR !! Checksum of block 0x0 should validate, but it doesn't. Proceeding as if it does.
OK.
ABORT: Block 0x0 isn't a container superblock.
!! APFS ERROR !! Container superblock at 0x0 doesn't have the correct magic number. Proceeding as if it does.
Locating the checkpoint descriptor area:
- Its length is 0 blocks.
- It is contiguous.
- The address of its first block is 0x0.
Loading the checkpoint descriptor area into memory ... OK.
Locating the most recent well-formed container superblock in the checkpoint descriptor area:
No container superblock with an XID that doesn't exceed 0xffffffffffffffff exists in the checkpoint descriptor area.
Is there no hope for me? Or is there something with the software?
I should also add that I am really after a specific folder on the drive, but I don't remember its path and explore-fs-tree asks for block addresses. Is there a way to provide block addresses to display everything on the partition for me to figure out the path to recover a specific folder? Or does the above error suggest that it's impossible to even view the contents of the drive?
Thanks!
Add xattr support
No container superblock with an XID that doesn't exceed 0xffffffffffffffff exists in the checkpoint descriptor area.
Hi, I'm wondering if you could provide some guidance on restoring mounting ability to an external drive that is currently formatted as apfs (I won't make that mistake again).
I successfully built your tools on an M1 MacBook Pro (incase you were wondering about compatibility) but am now running into an error I think has to do with the B-tree node since this is the output from fsck_apfs:
sudo fsck_apfs -y /dev/disk4s1
(base) luke@My-MacBook-Pro ~ % sudo fsck_apfs -y /dev/disk4s1
Password:
** Checking the container superblock.
** Checking the EFI jumpstart record.
** Checking the space manager.
** Checking the space manager free queue trees.
warning: Unable to read apfs keylocker ranges: No such process
** Checking the object map.
** Checking volume.
** Checking the APFS volume superblock.
** The volume Torch was formatted by hfs_convert (748.57.19) and last modified by apfs_kext (1677.60.23).
** Checking the object map.
error: btn: invalid key order (163) oid 4209151 / oxid 0 / level 1 / flags 0x5
previous key: 0d 3a 00 00 00 00 00 00 70 8b 00 00 00 00 00 00
current key: 1d 04 00 00 00 00 00 00 2f 07 00 00 00 00 00 00
next key: ef 3a 00 00 00 00 00 00 41 8a 00 00 00 00 00 00
Object map is invalid.
** The volume /dev/disk4s1 could not be verified completely.
Here is the output from sudo ./apfs-inspect /dev/disk4s1
Opening file at `/dev/disk4s1` in read-only mode ... OK.
Simulating a mount of the APFS container.
Validating checksum of block 0x0 ... FAILED.
!! APFS ERROR !! Checksum of block 0x0 should validate, but it doesn't. Proceeding as if it does.
Details of block 0x0:
--------------------------------------------------------------------------------
Stored checksum: 0x006513adb556683c
OID: 0x1
XID: 0x8c27
Storage type: Ephemeral
Type flags: (none)
Type: Container superblock
Subtype: (none/invalid)
Keybag location: starts at 0x811d89, spans 0x1 blocks
Magic string: NXSB
Block size: 8192 bytes
Block count: 488331131
Supported features:
- No feature flags are set.
Supported read-only compatible features:
- No read-only compatible feature flags are set.
Backward-incompatible features:
- No backward-incompatible feature flags are set.
UUID: 0x7238fcd169ed3aa82049687876943b5f
Next OID: 0x3b7d
Next XID: 0x8c28
Space manager Ephemeral OID: 0x400
Object map Physical OID: 0x403a25
Reaper Ephemeral OID: 0x401
Other flags:
- No other flags are set.
--------------------------------------------------------------------------------
Locating the checkpoint descriptor area:
- Its length is 136 blocks.
- It is contiguous.
- The address of its first block is 0x1661e.
Loading the checkpoint descriptor area into memory ... OK.
Locating the most recent well-formed container superblock in the checkpoint descriptor area:
- !! APFS WARNING !! Block at index 0 within this area failed checksum validation. Skipping it.
[OMITTED: SAME LINE AS ABOVE AND BELOW FROM 0-135 WITH JUST THE NUMBER CHANGING]
- !! APFS WARNING !! Block at index 135 within this area failed checksum validation. Skipping it.
No container superblock with an XID that doesn't exceed 0xffffffffffffffff exists in the checkpoint descriptor area.
Also if it's helpful...
Here is the output of `diskutil apfs list`:
(base) luke@My-MacBook-Pro ~ % diskutil apfs list
APFS Containers (4 found)
|
+-- Container disk3 7BBFE2B4-A53F-40DA-9A23-B7F93F023391
| ====================================================
| APFS Container Reference: disk3
| Size (Capacity Ceiling): 994662584320 B (994.7 GB)
| Capacity In Use By Volumes: 133843386368 B (133.8 GB) (13.5% used)
| Capacity Not Allocated: 860819197952 B (860.8 GB) (86.5% free)
| |
| +-< Physical Store disk0s2 FFE7F386-3F12-4521-A960-CD58EE0D38F9
| | -----------------------------------------------------------
| | APFS Physical Store Disk: disk0s2
| | Size: 994662584320 B (994.7 GB)
| |
| +-> Volume disk3s1 A473740A-7503-4953-BBAC-DF597AA612B6
| | ---------------------------------------------------
| | APFS Volume Disk (Role): disk3s1 (System)
| | Name: Macintosh HD (Case-insensitive)
| | Mount Point: Not Mounted
| | Capacity Consumed: 15053828096 B (15.1 GB)
| | Sealed: Broken
| | FileVault: No (Encrypted at rest)
| | |
| | Snapshot: 2FA71488-D63A-403D-9650-DDA3923EA697
| | Snapshot Disk: disk3s1s1
| | Snapshot Mount Point: /
| | Snapshot Sealed: Yes
| |
| +-> Volume disk3s2 DA6B5982-740B-4BD8-8D6F-ABBA714CE061
| | ---------------------------------------------------
| | APFS Volume Disk (Role): disk3s2 (Preboot)
| | Name: Preboot (Case-insensitive)
| | Mount Point: /System/Volumes/Preboot
| | Capacity Consumed: 305635328 B (305.6 MB)
| | Sealed: No
| | FileVault: No
| |
| +-> Volume disk3s3 63144F31-6220-41D2-A929-A7F4F5993914
| | ---------------------------------------------------
| | APFS Volume Disk (Role): disk3s3 (Recovery)
| | Name: Recovery (Case-insensitive)
| | Mount Point: Not Mounted
| | Capacity Consumed: 1072377856 B (1.1 GB)
| | Sealed: No
| | FileVault: No
| |
| +-> Volume disk3s5 6956C502-FC9F-47A4-B673-05D2D93913B4
| | ---------------------------------------------------
| | APFS Volume Disk (Role): disk3s5 (Data)
| | Name: Data (Case-insensitive)
| | Mount Point: /System/Volumes/Data
| | Capacity Consumed: 117204049920 B (117.2 GB)
| | Sealed: No
| | FileVault: No (Encrypted at rest)
| |
| +-> Volume disk3s6 EB20ECBE-DE85-48F5-B8C3-60A12C07D5ED
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s6 (VM)
| Name: VM (Case-insensitive)
| Mount Point: /System/Volumes/VM
| Capacity Consumed: 20480 B (20.5 KB)
| Sealed: No
| FileVault: No
|
+-- Container ERROR -69808
======================
APFS Container Reference: disk5
Size (Capacity Ceiling): ERROR -69620
Capacity In Use By Volumes: ERROR -69620
Capacity Not Allocated: ERROR -69620
|
+-< Physical Store disk4s1 7CC5E36F-BD03-48D6-835F-963FD194BB6C
| -----------------------------------------------------------
| APFS Physical Store Disk: disk4s1
| Size: 4000408625152 B (4.0 TB)
|
+-> No Volumes
Here is the output of `diskutil apfs list`:
(base) luke@My-MacBook-Pro ~ % diskutil list
/dev/disk0 (internal):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme 1.0 TB disk0
1: Apple_APFS_ISC 524.3 MB disk0s1
2: Apple_APFS Container disk3 994.7 GB disk0s2
3: Apple_APFS_Recovery 5.4 GB disk0s3
/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +994.7 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 15.1 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 15.1 GB disk3s1s1
3: APFS Volume Preboot 305.6 MB disk3s2
4: APFS Volume Recovery 1.1 GB disk3s3
5: APFS Volume Data 117.2 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk4
1: Apple_APFS Container disk5 4.0 TB disk4s1
/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +ERROR disk5
Physical Store disk4s1
If you could even point me in the direction of some documentation that might let show me how to manually edit the B Tree to match what is expected that would be great. Thanks in advance!
how can i recover a directory
sorry i am foolish, i have read doc:
- https://apple.stackexchange.com/questions/373718/how-to-recover-apparently-missing-directory-and-data-from-apfs-volume-found-ze
- https://forums.macrumors.com/threads/apfs-system-volume-recovery-after-macbook-air-logic-board-failure.2193705/page-2
but i can understand how can i recover : - disk: /dev/disk3
- directory: /backup/
thank you for any reply
error: "S_IFMT" redefined [-Werror]
Attempting to build on ubuntuy 20.04, get errors from include/apfs/jconst.c about macros on lines 176-184 being redfined (previous definition /usr/include/fcntl.h).
gcc (Ubuntu 9.4.0-1ubuntu1-20.04.1) 9.4.0, Gnu Make 4.2.1, ldd (Ubuntu GLIBC 2.31-0ubuntu9.9) 2.31
I was able to make it build by commenting out the offending lines 176-184 from jconst.c and adding a #include of <fcntl.h> in include/drat/string/j.c , but I suspect this is a workaround as opposed to a fix (did not delve into it any further after it built).
Sample output from make:
OBJECTS +++ src/commands/recover.c +++ out/src/commands/recover.o
gcc -std=c99 -D _GNU_SOURCE -Werror -Wall -Wextra -Wno-incompatible-pointer-types -Wno-multichar -Wno-unused-variable -Wno-unused-parameter -Wno-missing-field-initializers -I./include -c "src/commands/recover.c" -o "out/src/commands/recover.o"
In file included from ./include/apfs/j.h:10,
from ./include/apfs/crypto.h:12,
from ./include/apfs/fs.h:10,
from src/commands/recover.c:13:
./include/apfs/jconst.h:176: error: "S_IFMT" redefined [-Werror]
176 | #define S_IFMT 0170000
|
In file included from src/commands/recover.c:8:
/usr/include/fcntl.h:80: note: this is the location of the previous definition
80 | # define S_IFMT __S_IFMT
|
Add tests
Add tests for all functions, e.g.:
- string mappings, e.g.
get_apfs_role_string(). - complex routines like B-tree operations
I'm getting this on inspect:
Reading the Ephemeral objects used by this checkpoint ... OK. Validating the Ephemeral objects ... FAILED. An Ephemeral object used by this checkpoint is malformed. Going back to look at the previous checkpoint instead. END: Handling of this case has not yet been implemented. $
Would there be a chance that you can handle this case?
'SF_DATALESS' undeclared
Compiler: GCC 9.2.0_2 (homebrew.)
When compiling apfs-inspect gcc throws the following error:
In file included from src/apfs/func/btree.h:16,
from src/apfs-inspect.c:10:
src/apfs/func/../string/j.h: In function 'get_j_inode_bsd_flags_string':
src/apfs/func/../string/j.h:191:9: error: 'SF_DATALESS' undeclared (first use in this function)
191 | SF_DATALESS,
| ^~~~~~~~~~~
src/apfs/func/../string/j.h:191:9: note: each undeclared identifier is reported only once for each function it appears in
make: *** [obj/apfs-inspect.o] Error 1
Don't really know what else to add here.
Feature not implemented
I destroyed my Fotos library volume while backing it. So I destroyed both. my backup and my original.
Anyway, I found your toolset while trying to fix it. Thank you for your great work so far.
The program ends with the message:
"END: The ability to handle this case has not yet been implemented."
So I wanted to ask if there is any plan to implement this feature-
best regards and merry Christmas
Add encryption support
Looking for a way to determine the actual file size
Hi,
I have come across the project while trying to recover my partly corrupted APFS storage. I managed to list all the files via apfs-list. It works like a charm. Moreover, apfs-recover provides me the content part. Yet I have not managed to find the right way to determine the actual file size. All blocks are multiple of 4096 and I see no other information. I have no idea what to do with binary files as some file formats can be unable to open.
According to Apple File System Reference, j_file_extent_val_t is specified to be multiple of the block size.
Is there a way to determine the actual files size. If not, how does stdio::fread know when it should return zero if no more bytes available? There must be some information about the total size of the file, otherwise the standard FS API would be inconvenient.
Thank you,
Does apfs Object Maps B-tree has internal copies (or old versions)?
bash-3.2# fsck_apfs /dev/disk3s1
** Checking the container superblock.
Checking the checkpoint with transaction ID 3938710.
** Checking the EFI jumpstart record.
** Checking the space manager.
** Checking the space manager free queue trees.
** Checking the object map.
** Checking the encryption key structures.
** Checking volume /dev/rdisk3s1.
** Checking the APFS volume superblock.
The volume OSX1015 - Data was formatted by newfs_apfs (748.77.11) and last modified by apfs_kext (1933.80.3).
** Checking the object map.
error: (oid 0x375ac2) om: btn: invalid o_type (0x4000000b, expected 0x40000003)
error: (oid 0x375ac2) om: btn: invalid o_subtype (0x0, expected 0xb)
Object map is invalid.
** The volume /dev/disk3s1 could not be verified completely.
I examined (oid 0x375ac2), it seems that node get wiped.
this node corresponded to /Users, therefore most important data is there.
a4 3e 58 73 98 16 e7 c2 5a 37 00 00 00 00 00 dd 0d 3c 00 00 00 00 00 0b 00 00 40 00 00 00 00 : �>Xs���Z7�
00 00 00 00 00 00 00 00 02 00 00 40 02 00 00 40 c3 5a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 : @@�Z7
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :
Is there another (or older) copy in APFS that I can recover from?
It seems odd that APFS only have 1 copy of ObjectMap?
get_fs_records behaviour when loop reaches btn_nkeys
So I've been looking why a certain recent folder can't be listed by apfs-list and worked back to what I believe the issue is.
In the get_fs_records function there is a loop titled "Determine which entry in this node we should descend":
for (desc_path[i] = 0; desc_path[i] < node->btn_nkeys; desc_path[i]++, toc_entry++)
For my oid it reaches the end of the loop and desc_path[i] == node->btn_nkeys... so it exits the loop. However the toc_entry->v.off == 0... which doesn't reference a valid index for child_node_virt_oid... right? maybe?
I printf'd out the oid vs record_oid as it goes through the loop:
path 'Dunkirk (2017) 5.1 Dual Áudio 4K UtraHD By-LuanHarper' = 3307851
get_fs_records:301 - [0] record_oid=1 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=181686 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=364079 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=388618 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=556537 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=691924 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=787838 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=893180 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=899653 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=1037106 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=1058869 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=1189538 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=1388293 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=1534138 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=1682289 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=1832542 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=1954405 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=1966472 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=2114638 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=2213200 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=2337265 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=2528369 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=2674253 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=2846735 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=3062975 oid=3307851 node->btn_nkeys=26
get_fs_records:301 - [0] record_oid=3222652 oid=3307851 node->btn_nkeys=26
get_fs_records:358 - *child_node_virt_oid=17592186044482 toc_entry->v.off=0
get_btree_phys_omap_val:50 - oid=17592186044482
It almost gets up the value it's searching for but then runs out of entries. So in my limited knowledge of b-trees, maybe the value it's looking for is in the children of the last element? And it should descend down there to find it? Maybe?
Seems like an unhandled edge case. Or I could be barking up the wrong [b]tree here. Haha. Maybe you could have a brief look at the code and see if there is something missing?
Reading block 0x0 ... FAILED:
Hi, My APFS container fails to mount and running first aid gives the following output.
Repairing storage system
Performing fsck_apfs -y -x /dev/disk0s2
Checking the container superblock.
Checking the space manager.
Checking the space manager free queue trees.
Checking the object map.
Checking volume.
Checking the APFS volume superblock.
Checking the object map.
error: btn: invalid key order (0) oid 2661014 / oxid 0 / level 1 / flags 0x4
previous key: 2c 60 03 00 00 00 00 00 83 ac 00 00 00 00 00 00
current key: 04 04 00 00 00 00 00 00 c1 b4 00 00 00 00 00 00
next key: 4f 04 00 00 00 00 00 00 66 00 00 00 00 00 00 00
Object map is invalid.
The volume /dev/disk0s2 could not be verified completely.
Storage system check exit code is 8.
Storage system verify or repair failed. : (-69716)
Operation failed…
When i run drat inspect /dev/disk5s1 i get the following output
drat-0.1.3 % sudo ./drat inspect /dev/disk5s1
Opening file at `/dev/disk5s1` in read-only mode ... OK.
Simulating a mount of the APFS container.
Reading container superblock at address 0x0, assuming default block size of 4096 bytes ... FAILED: read_blocks: An unknown error occurred whilst reading from the stream.
ABORT: Failed to successfully read block 0x0.
Output of diskutil list and diskutil apfs list is attached below
drat-0.1.3 % diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *1.0 TB disk0
1: EFI EFI 209.7 MB disk0s1
2: Apple_APFS Container disk5 1000.0 GB disk0s2
/dev/disk1 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *500.1 GB disk1
1: EFI EFI 209.7 MB disk1s1
2: Apple_APFS Container disk3 499.9 GB disk1s2
/dev/disk2 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: FDisk_partition_scheme *120.0 GB disk2
1: Apple_HFS vbox 120.0 GB disk2s1
/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +499.9 GB disk3
Physical Store disk1s2
1: APFS Volume Home - Data 168.7 GB disk3s1
2: APFS Volume Home 15.3 GB disk3s2
3: APFS Snapshot com.apple.os.update-... 15.3 GB disk3s2s1
4: APFS Volume Preboot 508.1 MB disk3s3
5: APFS Volume Recovery 625.7 MB disk3s4
6: APFS Volume VM 2.1 GB disk3s5
/dev/disk4 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: FDisk_partition_scheme *500.1 GB disk4
1: Apple_HFS Media 500.1 GB disk4s1
/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +1000.0 GB disk5
Physical Store disk0s2
1: APFS Volume Other 349.9 GB disk5s1
drat-0.1.3 % diskutil apfs list
APFS Containers (2 found)
|
+-- Container disk3 441E001F-0596-4B99-A975-332968F2DC9A
| ====================================================
| APFS Container Reference: disk3
| Size (Capacity Ceiling): 499898105856 B (499.9 GB)
| Capacity In Use By Volumes: 187464822784 B (187.5 GB) (37.5% used)
| Capacity Not Allocated: 312433283072 B (312.4 GB) (62.5% free)
| |
| +-< Physical Store disk1s2 65A0CD99-7EF7-460B-A485-26D09C2FAFEA
| | -----------------------------------------------------------
| | APFS Physical Store Disk: disk1s2
| | Size: 499898105856 B (499.9 GB)
| |
| +-> Volume disk3s1 97094914-0638-41CD-9FF7-C3F187D061E3
| | ---------------------------------------------------
| | APFS Volume Disk (Role): disk3s1 (Data)
| | Name: Home - Data (Case-insensitive)
| | Mount Point: /System/Volumes/Data
| | Capacity Consumed: 168678100992 B (168.7 GB)
| | Sealed: No
| | FileVault: No
| |
| +-> Volume disk3s2 2104C312-125B-4F9E-9E5C-FEE8A948FD5D
| | ---------------------------------------------------
| | APFS Volume Disk (Role): disk3s2 (System)
| | Name: Home (Case-insensitive)
| | Mount Point: Not Mounted
| | Capacity Consumed: 15333896192 B (15.3 GB)
| | Sealed: Broken
| | FileVault: No
| | |
| | Snapshot: 7BD98F2F-6B3A-46DA-A4D2-348E84D51D9F
| | Snapshot Disk: disk3s2s1
| | Snapshot Mount Point: /
| | Snapshot Sealed: Yes
| |
| +-> Volume disk3s3 B2CFE273-1658-46D6-9BE6-58B24F1FD3A8
| | ---------------------------------------------------
| | APFS Volume Disk (Role): disk3s3 (Preboot)
| | Name: Preboot (Case-insensitive)
| | Mount Point: /System/Volumes/Preboot
| | Capacity Consumed: 508104704 B (508.1 MB)
| | Sealed: No
| | FileVault: No
| |
| +-> Volume disk3s4 36074125-4395-4A85-AB17-B26529B4DFB7
| | ---------------------------------------------------
| | APFS Volume Disk (Role): disk3s4 (Recovery)
| | Name: Recovery (Case-insensitive)
| | Mount Point: Not Mounted
| | Capacity Consumed: 625659904 B (625.7 MB)
| | Sealed: No
| | FileVault: No
| |
| +-> Volume disk3s5 6EBCA5C6-0B82-49C8-8325-260F9034CEDA
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (VM)
| Name: VM (Case-insensitive)
| Mount Point: /System/Volumes/VM
| Capacity Consumed: 2148552704 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-- Container disk5 C5B66826-570B-408A-857A-F5F9E84F88CD
====================================================
APFS Container Reference: disk5
Size (Capacity Ceiling): 999995129856 B (1000.0 GB)
Capacity In Use By Volumes: 350252339200 B (350.3 GB) (35.0% used)
Capacity Not Allocated: 649742790656 B (649.7 GB) (65.0% free)
|
+-< Physical Store disk0s2 9D99A1A0-6418-4ECD-9D93-2F12B2CEFDFE
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 999995129856 B (1000.0 GB)
|
+-> Volume disk5s1 B312E750-E7AF-404F-B524-B56959EF3D8C
---------------------------------------------------
APFS Volume Disk (Role): disk5s1 (No specific role)
Name: Other (Case-insensitive)
Mount Point: Not Mounted
Capacity Consumed: 349941567488 B (349.9 GB)
Sealed: No
FileVault: No
Is there any way i can recover data from this drive?
Getting int-short assignment error
Hi, after command make getting the next error
OBJECTS +++ include/drat/string/j.c +++ out/include/drat/string/j.o
gcc -std=c99 -D _GNU_SOURCE -Werror -Wall -Wextra -Wno-incompatible-pointer-types -Wno-multichar -Wno-unused-variable -Wno-unused-parameter -Wno-missing-field-initializers -I./include -I/usr/local/Cellar/argp-standalone/1.3/include/ -c "include/drat/string/j.c" -o "out/include/drat/string/j.o"
include/drat/string/j.c:53:55: error: format specifies type 'unsigned short' but
the argument has type 'int' [-Werror,-Wformat]
...extended fields: %"PRIu16"\n", has_xfields ? xfields->xf_num_exts : 0);
~~~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
make: *** [out/include/drat/string/j.o] Error 1
Why it could be?
-GNU C Compiler (gcc)
-GNU Make (make)
-GNU Argp library (<argp.h>)
are installed. I have MacOs 10.15.7
Properly define custom Sphinx roles
Implement `resolve-virtual-oids`, remove `resolver`
compilation errors under macOS (BigSur in this case)
$ gcc --version
Configured with: --prefix=/Applications/Xcode.app/Contents/Developer/usr --with-gxx-include-dir=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/c++/4.2.1
Apple clang version 13.0.0 (clang-1300.0.29.3)
Target: x86_64-apple-darwin20.6.0
Thread model: posix
InstalledDir: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin
$
Excerpt from output of make:
.h" -o "out/include/drat/argp.gch"
include/drat/argp.h:6:10: error: 'argp.h' file not found with <angled> include; use "quotes" instead
#include <argp.h>
^~~~~~~~
"argp.h"
include/drat/argp.h:30:53: error: array has incomplete element type 'const struct argp_option'
extern const struct argp_option argp_options_globals[];
^
include/drat/argp.h:30:21: note: forward declaration of 'struct argp_option'
extern const struct argp_option argp_options_globals[];
^
include/drat/argp.h:31:1: error: unknown type name 'error_t'
error_t argp_parser_command(int key, char* arg, struct argp_state* state);
^
include/drat/argp.h:31:56: error: declaration of 'struct argp_state' will not be visible outside of this function [-Werror,-Wvisibility]
error_t argp_parser_command(int key, char* arg, struct argp_state* state);
^
include/drat/argp.h:32:1: error: unknown type name 'error_t'
error_t argp_parser_globals(int key, char* arg, struct argp_state* state);
^
include/drat/argp.h:32:56: error: declaration of 'struct argp_state' will not be visible outside of this function [-Werror,-Wvisibility]
error_t argp_parser_globals(int key, char* arg, struct argp_state* state);
^
include/drat/argp.h:35:45: error: array has incomplete element type 'const struct argp_child'
extern const struct argp_child argp_children[];
^
include/drat/argp.h:35:21: note: forward declaration of 'struct argp_child'
extern const struct argp_child argp_children[];
^
7 errors generated.
make: *** [out/include/drat/argp.gch] Error 1
Sorry, I overlooked that argp_standalone is required (a home_brew port). Will try that and ignore my post.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.