mac - How to repair HFS+ extended attributes file?

06
2013-08
  • gelraen

    Is there any tool able to repair/rebuild extended attributes file?

    For now I tried fsck_hfs from Mac OS X 10.6.3 Retail DVD, fsck.hfsplus from GParted 0.5.2 livecd and Paragon Partition Manager 11. All without any success.

    This man page states that fsck_hfs have -R option to specify which B-trees need to be rebuilt, but I've not found anywhere fsck_hfs binary that accepts this option.

    Now I have HDD with broken HFS+ attached to VM in VirtualBox over network (via FreeBSD's GEOM gate), because I currently have no SATA-USB adapter.

  • Answers
  • Graham Perrin

    Specify the option as

    -Re
    

    If you command fsck_hfs with no option, then the list of options presented under 'usage' may be less than the options that are truly accepted. This is, I believe, a documentation bug.

    Update — 2011-07-30

    If the -R option is unrecognised by fsck_hfs in Mac OS X 10.6.3, assume that it was introduced in a later version of 10.6.x — for the manual page referenced in the opening post, between 10.5 and 10.6.6 there's nothing.

    Snow Leopard in the Apple Store (UK) remains at 10.6.3 so if you require bootable media with the more capable version of fsck_hfs I should recommend either of the following:

    For reference, here's a transcript from 10.7 (Build 11A511):

    [macbookpro08-centrim:~] gjp22% date
    Sat 30 Jul 2011 08:25:39 BST
    [macbookpro08-centrim:~] gjp22% uname -a
    Darwin macbookpro08-centrim.home 11.0.0 Darwin Kernel Version 11.0.0: Sat Jun 18 12:56:35 PDT 2011; root:xnu-1699.22.73~1/RELEASE_X86_64 x86_64
    [macbookpro08-centrim:~] gjp22% diskutil list
    /dev/disk0
       #:                       TYPE NAME                    SIZE       IDENTIFIER
       0:      GUID_partition_scheme                        *320.1 GB   disk0
       1:                        EFI                         209.7 MB   disk0s1
       2:          Apple_CoreStorage                         318.1 GB   disk0s2
       3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3
       4:              Apple_Journal                         536.9 MB   disk0s4
       5:                  Apple_HFS scratchy                536.9 MB   disk0s5
    /dev/disk1
       #:                       TYPE NAME                    SIZE       IDENTIFIER
       0:                  Apple_HFS speedy                 *317.8 GB   disk1
    [macbookpro08-centrim:~] gjp22% sudo /sbin/fsck_hfs -R
    /sbin/fsck_hfs: option requires an argument -- R
    usage: fsck_hfs [-b [size] B [path] c [size] Edfglx m [mode] npqruy] special-device
      b size = size of physical blocks (in bytes) for -B option
      B path = file containing physical block numbers to map to paths
      c size = cache size (ex. 512m, 1g)
      E = exit on first major error
      d = output debugging info
      f = force fsck even if clean (preen only) 
      g = GUI output mode
      x = XML output mode
      l = live fsck (lock down and test-only)
      m arg = octal mode used when creating lost+found directory 
      n = assume a no response 
      p = just fix normal inconsistencies 
      q = quick check returns clean, dirty, or failure 
      r = rebuild catalog btree 
      u = usage 
      y = assume a yes response 
    [macbookpro08-centrim:~] gjp22% sudo diskutil unmount /Volumes/scratchy
    Volume scratchy on disk0s5 unmounted
    [macbookpro08-centrim:~] gjp22% sudo /sbin/fsck_hfs -Re /dev/disk0s5
    ** /dev/rdisk0s5
       Executing fsck_hfs (version diskdev_cmds-540.1~34).
    ** Checking Journaled HFS Plus volume.
       The volume name is scratchy
    ** Checking extents overflow file.
    ** Checking catalog file.
    ** Rebuilding extents overflow B-tree.
    ** Rechecking volume.
    ** Checking Journaled HFS Plus volume.
       The volume name is scratchy
    ** Checking extents overflow file.
    ** Checking catalog file.
    ** Checking multi-linked files.
    ** Checking catalog hierarchy.
    ** Checking extended attributes file.
    ** Checking volume bitmap.
    ** Checking volume information.
       Invalid volume file count
       (It should be 336 instead of 226)
       Invalid volume directory count
       (It should be 37 instead of 52)
       Invalid volume free block count
       (It should be 124541 instead of 125082)
       Volume header needs minor repair
    (2, 0)
    ** Repairing volume.
    ** Rechecking volume.
    ** Checking Journaled HFS Plus volume.
       The volume name is scratchy
    ** Checking extents overflow file.
    ** Checking catalog file.
    ** Checking multi-linked files.
    ** Checking catalog hierarchy.
    ** Checking extended attributes file.
    ** Checking volume bitmap.
    ** Checking volume information.
    ** The volume scratchy was repaired successfully.
    [macbookpro08-centrim:~] gjp22% sudo /sbin/fsck_hfs -fn /dev/disk0s5
    ** /dev/rdisk0s5 (NO WRITE)
       Executing fsck_hfs (version diskdev_cmds-540.1~34).
    ** Checking Journaled HFS Plus volume.
       The volume name is scratchy
    ** Checking extents overflow file.
    ** Checking catalog file.
    ** Checking multi-linked files.
    ** Checking catalog hierarchy.
    ** Checking extended attributes file.
    ** Checking volume bitmap.
    ** Checking volume information.
    ** The volume scratchy appears to be OK.
    [macbookpro08-centrim:~] gjp22% 
    

  • Related Question

    osx - How do I look at disk journals under OS X?
  • stalepretzel

    About 2000 files just turned up missing on my Mac, with no clues as to where they went or how they were deleted. I have disk journaling enabled, so I'd like to look at the journals. Hopefully, they'll be able to shed some light on the situation.

    How can I look at these journals? Is there an application or a command-line program? Are there certain log files?

    Thanks!


  • Related Answers
  • John T

    These "Journals" are not actually readable journals as you'd expect. It's a process that is done for you behind the scenes to record changes to files if the disk unexpectedly turns off (power failure for example). Although you cannot read these journals, you can easily repair journaled volumes. You can find further information from these links:

    Mac OS X: About file system journaling

    How To Journal a Volume or Repair a Journaled Volume