Error mounting on GNU/Linux: all records greater than key / could not find root parent

[ethus3h]

Hi, I ran into an error using this in GNU/Linux, saying "all records greater than key" and "could not find root parent" when mounting a disk. The disk mounts OK using the Linux kernel driver. (I was trying this program to try to get around a character encoding issue with the Linux driver, but the Linux driver mostly works. Hfsexplorer is able to read the drive without any character encoding issues, but I want to mount it as a directory, which hfsexplorer can't do.)

I built hfsfuse from commit 70e2afecc7aef10b010c3ad69533f1bbe69e1954.

I'd appreciate any help with getting it working if possible! Thank you.

Here are the errorred output of hfsfuse, mounting it successfully with mount, the uname -a of the system I'm using, and output of hfsdump for the disk:

elegiac / # /home/kyan/hfsfuse/hfsfuse -o noublio /dev/sdc2 /redacted
all records greater than key
could not find root parent
elegiac / # ls !$
ls /redacted
ls: cannot access '/redacted': No such file or directory
-bash
failed with the error on /usr/bin/error-notify line 28 in / at 20211201232138914501699U2d303530300a:
An error was reported on  line 95 in / at 20211201232138870343719U2d303530300a.
elegiac / # umount /redacted 
elegiac / # mount -o ro,decompose  /dev/sdc2 /redacted
elegiac / # ls /redacted/.DS_Store
/redacted/.DS_Store
elegiac / # uname -a
Linux elegiac 5.4.72-gentoo-x86_64 #1 SMP PREEMPT Tue Nov 10 01:25:59 EST 2020 x86_64 Intel(R) Core(TM) i7-6560U CPU @ 2.20GHz GenuineIntel GNU/Linux
elegiac / # /home/kyan/hfsfuse/hfsdump /dev/sdc2
all records greater than key
could not find root parent
Volume name: 
Journaled? 1
Readonly? 1
Offset: 0
volume header:
signature: H+
version: 4
attributes: hwlock 0 unmounted 1 badblocks 0 nocache 0 dirty 0 cnids recycled 0 journaled 1 swlock 0
last_mounting_version: HFSJ
journal_info_block: 14905
date_created: Fri Nov  3 16:21:38 2017
date_modified: Fri Nov 12 16:01:47 2021
date_backedup: Wed Dec 31 19:00:00 1969
date_checked: Fri Nov  3 20:21:38 2017
file_count: 15500081
folder_count: 870963
block_size: 8192
total_blocks: 976711291
free_blocks: 107528638
next_alloc_block: 791701316
rsrc_clump_size: 65536
data_clump_size: 65536
next_cnid: 216797604
write_count: 166153162
encodings: 35651839
finderinfo:
        Boot directory ID: 0
        Startup parent directory ID: 0
        Display directory ID: 0
        OS classic system directory ID: 0
        OS X system directory ID: 0
        Volume unique ID: b315a2c4ef8331bd
elegiac / # 

[0x09]

Hi, it's tough to say but based on where this error is cropping up I'm concerned it may be a regression in fb874cd6e4e6ba44a95b25ec981340d19d1e5ee0. Do you mind checking out the most recent commit before that fd11ccce7ec2636c68aaee5f15f4de4ff8c99499 and rebuilding with CFLAGS='-include ctype.h -DDLO_DEBUG' make and adding the output from mounting the disk again? (the missing ctype.h include when DLO_DEBUG is defined is actually a bug so I'll fix that)

Thanks for the detailed report.

[ethus3h]

Hi, thank you; I built it as suggested from fd11ccce7ec2636c68aaee5f15f4de4ff8c99499. It still gave that error:

elegiac / # /home/kyan/hfsfuse/hfsfuse -o noublio /dev/sdc2 /redacted
-> key 2:[]
--> node 1302367
---> record 0: 215690174:[] <
all records greater than key
could not find root parent
elegiac / # ls /redacted
ls: cannot access '/redacted': No such file or directory
-bash
failed with the error on /usr/bin/error-notify line 28 in / at 20211203123931948733210U2d303530300a:
An error was reported on  line 124 in / at 20211203123931920580039U2d303530300a.
elegiac / # 

[0x09]

Hi, sorry for the back and forth, but could you try one more time with bb30b4011a1f40cdca0ead08113159b9239c3602 ? The debug output here indicates there are records in the filesystem but none are under / -- which seems like the result of filesystem corruption -- but the fact that these other tools are able to read them makes me wonder if some of the nodes are being skipped by hfsfuse instead. There were some changes in the commits after the one I linked to prevent possible overreads of nodes and I'm wondering if this is a bug that only appears in certain btree layouts (e.g. there are exactly the max number of nodes and hfsfuse isn't reading the last one).

[ethus3h]

Unfortunately it still didn't seem to work, building from that commit:

elegiac ~ # /home/kyan/hfsfuse/hfsfuse -o noublio /dev/sdd2 /redacted
-> key 2:[]
--> node 1302367
---> record 0: 215690174:[] <
all records greater than key
could not find root parent
elegiac ~ # ls /redacted
ls: cannot access '/redacted': No such file or directory
-bash
failed with the error on /usr/bin/error-notify line 28 in /root at 20211205223850764492027U2d303530300a:
An error was reported on  line 10 in /root at 20211205223850705491870U2d303530300a.
elegiac ~ # 

[0x09]

I see, thanks for trying it out. I've been trying to trace what might be going on here but it's tough without a disk that demonstrates the same problem to do more involved debugging on. I still think this might be a bug in hfsfuse, partly because I've never tested with a disk this large, but it's admittedly a bit of a stab in the dark at this point so if you'd rather stick with the other tools than continue trying things out that's understandable.

As for other info that could help at this point, I'd be interested to see the output of these if any.

/home/kyan/hfsfuse/hfsfuse -d -o noublio /dev/sdd2 /redacted
/home/kyan/hfsdump /dev/sdd2 read /
/home/kyan/hfsdump /dev/sdd2 stat /
/home/kyan/hfsdump /dev/sdd2 stat /.DS_Store

[ethus3h]

Here are the last three:

elegiac ~ # /home/kyan/hfsfuse/hfsdump /dev/sdd2 read /
-> key 2:[]
--> node 1302367
---> record 0: 215690174:[] <
all records greater than key
could not find root parent
-> key 2:[]
--> node 1302367
---> record 0: 215690174:[] <
all records greater than key
could not find parent thread for cnid 2
Path lookup failure: /
No such file or directory
-bash
failed with the error on /usr/bin/error-notify line 28 in /root at 20211208043333788873120U2d303530300a:
An error was reported on  line 41 in /root at 20211208043333745058017U2d303530300a.
elegiac ~ # /home/kyan/hfsfuse/hfsdump /dev/sdd2 stat /
-> key 2:[]
--> node 1302367
---> record 0: 215690174:[] <
all records greater than key
could not find root parent
-> key 2:[]
--> node 1302367
---> record 0: 215690174:[] <
all records greater than key
could not find parent thread for cnid 2
Path lookup failure: /
No such file or directory
-bash
failed with the error on /usr/bin/error-notify line 28 in /root at 20211208043340432523901U2d303530300a:
An error was reported on  line 42 in /root at 20211208043340347218120U2d303530300a.
elegiac ~ # /home/kyan/hfsfuse/hfsdump /dev/sdd2 stat /.DS_Store
-> key 2:[]
--> node 1302367
---> record 0: 215690174:[] <
all records greater than key
could not find root parent
-> key 2:[]
--> node 1302367
---> record 0: 215690174:[] <
all records greater than key
could not find parent thread for cnid 2
Path lookup failure: /.DS_Store
No such file or directory
-bash
failed with the error on /usr/bin/error-notify line 28 in /root at 20211208043350056150375U2d303530300a:
An error was reported on  line 43 in /root at 20211208043350000007912U2d303530300a.
elegiac ~ # 

The first one was taking a long time and producing a lot of output, so I cancelled it because it's time for bed for me, but here's what I got (I find-and-replaced one directory name that is from the filesystem contents of /dev/sdd2 with "redacted"; all the "redacted" in this correspond to the same string): https://gist.github.com/ethus3h/cff6c1880725889d33b9ba821d98c24a

[ethus3h]

(Oh, those were still using the https://github.com/0x09/hfsfuse/commit/bb30b4011a1f40cdca0ead08113159b9239c3602 commit, if that matters.)