Closed themantripleman closed 4 years ago
Have you tried afro for your case? Which issues occurred?
Thank you for answering so quickly.
It seems to me that, when extracting data from drives that are, often enough, multiple terabytes in size, being able to chose where to put all of that recovered data is a necessity. As I said, perhaps number 4 is a dumb question because, to a programmer or CS engineer, the answer is so basic and obvious, it doesn't rate mentioning but, for me, I'm totally baffled.
So, I just decided to run Afro on 005
of disk4
because, why not? I can always create another image because the HD portion of my Fusion Drive is physically ok, as far as I can tell. Running DDRescue always returns 0 unreadable data
and 0 bad sectors
. The only actual limitation to the number of times I can clone the original HD is the fact that eventually I need to take the iMac in to fix the dead drive.
It's been running for about 30 minutes now, getting a lot of errors:
icemo:~ icemo$ strings /sbin/fsck_apfs | grep "fsck_apfs ("
fsck_apfs (945.275.7)
icemo:~ icemo$ sudo afro -o 409640 -e files /dev/disk4
Password:
INFO Found apsb in block 4128353
INFO 'Obj' object has no attribute 'body'
INFO Found apsb in block 4144388
INFO 'Obj' object has no attribute 'body'
INFO Found apsb in block 4178077
INFO 'Obj' object has no attribute 'body'
INFO Found apsb in block 4216757
INFO 'Obj' object has no attribute 'body'
INFO Found apsb in block 4240647
INFO 'Obj' object has no attribute 'body'
INFO Found apsb in block 4288916
INFO 'Obj' object has no attribute 'body'
INFO Found apsb in block 4480626
INFO 'Obj' object has no attribute 'body'
INFO Found apsb in block 4536986
INFO 'Obj' object has no attribute 'body'
INFO Found apsb in block 4544690
INFO 'Obj' object has no attribute 'body'
INFO Found apsb in block 4558903
INFO 'Obj' object has no attribute 'body'
INFO Found apsb in block 4572650
INFO 'Obj' object has no attribute 'body'
INFO Found apsb in block 4583859
INFO 'Obj' object has no attribute 'body'
INFO Found apsb in block 8181566
INFO 4 is not a valid ObjectTypeFlags
There are about forty more 'body' errors before what is shown here, I didn't include them. The last error here is actually the last one, so far, and has only come up the once.
Of course, at this point I have zero idea what it's really doing, how long it's going to take and where it will put the extracted files—if it actually extracts any. ¯\ (ツ) /¯
The working light on the external is still flashing away, so I'll let it run and check back on it later, unless you tell me that it's a waste of time.
Thanks again for your time and efforts on this matter.
afro extracts the files to the current folder. For icemo:~ icemo$ sudo afro -o 409640 -e files /dev/disk4
the extracted files should be located in /Users/icemo
. If you want to change the folder just cd
to another directory.
Yeah, I kind of thought it would be that way but…
icemo:please extract here icemo$ afro -o 40 -e files /Volumes/Deichtorhalle/cfp/dont\ extract\ here/wsdf.dmg
INFO Found apsb in block 269
INFO Found apsb in block 277
INFO Found apsb in block 2467
INFO Found apsb in block 2482
INFO Found apsb in block 2485
INFO Found apsb in block 2499
INFO Found apsb in block 2510
INFO Found apsb in block 2516
INFO Found apsb in block 2519
INFO Found apsb in block 2529
INFO Found apsb in block 2541
INFO Found apsb in block 2547
INFO Found apsb in block 2550
icemo:please extract here icemo$ ls
it's empty.txt
icemo:please extract here icemo$ cd /Volumes/Deichtorhalle/cfp/dont\ extract\ here
icemo:dont extract here icemo$ ls
wsdf.dmg wsdf.dmg.carve_apsb.extracted
icemo:dont extract here icemo$ :(
Thanks again, for replying. I'm really not sure what I'm doing wrong here.
True, my bad. I try to change the behavior in #16
Should be working now.
Oh wow, that's awesome. Thank you very much. That fixed it.
So, I ran Afro overnight…
afro -e bodyfile -e files -o 409640 -m carve -c apsb /Volumes/Deichtorhalle/cfp/disk0.dmg
…and it returned zero files. [sad trombone.wav]
But, on the plus side, this bodyfile I can figure out quite easily:
md5|name|id|mode|uid|gid|size|atime|mtime|ctime|crtime
That's it. The entire contents of disk0.dmg.carve_apsb.bodyfile.
I'm running it again now with the nxsb carving method but I really have no idea what the differences are.
As before, I'm getting a lot of these messages:
INFO Found nxsb in block 3883312
INFO 'Obj' object has no attribute 'body'
With some of these:
INFO Found nxsb in block 3883214
INFO 26734 is not a valid ObjectType
and the ever-present:
4 is not a valid ObjectTypeFlags
Which is always the last message it spits out before not printing any more messages (but, according to Activity Monitor, keeps on running and reading data at about 110MB/sec).
No idea at all what they mean.
I guess if nxsb doesn't work, there's always nodes.
Mid-Comment–Edit: I stopped the nxsb run and am running with -c nodes
and am getting a million Found nodes in block [some number]
but with none of the no attribute
or not a valid object type
messages. This seems much more promising.
Thanks again for your time and efforts on this, I really appreciate the help.
Unfortunately afro does not cover all variants/versions of APFS (and fusion drives have most like some special elements) and I do not have much time to improve it currently.
-c nodes
should be most detailed. Please keep me updated with the results.
Totally understandable. Additionally, there is the factor that the HD is only the surviving part of a Fusion Drive. I have no idea what kind of a mess was left behind when the SSD died.
At this point, it's still motoring away. Nothing new to report.
When I look at Activity Monitor, it says that the python process has read ~1.05 TB of data but written 0. I can also look at the recovery folder and, yes, it is still empty.
Should Afro be recovering on the go, or does it read everything and then recover? If it's the former, then this run will also be unsuccessful.
Thanks for your help.
Hmmmm, it finished with this error.
Traceback (most recent call last):
File "/usr/local/bin/afro", line 11, in <module>
load_entry_point('afro==0.2', 'console_scripts', 'afro')()
File "/usr/local/lib/python3.7/site-packages/afro-0.2-py3.7.egg/afro/__init__.py", line 117, in main
File "/usr/local/lib/python3.7/site-packages/afro-0.2-py3.7.egg/afro/__init__.py", line 103, in extract
File "/usr/local/lib/python3.7/site-packages/afro-0.2-py3.7.egg/afro/item_store.py", line 75, in save_files
File "/usr/local/Cellar/python/3.7.6_1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/os.py", line 221, in makedirs
mkdir(name, mode)
PermissionError: [Errno 13] Permission denied: '/journals.live_system'
The permission error makes me think that I should have run it as sudo
but that's just a guess. Also, and I'm not sure if this is of relevance or not but, I had no idea where to install Afro so I ended up installing it in /usr/bin
.
The bodyfile is 41.3 MB but, as I mentioned in my first post, I have no idea how to read it. an ls
list of the files in the .extracted folder shows this:
-rw-r--r--@ 1 icemo staff 6148 Mar 6 17:51 .DS_Store
-rw-r--r-- 1 icemo staff 7442432 Mar 6 17:09 .store.db
-rw-r--r-- 1 icemo staff 1048576 Mar 6 17:09 0.directoryStoreFile
-rw-r--r-- 1 icemo staff 12582912 Mar 6 17:09 0.indexArrays
-rw-r--r-- 1 icemo staff 1048576 Mar 6 17:09 0.indexBigDates
-rw-r--r-- 1 icemo staff 16384 Mar 6 17:09 0.indexCompactDirectory
-rw-r--r-- 1 icemo staff 16448 Mar 6 17:09 0.indexDirectory
-rw-r--r-- 1 icemo staff 209716 Mar 6 17:09 0.indexGroups
-rw-r--r-- 1 icemo staff 4096 Mar 6 17:09 0.indexHead
-rw-r--r-- 1 icemo staff 2097152 Mar 6 17:09 0.indexIds
-rw-r--r-- 1 icemo staff 8388608 Mar 6 17:09 0.indexPositionTable
-rw-r--r-- 1 icemo staff 4096 Mar 6 17:09 0.indexPositions
-rw-r--r-- 1 icemo staff 8388608 Mar 6 17:09 0.indexPostings
-rw-r--r-- 1 icemo staff 8388608 Mar 6 17:09 0.indexTermIds
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 0.indexUpdates
-rw-r--r-- 1 icemo staff 4096 Mar 6 17:09 0.shadowIndexHead
-rw-r--r-- 1 icemo staff 0 Mar 6 17:09 0.shadowIndexTermIds
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 Cab.created
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 Cache
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 Lion.created
-rw-r--r-- 1 icemo staff 60 Mar 6 17:09 activityJournal.1
-rw-r--r-- 1 icemo staff 28 Mar 6 17:09 indexState
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 journalExclusion
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 journals.assisted_import_post
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 journals.assisted_import_pre
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 journals.corespotlight
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 journals.health_check
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 journals.live
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 journals.live_priority
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 journals.live_system
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 journals.live_user
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 journals.migration
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 journals.migration_secondchance
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 journals.scan
-rw-r--r-- 1 icemo staff 65536 Mar 6 17:09 live.0.directoryStoreFile
-rw-r--r-- 1 icemo staff 786432 Mar 6 17:09 live.0.indexArrays
-rw-r--r-- 1 icemo staff 16384 Mar 6 17:09 live.0.indexBigDates
-rw-r--r-- 1 icemo staff 2048 Mar 6 17:09 live.0.indexCompactDirectory
-rw-r--r-- 1 icemo staff 8224 Mar 6 17:09 live.0.indexDirectory
-rw-r--r-- 1 icemo staff 3277 Mar 6 17:09 live.0.indexGroups
-rw-r--r-- 1 icemo staff 4096 Mar 6 17:09 live.0.indexHead
-rw-r--r-- 1 icemo staff 32768 Mar 6 17:09 live.0.indexIds
-rw-r--r-- 1 icemo staff 262144 Mar 6 17:09 live.0.indexPositionTable
-rw-r--r-- 1 icemo staff 4096 Mar 6 17:09 live.0.indexPositions
-rw-r--r-- 1 icemo staff 131072 Mar 6 17:09 live.0.indexPostings
-rw-r--r-- 1 icemo staff 262144 Mar 6 17:09 live.0.indexTermIds
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 live.0.indexUpdates
-rw-r--r-- 1 icemo staff 2097152 Mar 6 17:09 reverseDirectoryStore
-rw-r--r-- 1 icemo staff 1048576 Mar 6 17:09 reverseDirectoryStore.shadow
-rw-r--r-- 1 icemo staff 4 Mar 6 17:09 shutdown_time
-rw-r--r-- 1 icemo staff 6230016 Mar 6 17:09 store.db
-rw-r--r-- 1 icemo staff 3 Mar 6 17:09 store.updates
-rw-r--r-- 1 icemo staff 4 Mar 6 17:09 store_generation
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 tmp.Cab
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 tmp.Lion
drwxr-xr-x 2 icemo staff 68 Mar 6 17:09 tmp.SnowLeopard
-rw-r--r-- 1 icemo staff 499590 Mar 6 17:09 tmp.spotlight.loc
-rw-r--r-- 1 icemo staff 4096 Mar 6 17:09 tmp.spotlight.state
All of those files look like they are used by the system and not what I would consider "my files", if you know what I mean. But, having Afro return something seems like progress, though.
In the end, it didn't take that long to run, I'm going to run Afro again as sudo
and see if that makes any difference.
Pretty much the same result as before. That's a bit of a bummer because I'm starting to run out of options to try.
Traceback (most recent call last):
File "/usr/local/bin/afro", line 11, in <module>
load_entry_point('afro==0.2', 'console_scripts', 'afro')()
File "/usr/local/lib/python3.7/site-packages/afro-0.2-py3.7.egg/afro/__init__.py", line 117, in main
File "/usr/local/lib/python3.7/site-packages/afro-0.2-py3.7.egg/afro/__init__.py", line 103, in extract
File "/usr/local/lib/python3.7/site-packages/afro-0.2-py3.7.egg/afro/item_store.py", line 80, in save_files
PermissionError: [Errno 1] Operation not permitted: '/.Spotlight-V100/VolumeConfiguration.plist'
This bodyfile is also 41.3 MB in size, I doubt that's a coincidence.
The extracted folder is about 2.24 GB in size and two files, "com_apple_MobileAsset_DictionaryServices_dictionaryOSX.cpio" and "com_apple_MobileAsset_Font5.cpio" are about 1 GB each so other the other files are obviously all small.
A few image files were recovered, Hockey.tif, Tennis.png, Soccer.png and so on. They are, I think, some of the standard Mac OS profile icons. It is not possible to view them with Quicklook nor open them—Preview states that they've been damaged. Some fonts were also found, they can also not be opened or viewed.
I find it interesting that it is these files—all part of the OS—that are being found and "recovered" because, to my understanding, in a Fusion Drive, the OS is stored on the faster SSD portion of the Core Storage volume and my SSD is dead.
Running ls
shows:
-rw-r--r--@ 1 icemo staff 6148 Mar 7 11:40 .DS_Store
-rw-r--r-- 1 icemo staff 41290932 Mar 7 01:20 disk0.dmg.carve_nodes.bodyfile
drwxr-xr-x 4 icemo staff 136 Mar 7 01:41 disk0.dmg.carve_nodes.extracted
./disk0.dmg.carve_nodes.extracted:
total 16
-rw-r--r--@ 1 icemo staff 6148 Mar 7 11:40 .DS_Store
drwxr-xr-x 10 icemo staff 340 Mar 7 01:41 unknown
./disk0.dmg.carve_nodes.extracted/unknown:
total 16
-rw-r--r--@ 1 icemo staff 6148 Mar 7 10:23 .DS_Store
drwxr-xr-x 20 icemo staff 680 Mar 7 01:43 137
drwxr-xr-x 60 icemo staff 2040 Mar 7 01:43 171
drwxr-xr-x 35 icemo staff 1190 Mar 7 01:43 172
drwxr-xr-x 38 icemo staff 1292 Mar 7 01:43 173
drwxr-xr-x 108 icemo staff 3672 Mar 7 01:41 174
drwxr-xr-x 7 icemo staff 238 Mar 7 01:20 177
drwxr-xr-x 19 icemo staff 646 Mar 7 01:41 181
./disk0.dmg.carve_nodes.extracted/unknown/137:
total 4087120
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 .AppleCustomMac
-rw-r--r--@ 1 icemo staff 12292 Mar 7 01:43 .DS_Store
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 .ShowHardwareWarranty
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 CVMS
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 ConfigurationProfiles
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 GPURestartReporter
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 Login.logical_playlist
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 Root.logical_playlist
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 RootExtra.logical_playlist
-rw-r--r-- 1 icemo staff 1071675904 Mar 7 01:20 com_apple_MobileAsset_DictionaryServices_dictionaryOSX.cpio
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 com_apple_MobileAsset_DictionaryServices_dictionaryOSX.xml
-rw-r--r-- 1 icemo staff 1020908544 Mar 7 01:20 com_apple_MobileAsset_Font5.cpio
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 com_apple_MobileAsset_Font5.xml
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 com_apple_MobileAsset_LinguisticData.cpio
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 com_apple_MobileAsset_LinguisticData.xml
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 private-dir
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 receipts
drwxr-xr-x 4 icemo staff 136 Mar 7 01:20 root
./disk0.dmg.carve_nodes.extracted/unknown/137/.AppleCustomMac:
./disk0.dmg.carve_nodes.extracted/unknown/137/.ShowHardwareWarranty:
./disk0.dmg.carve_nodes.extracted/unknown/137/CVMS:
./disk0.dmg.carve_nodes.extracted/unknown/137/ConfigurationProfiles:
./disk0.dmg.carve_nodes.extracted/unknown/137/GPURestartReporter:
./disk0.dmg.carve_nodes.extracted/unknown/137/Login.logical_playlist:
./disk0.dmg.carve_nodes.extracted/unknown/137/Root.logical_playlist:
./disk0.dmg.carve_nodes.extracted/unknown/137/RootExtra.logical_playlist:
./disk0.dmg.carve_nodes.extracted/unknown/137/com_apple_MobileAsset_DictionaryServices_dictionaryOSX.xml:
./disk0.dmg.carve_nodes.extracted/unknown/137/com_apple_MobileAsset_Font5.xml:
./disk0.dmg.carve_nodes.extracted/unknown/137/com_apple_MobileAsset_LinguisticData.cpio:
./disk0.dmg.carve_nodes.extracted/unknown/137/com_apple_MobileAsset_LinguisticData.xml:
./disk0.dmg.carve_nodes.extracted/unknown/137/private-dir:
./disk0.dmg.carve_nodes.extracted/unknown/137/receipts:
./disk0.dmg.carve_nodes.extracted/unknown/137/root:
total 0
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 .PKInstallSandboxManager
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 .fseventsd
./disk0.dmg.carve_nodes.extracted/unknown/137/root/.PKInstallSandboxManager:
./disk0.dmg.carve_nodes.extracted/unknown/137/root/.fseventsd:
./disk0.dmg.carve_nodes.extracted/unknown/171:
total 119568
-rw-r--r--@ 1 icemo staff 12292 Mar 7 01:43 .DS_Store
-rw-r--r-- 1 icemo staff 7442432 Mar 7 01:20 .store.db
-rw-r--r-- 1 icemo staff 1048576 Mar 7 01:20 0.directoryStoreFile
-rw-r--r-- 1 icemo staff 12582912 Mar 7 01:20 0.indexArrays
-rw-r--r-- 1 icemo staff 1048576 Mar 7 01:20 0.indexBigDates
-rw-r--r-- 1 icemo staff 16384 Mar 7 01:20 0.indexCompactDirectory
-rw-r--r-- 1 icemo staff 16448 Mar 7 01:20 0.indexDirectory
-rw-r--r-- 1 icemo staff 209716 Mar 7 01:20 0.indexGroups
-rw-r--r-- 1 icemo staff 4096 Mar 7 01:20 0.indexHead
-rw-r--r-- 1 icemo staff 2097152 Mar 7 01:20 0.indexIds
-rw-r--r-- 1 icemo staff 8388608 Mar 7 01:20 0.indexPositionTable
-rw-r--r-- 1 icemo staff 4096 Mar 7 01:20 0.indexPositions
-rw-r--r-- 1 icemo staff 8388608 Mar 7 01:20 0.indexPostings
-rw-r--r-- 1 icemo staff 8388608 Mar 7 01:20 0.indexTermIds
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 0.indexUpdates
-rw-r--r-- 1 icemo staff 4096 Mar 7 01:20 0.shadowIndexHead
-rw-r--r-- 1 icemo staff 0 Mar 7 01:20 0.shadowIndexTermIds
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 Cab.created
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 Cache
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 Lion.created
-rw-r--r-- 1 icemo staff 60 Mar 7 01:20 activityJournal.1
-rw-r--r-- 1 icemo staff 28 Mar 7 01:20 indexState
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journalExclusion
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.assisted_import_post
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.assisted_import_pre
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.corespotlight
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.health_check
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.live
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.live_priority
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.live_system
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.live_user
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.migration
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.migration_secondchance
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.scan
-rw-r--r-- 1 icemo staff 65536 Mar 7 01:20 live.0.directoryStoreFile
-rw-r--r-- 1 icemo staff 786432 Mar 7 01:20 live.0.indexArrays
-rw-r--r-- 1 icemo staff 16384 Mar 7 01:20 live.0.indexBigDates
-rw-r--r-- 1 icemo staff 2048 Mar 7 01:20 live.0.indexCompactDirectory
-rw-r--r-- 1 icemo staff 8224 Mar 7 01:20 live.0.indexDirectory
-rw-r--r-- 1 icemo staff 3277 Mar 7 01:20 live.0.indexGroups
-rw-r--r-- 1 icemo staff 4096 Mar 7 01:20 live.0.indexHead
-rw-r--r-- 1 icemo staff 32768 Mar 7 01:20 live.0.indexIds
-rw-r--r-- 1 icemo staff 262144 Mar 7 01:20 live.0.indexPositionTable
-rw-r--r-- 1 icemo staff 4096 Mar 7 01:20 live.0.indexPositions
-rw-r--r-- 1 icemo staff 131072 Mar 7 01:20 live.0.indexPostings
-rw-r--r-- 1 icemo staff 262144 Mar 7 01:20 live.0.indexTermIds
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 live.0.indexUpdates
-rw-r--r-- 1 icemo staff 2097152 Mar 7 01:20 reverseDirectoryStore
-rw-r--r-- 1 icemo staff 1048576 Mar 7 01:20 reverseDirectoryStore.shadow
-rw-r--r-- 1 icemo staff 4 Mar 7 01:20 shutdown_time
-rw-r--r-- 1 icemo staff 6230016 Mar 7 01:20 store.db
-rw-r--r-- 1 icemo staff 3 Mar 7 01:20 store.updates
-rw-r--r-- 1 icemo staff 4 Mar 7 01:20 store_generation
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 tmp.Cab
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 tmp.Lion
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 tmp.SnowLeopard
-rw-r--r-- 1 icemo staff 499590 Mar 7 01:20 tmp.spotlight.loc
-rw-r--r-- 1 icemo staff 4096 Mar 7 01:20 tmp.spotlight.state
./disk0.dmg.carve_nodes.extracted/unknown/171/0.indexUpdates:
./disk0.dmg.carve_nodes.extracted/unknown/171/Cab.created:
./disk0.dmg.carve_nodes.extracted/unknown/171/Cache:
./disk0.dmg.carve_nodes.extracted/unknown/171/Lion.created:
./disk0.dmg.carve_nodes.extracted/unknown/171/journalExclusion:
./disk0.dmg.carve_nodes.extracted/unknown/171/journals.assisted_import_post:
./disk0.dmg.carve_nodes.extracted/unknown/171/journals.assisted_import_pre:
./disk0.dmg.carve_nodes.extracted/unknown/171/journals.corespotlight:
./disk0.dmg.carve_nodes.extracted/unknown/171/journals.health_check:
./disk0.dmg.carve_nodes.extracted/unknown/171/journals.live:
./disk0.dmg.carve_nodes.extracted/unknown/171/journals.live_priority:
./disk0.dmg.carve_nodes.extracted/unknown/171/journals.live_system:
./disk0.dmg.carve_nodes.extracted/unknown/171/journals.live_user:
./disk0.dmg.carve_nodes.extracted/unknown/171/journals.migration:
./disk0.dmg.carve_nodes.extracted/unknown/171/journals.migration_secondchance:
./disk0.dmg.carve_nodes.extracted/unknown/171/journals.scan:
./disk0.dmg.carve_nodes.extracted/unknown/171/live.0.indexUpdates:
./disk0.dmg.carve_nodes.extracted/unknown/171/tmp.Cab:
./disk0.dmg.carve_nodes.extracted/unknown/171/tmp.Lion:
./disk0.dmg.carve_nodes.extracted/unknown/171/tmp.SnowLeopard:
./disk0.dmg.carve_nodes.extracted/unknown/172:
total 33136
-rw-r--r--@ 1 icemo staff 10244 Mar 7 01:43 .DS_Store
-rw-r--r-- 1 icemo staff 9113600 Mar 7 01:20 .store.db
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 libecpg_compat.pc
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 libiodbc.pc
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 libpcre.pc
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 libpcreposix.pc
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 libpgtypes.pc
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 libpq.pc
-rw-r--r-- 1 icemo staff 65536 Mar 7 01:20 live.0.directoryStoreFile
-rw-r--r-- 1 icemo staff 786432 Mar 7 01:20 live.0.indexArrays
-rw-r--r-- 1 icemo staff 16384 Mar 7 01:20 live.0.indexBigDates
-rw-r--r-- 1 icemo staff 2048 Mar 7 01:20 live.0.indexCompactDirectory
-rw-r--r-- 1 icemo staff 8224 Mar 7 01:20 live.0.indexDirectory
-rw-r--r-- 1 icemo staff 3277 Mar 7 01:20 live.0.indexGroups
-rw-r--r-- 1 icemo staff 32768 Mar 7 01:20 live.0.indexIds
-rw-r--r-- 1 icemo staff 262144 Mar 7 01:20 live.0.indexPositionTable
-rw-r--r-- 1 icemo staff 4096 Mar 7 01:20 live.0.indexPositions
-rw-r--r-- 1 icemo staff 131072 Mar 7 01:20 live.0.indexPostings
-rw-r--r-- 1 icemo staff 262144 Mar 7 01:20 live.0.indexTermIds
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 python2.7
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 rpcsvc
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 ruby
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 sasl2
-rw-r--r-- 1 icemo staff 6230016 Mar 7 01:20 store.db
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 videosubscriptionsd
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 vndevice
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 warmd
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 warmd_agent
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 watchdogd
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 webinspectord
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 wfs
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 wifiFirmwareLoader
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 wifid
./disk0.dmg.carve_nodes.extracted/unknown/172/libecpg_compat.pc:
./disk0.dmg.carve_nodes.extracted/unknown/172/libiodbc.pc:
./disk0.dmg.carve_nodes.extracted/unknown/172/libpcre.pc:
./disk0.dmg.carve_nodes.extracted/unknown/172/libpcreposix.pc:
./disk0.dmg.carve_nodes.extracted/unknown/172/libpgtypes.pc:
./disk0.dmg.carve_nodes.extracted/unknown/172/libpq.pc:
./disk0.dmg.carve_nodes.extracted/unknown/172/python2.7:
./disk0.dmg.carve_nodes.extracted/unknown/172/rpcsvc:
./disk0.dmg.carve_nodes.extracted/unknown/172/ruby:
./disk0.dmg.carve_nodes.extracted/unknown/172/sasl2:
./disk0.dmg.carve_nodes.extracted/unknown/172/videosubscriptionsd:
./disk0.dmg.carve_nodes.extracted/unknown/172/vndevice:
./disk0.dmg.carve_nodes.extracted/unknown/172/warmd:
./disk0.dmg.carve_nodes.extracted/unknown/172/warmd_agent:
./disk0.dmg.carve_nodes.extracted/unknown/172/watchdogd:
./disk0.dmg.carve_nodes.extracted/unknown/172/webinspectord:
./disk0.dmg.carve_nodes.extracted/unknown/172/wfs:
./disk0.dmg.carve_nodes.extracted/unknown/172/wifiFirmwareLoader:
./disk0.dmg.carve_nodes.extracted/unknown/172/wifid:
./disk0.dmg.carve_nodes.extracted/unknown/173:
total 62176
-rw-r--r--@ 1 icemo staff 10244 Mar 7 01:43 .DS_Store
-rw-r--r-- 1 icemo staff 9244672 Mar 7 01:20 .store.db
-rw-r--r-- 1 icemo staff 1048576 Mar 7 01:20 0.directoryStoreFile
-rw-r--r-- 1 icemo staff 12582912 Mar 7 01:20 0.indexArrays
-rw-r--r-- 1 icemo staff 16384 Mar 7 01:20 0.indexCompactDirectory
-rw-r--r-- 1 icemo staff 4096 Mar 7 01:20 0.shadowIndexHead
-rw-r--r-- 1 icemo staff 0 Mar 7 01:20 0.shadowIndexTermIds
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journalExclusion
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.assisted_import_post
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.assisted_import_pre
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.corespotlight
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.health_check
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.live
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.live_priority
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.live_system
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.live_user
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.migration
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.migration_secondchance
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 journals.scan
-rw-r--r-- 1 icemo staff 65536 Mar 7 01:20 live.0.directoryStoreFile
-rw-r--r-- 1 icemo staff 786432 Mar 7 01:20 live.0.indexArrays
-rw-r--r-- 1 icemo staff 16384 Mar 7 01:20 live.0.indexBigDates
-rw-r--r-- 1 icemo staff 2048 Mar 7 01:20 live.0.indexCompactDirectory
-rw-r--r-- 1 icemo staff 8224 Mar 7 01:20 live.0.indexDirectory
-rw-r--r-- 1 icemo staff 3277 Mar 7 01:20 live.0.indexGroups
-rw-r--r-- 1 icemo staff 4096 Mar 7 01:20 live.0.indexHead
-rw-r--r-- 1 icemo staff 32768 Mar 7 01:20 live.0.indexIds
-rw-r--r-- 1 icemo staff 262144 Mar 7 01:20 live.0.indexPositionTable
-rw-r--r-- 1 icemo staff 4096 Mar 7 01:20 live.0.indexPositions
-rw-r--r-- 1 icemo staff 131072 Mar 7 01:20 live.0.indexPostings
-rw-r--r-- 1 icemo staff 262144 Mar 7 01:20 live.0.indexTermIds
-rw-r--r-- 1 icemo staff 1048576 Mar 7 01:20 reverseDirectoryStore.shadow
-rw-r--r-- 1 icemo staff 4 Mar 7 01:20 shutdown_time
-rw-r--r-- 1 icemo staff 6230016 Mar 7 01:20 store.db
-rw-r--r-- 1 icemo staff 4 Mar 7 01:20 store_generation
-rw-r--r-- 1 icemo staff 4096 Mar 7 01:20 tmp.spotlight.state
./disk0.dmg.carve_nodes.extracted/unknown/173/journalExclusion:
./disk0.dmg.carve_nodes.extracted/unknown/173/journals.assisted_import_post:
./disk0.dmg.carve_nodes.extracted/unknown/173/journals.assisted_import_pre:
./disk0.dmg.carve_nodes.extracted/unknown/173/journals.corespotlight:
./disk0.dmg.carve_nodes.extracted/unknown/173/journals.health_check:
./disk0.dmg.carve_nodes.extracted/unknown/173/journals.live:
./disk0.dmg.carve_nodes.extracted/unknown/173/journals.live_priority:
./disk0.dmg.carve_nodes.extracted/unknown/173/journals.live_system:
./disk0.dmg.carve_nodes.extracted/unknown/173/journals.live_user:
./disk0.dmg.carve_nodes.extracted/unknown/173/journals.migration:
./disk0.dmg.carve_nodes.extracted/unknown/173/journals.migration_secondchance:
./disk0.dmg.carve_nodes.extracted/unknown/173/journals.scan:
./disk0.dmg.carve_nodes.extracted/unknown/174:
total 39584
-rw-r--r--@ 1 icemo staff 30724 Mar 7 01:43 .DS_Store
-rw-r--r-- 1 icemo staff 9834496 Mar 7 01:20 .store.db
-rw-r--r--@ 1 icemo staff 770326 Mar 7 01:20 Football.tif
-rw-r--r-- 1 icemo staff 406534 Mar 7 01:20 Golf.png
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 Grapher
-rw-r--r-- 1 icemo staff 230808 Mar 7 01:20 Hockey.tif
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 LantingheiTC-Extralight.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NetSNMP
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansAvestan-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansBalinese-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansBamum-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansBatak-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansBrahmi-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansBuginese-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansBuhid-Regular.ttf
-rw-r--r-- 1 icemo staff 6260 Mar 7 01:20 NotoSansCarian-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansChakma-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansCham-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansCoptic-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansCuneiform-Regular.ttf
-rw-r--r-- 1 icemo staff 7980 Mar 7 01:20 NotoSansCypriot-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansEgyptianHieroglyphs-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansGlagolitic-Regular.ttf
-rw-r--r-- 1 icemo staff 6152 Mar 7 01:20 NotoSansGothic-Regular.ttf
-rw-r--r-- 1 icemo staff 7220 Mar 7 01:20 NotoSansHanunoo-Regular.ttf
-rw-r--r-- 1 icemo staff 5632 Mar 7 01:20 NotoSansImperialAramaic-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansInscriptionalPahlavi-Regular.ttf
-rw-r--r-- 1 icemo staff 8040 Mar 7 01:20 NotoSansInscriptionalParthian-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansJavanese-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansKaithi-Regular.ttf
-rw-r--r-- 1 icemo staff 8096 Mar 7 01:20 NotoSansKayahLi-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansKharoshthi-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansLepcha-Regular.ttf
-rw-r--r-- 1 icemo staff 11820 Mar 7 01:20 NotoSansLimbu-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansLinearB-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansLisu-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansLycian-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansLydian-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansMandaic-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansMeeteiMayek-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansMongolian-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansNKo-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansNewTaiLue-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansOgham-Regular.ttf
-rw-r--r-- 1 icemo staff 7628 Mar 7 01:20 NotoSansOlChiki-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansOldItalic-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansOldPersian-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansOldSouthArabian-Regular.ttf
-rw-r--r-- 1 icemo staff 7856 Mar 7 01:20 NotoSansOldTurkic-Regular.ttf
-rw-r--r-- 1 icemo staff 7472 Mar 7 01:20 NotoSansOsmanya-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansPhagsPa-Regular.ttf
-rw-r--r-- 1 icemo staff 5684 Mar 7 01:20 NotoSansPhoenician-Regular.ttf
-rw-r--r-- 1 icemo staff 6876 Mar 7 01:20 NotoSansRejang-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansRunic-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansSamaritan-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansSaurashtra-Regular.ttf
-rw-r--r-- 1 icemo staff 6020 Mar 7 01:20 NotoSansShavian-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansSundanese-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansSylotiNagri-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansSyriacEastern-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansTagalog-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansTagbanwa-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansTaiLe-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansTaiTham-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansTaiViet-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansThaana-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansTifinagh-Regular.ttf
-rw-r--r-- 1 icemo staff 6772 Mar 7 01:20 NotoSansUgaritic-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansVai-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 NotoSansYi-Regular.ttf
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 PreferencePanes
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 Preferences
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 SNMP
-rw-r--r-- 1 icemo staff 379008 Mar 7 01:20 Soccer.png
-rw-r--r-- 1 icemo staff 218271 Mar 7 01:20 Target.png
-rw-r--r-- 1 icemo staff 394296 Mar 7 01:20 Tennis.png
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 Video
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 WebServer
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 build.properties
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 common.dtd
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 css
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 faq.dtd
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 iLife
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 iWork
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 iWork Arabic Support
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 lang
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 lang.dtd
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 latex
-rw-r--r-- 1 icemo staff 65536 Mar 7 01:20 live.0.directoryStoreFile
-rw-r--r-- 1 icemo staff 786432 Mar 7 01:20 live.0.indexArrays
-rw-r--r-- 1 icemo staff 16384 Mar 7 01:20 live.0.indexBigDates
-rw-r--r-- 1 icemo staff 2048 Mar 7 01:20 live.0.indexCompactDirectory
-rw-r--r-- 1 icemo staff 8224 Mar 7 01:20 live.0.indexDirectory
-rw-r--r-- 1 icemo staff 3277 Mar 7 01:20 live.0.indexGroups
-rw-r--r-- 1 icemo staff 32768 Mar 7 01:20 live.0.indexIds
-rw-r--r-- 1 icemo staff 262144 Mar 7 01:20 live.0.indexPositionTable
-rw-r--r-- 1 icemo staff 4096 Mar 7 01:20 live.0.indexPositions
-rw-r--r-- 1 icemo staff 131072 Mar 7 01:20 live.0.indexPostings
-rw-r--r-- 1 icemo staff 262144 Mar 7 01:20 live.0.indexTermIds
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 manualpage.dtd
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 modulesynopsis.dtd
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 scripts
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 sitemap.dtd
-rw-r--r-- 1 icemo staff 6230016 Mar 7 01:20 store.db
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 version.ent
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 xsl
./disk0.dmg.carve_nodes.extracted/unknown/174/Grapher:
./disk0.dmg.carve_nodes.extracted/unknown/174/LantingheiTC-Extralight.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NetSNMP:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansAvestan-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansBalinese-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansBamum-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansBatak-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansBrahmi-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansBuginese-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansBuhid-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansChakma-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansCham-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansCoptic-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansCuneiform-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansEgyptianHieroglyphs-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansGlagolitic-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansInscriptionalPahlavi-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansJavanese-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansKaithi-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansKharoshthi-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansLepcha-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansLinearB-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansLisu-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansLycian-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansLydian-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansMandaic-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansMeeteiMayek-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansMongolian-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansNKo-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansNewTaiLue-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansOgham-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansOldItalic-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansOldPersian-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansOldSouthArabian-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansPhagsPa-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansRunic-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansSamaritan-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansSaurashtra-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansSundanese-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansSylotiNagri-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansSyriacEastern-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansTagalog-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansTagbanwa-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansTaiLe-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansTaiTham-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansTaiViet-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansThaana-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansTifinagh-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansVai-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/NotoSansYi-Regular.ttf:
./disk0.dmg.carve_nodes.extracted/unknown/174/PreferencePanes:
./disk0.dmg.carve_nodes.extracted/unknown/174/Preferences:
./disk0.dmg.carve_nodes.extracted/unknown/174/SNMP:
./disk0.dmg.carve_nodes.extracted/unknown/174/Video:
./disk0.dmg.carve_nodes.extracted/unknown/174/WebServer:
./disk0.dmg.carve_nodes.extracted/unknown/174/build.properties:
./disk0.dmg.carve_nodes.extracted/unknown/174/common.dtd:
./disk0.dmg.carve_nodes.extracted/unknown/174/css:
./disk0.dmg.carve_nodes.extracted/unknown/174/faq.dtd:
./disk0.dmg.carve_nodes.extracted/unknown/174/iLife:
./disk0.dmg.carve_nodes.extracted/unknown/174/iWork:
./disk0.dmg.carve_nodes.extracted/unknown/174/iWork Arabic Support:
./disk0.dmg.carve_nodes.extracted/unknown/174/lang:
./disk0.dmg.carve_nodes.extracted/unknown/174/lang.dtd:
./disk0.dmg.carve_nodes.extracted/unknown/174/latex:
./disk0.dmg.carve_nodes.extracted/unknown/174/manualpage.dtd:
./disk0.dmg.carve_nodes.extracted/unknown/174/modulesynopsis.dtd:
./disk0.dmg.carve_nodes.extracted/unknown/174/scripts:
./disk0.dmg.carve_nodes.extracted/unknown/174/sitemap.dtd:
./disk0.dmg.carve_nodes.extracted/unknown/174/version.ent:
./disk0.dmg.carve_nodes.extracted/unknown/174/xsl:
./disk0.dmg.carve_nodes.extracted/unknown/177:
total 176
-rw-r--r-- 1 icemo staff 1370 Mar 7 01:20 .MASManifest
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 .Spotlight-V100
-rw-r--r-- 1 icemo staff 63096 Mar 7 01:20 0000000000c38f51
-rw-r--r-- 1 icemo staff 71 Mar 7 01:20 0000000000c38f52
-rw-r--r-- 1 icemo staff 284 Mar 7 01:20 PartNumber.plist
./disk0.dmg.carve_nodes.extracted/unknown/177/.Spotlight-V100:
./disk0.dmg.carve_nodes.extracted/unknown/181:
total 35440
-rw-r--r--@ 1 icemo staff 6148 Mar 7 01:41 .DS_Store
-rw-r--r-- 1 icemo staff 10293248 Mar 7 01:20 .store.db
-rw-r--r-- 1 icemo staff 71 Mar 7 01:20 activityJournal.1
-rw-r--r-- 1 icemo staff 65536 Mar 7 01:20 live.0.directoryStoreFile
-rw-r--r-- 1 icemo staff 786432 Mar 7 01:20 live.0.indexArrays
-rw-r--r-- 1 icemo staff 16384 Mar 7 01:20 live.0.indexBigDates
-rw-r--r-- 1 icemo staff 2048 Mar 7 01:20 live.0.indexCompactDirectory
-rw-r--r-- 1 icemo staff 8224 Mar 7 01:20 live.0.indexDirectory
-rw-r--r-- 1 icemo staff 3277 Mar 7 01:20 live.0.indexGroups
-rw-r--r-- 1 icemo staff 32768 Mar 7 01:20 live.0.indexIds
-rw-r--r-- 1 icemo staff 262144 Mar 7 01:20 live.0.indexPositionTable
-rw-r--r-- 1 icemo staff 4096 Mar 7 01:20 live.0.indexPositions
-rw-r--r-- 1 icemo staff 131072 Mar 7 01:20 live.0.indexPostings
-rw-r--r-- 1 icemo staff 262144 Mar 7 01:20 live.0.indexTermIds
-rw-r--r-- 1 icemo staff 6230016 Mar 7 01:20 store.db
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 tmp.Lion
drwxr-xr-x 2 icemo staff 68 Mar 7 01:20 tmp.SnowLeopard
./disk0.dmg.carve_nodes.extracted/unknown/181/tmp.Lion:
./disk0.dmg.carve_nodes.extracted/unknown/181/tmp.SnowLeopard:
Well, thanks for your time and efforts on this, you have been very helpful. It appears that the damage is too great, though, and that I'll have to be satisfied with the unstructured mess of files that PhotoRec recovered. So it is. I do have a Time Machine backup but, for various totally unjustifiable reasons, I have not been using it for the last couple of months. Stupid mistake on my part.
Extracting files now skips files that cannot be saved (#17). This should prevent errors like the one you had.
Thanks for all your feedback by the way.
You're welcome for the feedback and thank you for the quick updates. As I said in my first message, I was looking for info on APFS and Fusion Drives and wasn't really finding a lot. I started to feel a bit like patient zero. Everyone else having problems with Fusion Drives seems to have bungled a Bootcamp install. Interesting but, as far as I can figure out, not helpful to my case.
As for this run: Unfortunately, the result is the same as the last run. The message has a different format, though.
WARNING Could not save disk0.dmg.carve_nodes.extracted: [Errno 1] Operation not permitted: '/.Spotlight-V100/VolumeConfiguration.plist'
The bodyfile is still 41.3 MB and the recovered files are again 2.24 GB in size.
Interestingly, and this must be specific to my case, the last INFO
message is always:
INFO Found nodes in block 8181582
I guess Afro is getting hung up on whatever is in that block which is unfortunate because it comes fairly early in the process—after reading about 32 GB of data—but it continues to run until it's read through the entire 2 TB image before outputting anything.
Of no real importance, I did finally manage to get Mactime to output a spreadsheet file. I'll claim it as a small victory.
The warning is expected, but afro does not fail in this step anymore.
Ok, so, basically, what I've recovered so far is as much as can be recovered.
Alright, thanks for all of your time and help on this but it looks like what is gone is really gone.
So it is.
Moral of the story: Back up your data kids, early and often (and then make a second set and keep it offsite).
hi, i'm in the same situation now.
what i did is below
$ mmls ../img/nsanomac4_ssd.img
GUID Partition Table (EFI)
Offset Sector: 0
Units are in 512-byte sectors
Slot Start End Length Description
000: Meta 0000000000 0000000000 0000000001 Safety Table
001: ------- 0000000000 0000000039 0000000040 Unallocated
002: Meta 0000000001 0000000001 0000000001 GPT Header
003: Meta 0000000002 0000000033 0000000032 Partition Table
004: 000 0000000040 0000409639 0000409600 EFI System Partition
005: 001 0000409640 0236978135 0236568496 Customer
006: ------- 0236978136 0236978175 0000000040 Unallocated
$ afro -o 409640 -e files -m carve -c nodes ../img/nsanomac4_ssd.img
INFO Found nodes in block 449
INFO Found nodes in block 452
INFO Found nodes in block 861
:
it stopped at following console output like
:
INFO Found nodes in block 28722581
INFO Found nodes in block 28722664
WARNING Could not save nsanomac4_ssd.img.carve_nodes.extracted: [Errno 30] Read-only file system: '/Nintendo - Super Nintendo Entertainment System'
current directory list are
$ ls -l
total 930544
-rw-r--r-- 1 nsano staff 952870834 2021-01-20 13:46 nsanomac4_ssd.img.carve_nodes.bodyfile
drwxr-xr-x 3 nsano staff 102 2021-01-20 13:46 nsanomac4_ssd.img.carve_nodes.extracted
and extracted files are never increased.
$ tree nsanomac4_ssd.img.carve_nodes.extracted
:
├── Chrono Trigger.txt
└── Nintendo - Super Nintendo Entertainment System
10 directories, 836 files
bodyfile seems good.
$ wc -l nsanomac4_ssd.img.carve_nodes.bodyfile
7241864 nsanomac4_ssd.img.carve_nodes.bodyfile
i have to open my imac for never responded split fusion hdd from now...
regards
I have some questions, rather than an issue, that I'd love to get some help with. If this isn't the proper forum for that, please let me know. I have been searching for information regarding APFS data recovery and am having a hard time finding any.
For brevity, I'll start by pasting the output of mmls of disk4, a clone (created with DDRescue) of disk0, the HD portion of a Fusion Drive that, due to catastrophic failure, is now missing its SSD portion.
The ~2 TB of data from the HD has been cloned to a 5 TB USB external drive. Partition number 005 contains data that I want to retrieve. In
diskutil
the type for 005 is listed as Apple_APFS.I looked at TestDisk but it doesn't seem capable of dealing with APFS. I did run PhotoRec and was able to recover ~1.3 million files but, of course, they did not have their original files names and there is no file structure anymore. This is helpful but not so optimal.
Then I found and installed Afro (and Sleuthkit) and experimented with the example you provided, wsdf.dmg. That worked well although I have to admit I cannot for the life of me figure out how to output the bodyfile in some sort of human readable form. That's not important, though.
So, my questions are:
If there is more information you need or I have not been clear enough, please, don't hesitate to ask.
Any help you are able to provide with these questions is greatly appreciated and thanks for your time and efforts on this matter.