Hello. I need help with recoverting filesystem that was broken due to some strange incident.
My brother had a laptop with significant uptime with installed macOS. At some point of time it freezed during normal work, then it was rebooted and it was not booting at all. I tried to boot it from live linux flash, it booted successfully.
In conclusion to this, the main problem was that partition table was clean. I tried to restore partiton table and it was successful. There was a partition with GRUB (working flawlessly) and partition with macOS. Then I tried to boot macOS partiton, Apple logo appeared on screen and it just rebooted. Then, it stopped booting (Apple logo for short time and then reboot).
Then I did backup of internal ssd to a file on external ssd in order to recover it some time later and reinstalled the OS on that laptop.
So, I tried using this utility to restore, but I couldn't do anything valuable. As I said, I have a backup (of whole disk), so I did a little patch to read_blocks and write_blocks functions in order to skip blocks till the actual APFS filesystem.
Output of sudo fdisk -lu /mnt/i/disk.img:
Disk /mnt/i/disk.img: 223.58 GiB, 240057409536 bytes, 468862128 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 80312927-28A9-8031-441F-3180EF1D3180
Device Start End Sectors Size Type
/mnt/i/disk.img1 2048 391167 389120 190M EFI System
/mnt/i/disk.img2 1050624 1460223 409600 200M EFI System
/mnt/i/disk.img3 2099200 280119295 278020096 132.6G unknown
Opening file at `/mnt/i/disk.img` in read-only mode ... OK.
Reading block 0x0 ... validating ... OK.
Details of block 0x0:
--------------------------------------------------------------------------------
Stored checksum: 0xbe7e7ebf4157b036
OID: 0x1
XID: 0x2ee68d
Storage type: Ephemeral
Type flags: (none)
Type: Container superblock
Subtype: (invalid type / no subtype)
Keybag location: first block 0x15aeaeb, spans 1 (0x1) blocks (last block 0x15aeaeb)
Media keybag location: none (spans 0 blocks)
Magic string: NXSB
Latest version of Apple APFS software that mounted this container: 1284.305.552.845.64
Block size: 4096 bytes
Block count: 34752512 (last block 0x21247ff)
Supported features:
- No feature flags are set.
Supported read-only compatible features:
- No read-only compatible feature flags are set.
Backward-incompatible features:
- No backward-incompatible feature flags are set.
UUID: 0xe35aafc02f3cffbe244bde8093a8a0d5
Next OID: 0x3ab99d
Next XID: 0x2ee68e
Space manager Ephemeral OID: 0x1ba2b
Object map Physical OID: 0x81494
Reaper Ephemeral OID: 0x401
Other flags:
- No other flags are set.
--------------------------------------------------------------------------------
END: All done.
Output of ./drat inspect /mnt/i/disk.img:
Opening file at `/mnt/i/disk.img` in read-only mode ... OK.
Simulating a mount of the APFS container.
Validating checksum of block 0x0 ... OK.
Details of block 0x0:
--------------------------------------------------------------------------------
Stored checksum: 0xbe7e7ebf4157b036
OID: 0x1
XID: 0x2ee68d
Storage type: Ephemeral
Type flags: (none)
Type: Container superblock
Subtype: (invalid type / no subtype)
Keybag location: first block 0x15aeaeb, spans 1 (0x1) blocks (last block 0x15aeaeb)
Media keybag location: none (spans 0 blocks)
Magic string: NXSB
Latest version of Apple APFS software that mounted this container: 1284.305.552.845.64
Block size: 4096 bytes
Block count: 34752512 (last block 0x21247ff)
Supported features:
- No feature flags are set.
Supported read-only compatible features:
- No read-only compatible feature flags are set.
Backward-incompatible features:
- No backward-incompatible feature flags are set.
UUID: 0xe35aafc02f3cffbe244bde8093a8a0d5
Next OID: 0x3ab99d
Next XID: 0x2ee68e
Space manager Ephemeral OID: 0x1ba2b
Object map Physical OID: 0x81494
Reaper Ephemeral OID: 0x401
Other flags:
- No other flags are set.
--------------------------------------------------------------------------------
Locating the checkpoint descriptor area:
- Its length is 280 blocks.
- It is contiguous.
- The address of its first block is 0xeb6e.
Loading the checkpoint descriptor area into memory ... OK.
Locating the most recent well-formed container superblock in the checkpoint descriptor area:
- !! APFS ERROR !! Block at index 90 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 91 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 92 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 93 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 94 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 95 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 96 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 97 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 98 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 99 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 100 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 102 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 103 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 104 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 105 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 106 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 107 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 108 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 109 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 110 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 111 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 112 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 113 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 114 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 115 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 116 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 117 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 118 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 119 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 120 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 121 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 122 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 124 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 125 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 126 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 128 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 129 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 130 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 131 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 132 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 134 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 135 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 136 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 138 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 139 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 140 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 141 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 142 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 144 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 145 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 146 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 147 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 148 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 150 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 151 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 152 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 153 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 154 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 155 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 156 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 157 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 158 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 159 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 160 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 162 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 163 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 164 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 165 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 166 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 167 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 168 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 169 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 170 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 171 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 172 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 173 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 174 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 175 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 176 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 177 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 178 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 180 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 181 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 182 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 183 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 184 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 185 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 186 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 187 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 188 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 190 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 191 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 192 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 193 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 194 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 196 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 198 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 199 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 200 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 201 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 202 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 203 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 204 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 206 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 207 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 208 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 209 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 210 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 211 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 212 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 214 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 215 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 216 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 217 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 218 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 219 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 220 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 221 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 222 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 223 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 224 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 226 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 228 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 229 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 230 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 231 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 232 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 234 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 235 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 236 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 237 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 238 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 239 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 240 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 241 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 242 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 243 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 244 within this area is not a container superblock or checkpoint map. Skipping it.
- It lies at index 257 within the checkpoint descriptor area.
Details of this container superblock:
--------------------------------------------------------------------------------
Stored checksum: 0x1e15440ae1a21c55
OID: 0x1
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: Container superblock
Subtype: (invalid type / no subtype)
Keybag location: first block 0x15aeaeb, spans 1 (0x1) blocks (last block 0x15aeaeb)
Media keybag location: none (spans 0 blocks)
Magic string: NXSB
Latest version of Apple APFS software that mounted this container: 1284.305.552.845.64
Block size: 4096 bytes
Block count: 34752512 (last block 0x21247ff)
Supported features:
- No feature flags are set.
Supported read-only compatible features:
- No read-only compatible feature flags are set.
Backward-incompatible features:
- No backward-incompatible feature flags are set.
UUID: 0xe35aafc02f3cffbe244bde8093a8a0d5
Next OID: 0x3b2cb2
Next XID: 0x2f7231
Space manager Ephemeral OID: 0x1ba2b
Object map Physical OID: 0x86e8d
Reaper Ephemeral OID: 0x401
Other flags:
- No other flags are set.
--------------------------------------------------------------------------------
- The corresponding checkpoint starts at index 256 within the checkpoint descriptor area, and spans 2 blocks.
Loading the corresponding checkpoint ... OK.
Details of each block in this checkpoint:
--------------------------------------------------------------------------------
Stored checksum: 0x8f5a4fc4afd76291
OID: 0xec6e
XID: 0x2f7230
Storage type: Physical
Type flags: (none)
Type: Checkpoint map
Subtype: (invalid type / no subtype)
Flags:
- Last checkpoint-mapping block in the corresponding checkpoint.
Number of mappings: 7
--------------------------------------------------------------------------------
Stored checksum: 0x1e15440ae1a21c55
OID: 0x1
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: Container superblock
Subtype: (invalid type / no subtype)
Keybag location: first block 0x15aeaeb, spans 1 (0x1) blocks (last block 0x15aeaeb)
Media keybag location: none (spans 0 blocks)
Magic string: NXSB
Latest version of Apple APFS software that mounted this container: 1284.305.552.845.64
Block size: 4096 bytes
Block count: 34752512 (last block 0x21247ff)
Supported features:
- No feature flags are set.
Supported read-only compatible features:
- No read-only compatible feature flags are set.
Backward-incompatible features:
- No backward-incompatible feature flags are set.
UUID: 0xe35aafc02f3cffbe244bde8093a8a0d5
Next OID: 0x3b2cb2
Next XID: 0x2f7231
Space manager Ephemeral OID: 0x1ba2b
Object map Physical OID: 0x86e8d
Reaper Ephemeral OID: 0x401
Other flags:
- No other flags are set.
--------------------------------------------------------------------------------
Details of each checkpoint-mapping in this checkpoint:
--------------------------------------------------------------------------------
Ephemeral OID: 0x401
Logical block address on disk: 0xa357
Object type: Container reaper
Object subtype: (invalid type / no subtype)
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
Ephemeral OID: 0x405
Logical block address on disk: 0xa358
Object type: B-tree (root node)
Object subtype: Space manager free-space queue
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
Ephemeral OID: 0x1ba2b
Logical block address on disk: 0xa359
Object type: Space manager
Object subtype: (invalid type / no subtype)
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
Ephemeral OID: 0x1ba2c
Logical block address on disk: 0xa35a
Object type: B-tree (root node)
Object subtype: Space manager free-space queue
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
Ephemeral OID: 0x1f31ce
Logical block address on disk: 0xa35b
Object type: Container reaper list
Object subtype: (invalid type / no subtype)
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
Ephemeral OID: 0x3b2c4c
Logical block address on disk: 0xa35c
Object type: B-tree (non-root) node
Object subtype: Space manager free-space queue
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
Ephemeral OID: 0x3b2cb1
Logical block address on disk: 0xa35d
Object type: B-tree (non-root) node
Object subtype: Space manager free-space queue
Object size: 4096 bytes
Associated volume OID (virtual): 0x0
--------------------------------------------------------------------------------
- There are 7 checkpoint-mappings in this checkpoint.
Reading the Ephemeral objects used by this checkpoint ... OK.
Validating the Ephemeral objects ... OK.
Details of the Ephemeral objects:
--------------------------------------------------------------------------------
Stored checksum: 0x3592977509ff0787
OID: 0x401
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: Container reaper
Subtype: (invalid type / no subtype)
--------------------------------------------------------------------------------
Stored checksum: 0x31179a253b7fcee7
OID: 0x405
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: B-tree (root node)
Subtype: Space manager free-space queue
--------------------------------------------------------------------------------
Stored checksum: 0x5f3da7a8cf940dba
OID: 0x1ba2b
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: Space manager
Subtype: (invalid type / no subtype)
--------------------------------------------------------------------------------
Stored checksum: 0x9be909fb8afb5e3a
OID: 0x1ba2c
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: B-tree (root node)
Subtype: Space manager free-space queue
--------------------------------------------------------------------------------
Stored checksum: 0x04ba53adb11307c8
OID: 0x1f31ce
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: Container reaper list
Subtype: (invalid type / no subtype)
--------------------------------------------------------------------------------
Stored checksum: 0x3e0ec125e13eb47f
OID: 0x3b2c4c
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: B-tree (non-root) node
Subtype: Space manager free-space queue
--------------------------------------------------------------------------------
Stored checksum: 0x5abfeca701b91ca8
OID: 0x3b2cb1
XID: 0x2f7230
Storage type: Ephemeral
Type flags: (none)
Type: B-tree (non-root) node
Subtype: Space manager free-space queue
--------------------------------------------------------------------------------
The container superblock states that the container object map has Physical OID 0x86e8d.
Loading the container object map ... OK.
Validating the container object map ... OK.
Details of the container object map:
--------------------------------------------------------------------------------
Stored checksum: 0x4009e914ffb5c77b
OID: 0x86e8d
XID: 0x2f7230
Storage type: Physical
Type flags: (none)
Type: Object map
Subtype: (invalid type / no subtype)
Flags:
- No snapshot support
Object mappings tree:
- Storage type: Physical
- Type flags: (none)
- Type: B-tree (root node)
- Object ID: 0x86ea2
Snapshots tree:
- Storage type: Physical
- Type flags: (none)
- Type: B-tree (root node)
- Object ID: 0x0
- Number of snapshots: 0 snapshots
- Latest snapshot XID: 0x0
In-progress revert:
- Minimum XID: 0x0
- Maximum XID: 0x0
--------------------------------------------------------------------------------
Reading the root node of the container object map B-tree ... OK.
Validating the root node of the container object map B-tree ... OK.
Details of the container object map B-tree:
--------------------------------------------------------------------------------
Stored checksum: 0x78aa74943537cdd9
OID: 0x86ea2
XID: 0x2f7230
Storage type: Physical
Type flags: (none)
Type: B-tree (root node)
Subtype: Object map
Flags: Root node, Leaf node, Fixed size for keys and values
Number of child levels: 0
Number of keys in this node: 5
Location of table of contents:
- Offset from start of node data area: 0x0 = 0
- Length (bytes): 0x1c0 = 448
Location of key�value shared free space:
- Offset from start of keys area: 0x60 = 96
- Length (bytes): 0xd20 = 3360
Info relating to the entire B-tree:
- Flags:
- This B-tree is currently undergoing a series of sequential inserts --- optimise operations if possible
- Child nodes are referred to using Physical OIDs
- Node size: 4096 bytes
- Key size: 16 bytes
- Value size: 16 bytes
- Length of longest key: 16 bytes
- Length of longest value: 16 bytes
- Number of keys: 5
- Number of nodes: 1
--------------------------------------------------------------------------------
The container superblock lists 5 APFS volumes, whose superblocks have the following Virtual OIDs:
- 0x402
- 0x408
- 0x40a
- 0x40c
- 0x44c
Reading the APFS volume superblocks ... OK.
Validating the APFS volume superblocks ... OK.
Details of these volume superblocks:
--------------------------------------------------------------------------------
Stored checksum: 0xb2f848ccc24d0259
OID: 0x402
XID: 0x2f722f
Storage type: Virtual
Type flags: (none)
Type: APFS volume
Subtype: (invalid type / no subtype)
Magic string: APSB
Index within container volume array: 0
Volume name: ### macOS - Data ###
Role: Data (contains mutable data)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
- This volume supports mounting a system and data volume as a single user-visible volume.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.
- At least one snapshot with no data exists for this volume.
Last unmount time: Sun Jan 17 18:33:00 2021
Last modification time: Tue Jan 26 16:57:40 2021
Reserved blocks: 0 blocks
Block quota: 0 blocks
Allocated blocks: 27423593 blocks
Volume object map Physical OID: 0x832be
Root tree info:
- OID: 0x404
- Storage type: Virtual
- Type flags: (none)
- Object type: B-tree (root node)
Extent-reference tree info:
- OID: 0x821fc
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
Snapshot metadata tree info:
- OID: 0xd5446
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
On next mount, revert to:
- snapshot with this XID: 0x0
- APFS volume superblock with this Physical OID: 0x0
Next file-system object ID that will be assigned: 0x1e9c7d2
Next document ID that will be assigned: 0x9c
Number of:
- regular files: 1031200
- directories: 175840
- symbolic links: 42650
- other file-system objects: 74
- snapshots: 0
- block allocations ever made: 781445649
- block liberations ever made: 754153816
UUID: 0xe81812b2d15ac9a3674004f9f781f183
--------------------------------------------------------------------------------
Stored checksum: 0xd29310dd1db977fc
OID: 0x408
XID: 0x2365cf
Storage type: Virtual
Type flags: (none)
Type: APFS volume
Subtype: (invalid type / no subtype)
Magic string: APSB
Index within container volume array: 1
Volume name: ### Preboot ###
Role: Preboot (contains files needed to boot from an encrypted volumes)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.
Last unmount time: Sat Jul 4 13:27:02 2020
Last modification time: Sat Jul 4 13:27:02 2020
Reserved blocks: 0 blocks
Block quota: 0 blocks
Allocated blocks: 20644 blocks
Volume object map Physical OID: 0xeafdd
Root tree info:
- OID: 0x409
- Storage type: Virtual
- Type flags: (none)
- Object type: B-tree (root node)
Extent-reference tree info:
- OID: 0xeafd6
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
Snapshot metadata tree info:
- OID: 0x3a9c6
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
On next mount, revert to:
- snapshot with this XID: 0x0
- APFS volume superblock with this Physical OID: 0x0
Next file-system object ID that will be assigned: 0x4e0
Next document ID that will be assigned: 0x3
Number of:
- regular files: 63
- directories: 19
- symbolic links: 0
- other file-system objects: 0
- snapshots: 0
- block allocations ever made: 791584
- block liberations ever made: 770957
UUID: 0xc3b904e6ab5bd0941c4e662e9248c197
--------------------------------------------------------------------------------
Stored checksum: 0x05266ee88c8ca6bb
OID: 0x40a
XID: 0x2ee6cc
Storage type: Virtual
Type flags: (none)
Type: APFS volume
Subtype: (invalid type / no subtype)
Magic string: APSB
Index within container volume array: 2
Volume name: ### Recovery ###
Role: Recovery (contains a recovery system)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.
Last unmount time: Sun Jan 17 18:36:22 2021
Last modification time: Sat Jul 4 10:20:15 2020
Reserved blocks: 0 blocks
Block quota: 0 blocks
Allocated blocks: 128924 blocks
Volume object map Physical OID: 0xd4182
Root tree info:
- OID: 0x40b
- Storage type: Virtual
- Type flags: (none)
- Object type: B-tree (root node)
Extent-reference tree info:
- OID: 0x86d2b
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
Snapshot metadata tree info:
- OID: 0x3a9cd
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
On next mount, revert to:
- snapshot with this XID: 0x0
- APFS volume superblock with this Physical OID: 0x0
Next file-system object ID that will be assigned: 0xb1
Next document ID that will be assigned: 0x3
Number of:
- regular files: 38
- directories: 5
- symbolic links: 0
- other file-system objects: 0
- snapshots: 0
- block allocations ever made: 515466
- block liberations ever made: 386552
UUID: 0xb185c57b0f2931b557477d8852a55bb9
--------------------------------------------------------------------------------
Stored checksum: 0x1a170217e4c43227
OID: 0x40c
XID: 0x2ee90d
Storage type: Virtual
Type flags: (none)
Type: APFS volume
Subtype: (invalid type / no subtype)
Magic string: APSB
Index within container volume array: 3
Volume name: ### VM ###
Role: Virtual memory (used as swap space for virtual memory)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.
Last unmount time: Sun Jan 17 18:32:58 2021
Last modification time: Mon Jan 18 19:46:30 2021
Reserved blocks: 0 blocks
Block quota: 0 blocks
Allocated blocks: 262436 blocks
Volume object map Physical OID: 0x8df33
Root tree info:
- OID: 0x40d
- Storage type: Virtual
- Type flags: (none)
- Object type: B-tree (root node)
Extent-reference tree info:
- OID: 0x8faa6
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
Snapshot metadata tree info:
- OID: 0x3a988
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
On next mount, revert to:
- snapshot with this XID: 0x0
- APFS volume superblock with this Physical OID: 0x0
Next file-system object ID that will be assigned: 0x2f7
Next document ID that will be assigned: 0x3
Number of:
- regular files: 2
- directories: 0
- symbolic links: 0
- other file-system objects: 0
- snapshots: 0
- block allocations ever made: 165937152
- block liberations ever made: 165674752
UUID: 0x396d64c8eb1ed2aa3c41348f9159efa3
--------------------------------------------------------------------------------
Stored checksum: 0x48aa47a9e2f13984
OID: 0x44c
XID: 0x2f7230
Storage type: Virtual
Type flags: (none)
Type: APFS volume
Subtype: (invalid type / no subtype)
Magic string: APSB
Index within container volume array: 4
Volume name: ### macOS ###
Role: System (contains a root directory for the system)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
- This volume supports mounting a system and data volume as a single user-visible volume.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.
- At least one snapshot with no data exists for this volume.
Last unmount time: Wed Apr 22 18:14:44 2020
Last modification time: Fri Jan 29 21:35:12 2021
Reserved blocks: 0 blocks
Block quota: 0 blocks
Allocated blocks: 2756218 blocks
Volume object map Physical OID: 0x819fd
Root tree info:
- OID: 0x44d
- Storage type: Virtual
- Type flags: (none)
- Object type: B-tree (root node)
Extent-reference tree info:
- OID: 0x8687f
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
Snapshot metadata tree info:
- OID: 0xd5384
- Storage type: Physical
- Type flags: (none)
- Object type: B-tree (root node)
On next mount, revert to:
- snapshot with this XID: 0x0
- APFS volume superblock with this Physical OID: 0x0
Next file-system object ID that will be assigned: 0xfffffff000affd2
Next document ID that will be assigned: 0x3
Number of:
- regular files: 372740
- directories: 108851
- symbolic links: 6524
- other file-system objects: 0
- snapshots: 0
- block allocations ever made: 5391813
- block liberations ever made: 2684437
UUID: 0x6b89045f599234a5e84df68c9592fc86
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Simulating a mount of volume 0 (macOS - Data).
The volume object map has Physical OID 0x832be.
Reading the volume object map ... OK.
Validating the volume object map ... OK.
Details of the volume object map:
--------------------------------------------------------------------------------
Stored checksum: 0x3e3d32620182f222
OID: 0x832be
XID: 0x2f722f
Storage type: Physical
Type flags: (none)
Type: Object map
Subtype: (invalid type / no subtype)
Flags:
- No flags are set.
Object mappings tree:
- Storage type: Physical
- Type flags: (none)
- Type: B-tree (root node)
- Object ID: 0x8367f
Snapshots tree:
- Storage type: Physical
- Type flags: (none)
- Type: B-tree (root node)
- Object ID: 0x0
- Number of snapshots: 0 snapshots
- Latest snapshot XID: 0x0
In-progress revert:
- Minimum XID: 0x0
- Maximum XID: 0x0
--------------------------------------------------------------------------------
Reading the root node of the volume object map B-tree ... OK.
Validating the root node of the volume object map B-tree ... OK.
Details of the volume object map B-tree:
--------------------------------------------------------------------------------
Stored checksum: 0x86f7c9abb59b2762
OID: 0x8367f
XID: 0x2f722f
Storage type: Physical
Type flags: (none)
Type: B-tree (root node)
Subtype: Object map
Flags: Root node, Fixed size for keys and values
Number of child levels: 2
Number of keys in this node: 18
Location of table of contents:
- Offset from start of node data area: 0x0 = 0
- Length (bytes): 0x240 = 576
Location of key�value shared free space:
- Offset from start of keys area: 0x3e0 = 992
- Length (bytes): 0x790 = 1936
Info relating to the entire B-tree:
- Flags:
- This B-tree is currently undergoing a series of sequential inserts --- optimise operations if possible
- Child nodes are referred to using Physical OIDs
- Node size: 4096 bytes
- Key size: 16 bytes
- Value size: 16 bytes
- Length of longest key: 16 bytes
- Length of longest value: 16 bytes
- Number of keys: 114773
- Number of nodes: 1580
--------------------------------------------------------------------------------
The file-system tree root for this volume has Virtual OID 0x404.
Looking up this Virtual OID in the volume object map ... corresponding block address is 0x846d2.
Reading ... validating ... OK.
Details of the file-system B-tree root node:
--------------------------------------------------------------------------------
Stored checksum: 0x6eef9918862ccec8
OID: 0x404
XID: 0x2f722f
Storage type: Virtual
Type flags: (none)
Type: B-tree (root node)
Subtype: File-system records tree
Flags: Root node
Number of child levels: 3
Number of keys in this node: 17
Location of table of contents:
- Offset from start of node data area: 0x0 = 0
- Length (bytes): 0xc0 = 192
Location of key�value shared free space:
- Offset from start of keys area: 0x68d = 1677
- Length (bytes): 0x783 = 1923
Info relating to the entire B-tree:
- Flags:
- This B-tree is currently undergoing a series of sequential inserts --- optimise operations if possible
- 8-byte alignment of keys and values is not required
- Node size: 4096 bytes
- Key size: 0 bytes
- Value size: 0 bytes
- Length of longest key: 208 bytes
- Length of longest value: 2973 bytes
- Number of keys: 4807374
- Number of nodes: 114772
--------------------------------------------------------------------------------
0xa64b2:
ABORT: get_fs_records: Checksum of node at block 0xd326c did not validate.
Also, I tried using search command and I found out that there are references to files in data partition - I can find some source files. What about other filesystems - they're easily readable, but there are no any useful data.
So, there's the following APFS volumes:
Volume list
================
0: macOS - Data
1: Preboot
2: Recovery
3: VM
4: macOS
Volumes 4 is readable:
Records for file-system object 0x2 -- `/` --
- INODE
- DIR REC || Dirctry || target ID = 0xfffffff0007e5a3 || name = EFI-Backups
- DIR REC || Dirctry || target ID = 0xfffffff0000001f || name = usr
- DIR REC || RegFile || target ID = 0xfffffff00005837 || name = .DS_Store
- DIR REC || Dirctry || target ID = 0xfffffff00005838 || name = bin
- DIR REC || Dirctry || target ID = 0xfffffff00005881 || name = sbin
- DIR REC || RegFile || target ID = 0xfffffff000058e7 || name = .file
- DIR REC || Symlink || target ID = 0xfffffff000058e8 || name = etc
- DIR REC || Symlink || target ID = 0xfffffff0007e4db || name = var
- DIR REC || Dirctry || target ID = 0xfffffff0007e4dc || name = Library
- DIR REC || Dirctry || target ID = 0xfffffff0007e54d || name = .Trashes
- DIR REC || Dirctry || target ID = 0xfffffff000058e9 || name = System
- DIR REC || Symlink || target ID = 0xfffffff0007e4de || name = .VolumeIcon.icns
- DIR REC || Dirctry || target ID = 0xfffffff00000010 || name = .fseventsd
- DIR REC || Dirctry || target ID = 0xfffffff0007e4dd || name = private
- DIR REC || Dirctry || target ID = 0xfffffff0007e4df || name = .vol
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e6 || name = Users
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e4 || name = Applications
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e0 || name = opt
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e1 || name = dev
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e2 || name = Volumes
- DIR REC || Symlink || target ID = 0xfffffff0007e4e3 || name = tmp
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e5 || name = cores
END: All done.
But Volume 0 is not (./drat list /mnt/i/disk.img 0 /):
The volume object map has Physical OID 0x832be.
Reading the volume object map ... OK.
Validating the volume object map ... OK.
Reading the root node of the volume object map B-tree ... OK.
Validating the root node of the volume object map B-tree ... OK.
The file-system tree root for this volume has Virtual OID 0x404.
Looking up this Virtual OID in the volume object map ... corresponding block address is 0x846d2.
Reading ... validating ... OK.
No records found with OID 0x2.
I can't do literally anything with this volume. FileVault wasn't enabled.
Also, I used command search with custom filters and I found that there's files with names like index.js and etc that were stored on this volume. Trying recover-raw does not give anything useful.
Hello. I need help with recoverting filesystem that was broken due to some strange incident.
My brother had a laptop with significant uptime with installed macOS. At some point of time it freezed during normal work, then it was rebooted and it was not booting at all. I tried to boot it from live linux flash, it booted successfully. In conclusion to this, the main problem was that partition table was clean. I tried to restore partiton table and it was successful. There was a partition with GRUB (working flawlessly) and partition with macOS. Then I tried to boot macOS partiton, Apple logo appeared on screen and it just rebooted. Then, it stopped booting (Apple logo for short time and then reboot). Then I did backup of internal ssd to a file on external ssd in order to recover it some time later and reinstalled the OS on that laptop.
So, I tried using this utility to restore, but I couldn't do anything valuable. As I said, I have a backup (of whole disk), so I did a little patch to
read_blocksandwrite_blocksfunctions in order to skip blocks till the actual APFS filesystem.Output of
sudo fdisk -lu /mnt/i/disk.img:Modified code (functions read_blocks/write_blocks):
Output of
./drat read /mnt/i/disk.img 0:Output of
./drat inspect /mnt/i/disk.img:Also, I tried using
searchcommand and I found out that there are references to files in data partition - I can find some source files. What about other filesystems - they're easily readable, but there are no any useful data.So, there's the following APFS volumes:
Volumes 4 is readable:
But Volume 0 is not (
./drat list /mnt/i/disk.img 0 /):I can't do literally anything with this volume. FileVault wasn't enabled. Also, I used command
searchwith custom filters and I found that there's files with names likeindex.jsand etc that were stored on this volume. Tryingrecover-rawdoes not give anything useful.Any suggestions? Thank you.