search

jivanpal / drat

Utility for performing data recovery and analysis of APFS partitions/containers.
GNU General Public License v3.0
164 stars 23 forks source link

Reading block 0x0 ... FAILED: #29

Closed rohitagre closed 3 years ago

rohitagre commented 3 years ago

Hi, My APFS container fails to mount and running first aid gives the following output.

Repairing storage system
Performing fsck_apfs -y -x /dev/disk0s2
Checking the container superblock.
Checking the space manager.
Checking the space manager free queue trees.
Checking the object map.
Checking volume.
Checking the APFS volume superblock.
Checking the object map.
error: btn: invalid key order (0) oid 2661014 / oxid 0 / level 1 / flags 0x4
    previous key: 2c 60 03 00 00 00 00 00 83 ac 00 00 00 00 00 00
    current key:  04 04 00 00 00 00 00 00 c1 b4 00 00 00 00 00 00
    next key:     4f 04 00 00 00 00 00 00 66 00 00 00 00 00 00 00
Object map is invalid.
The volume /dev/disk0s2 could not be verified completely.
Storage system check exit code is 8.
Storage system verify or repair failed. : (-69716)

Operation failed…

When i run drat inspect /dev/disk5s1 i get the following output

drat-0.1.3 % sudo ./drat inspect /dev/disk5s1  
Opening file at `/dev/disk5s1` in read-only mode ... OK.
Simulating a mount of the APFS container.
Reading container superblock at address 0x0, assuming default block size of 4096 bytes ... FAILED: read_blocks: An unknown error occurred whilst reading from the stream.
ABORT: Failed to successfully read block 0x0.

Output of diskutil list and diskutil apfs list is attached below

drat-0.1.3 % diskutil list
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *1.0 TB     disk0
   1:                        EFI ⁨EFI⁩                     209.7 MB   disk0s1
   2:                 Apple_APFS ⁨Container disk5⁩         1000.0 GB  disk0s2

/dev/disk1 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *500.1 GB   disk1
   1:                        EFI ⁨EFI⁩                     209.7 MB   disk1s1
   2:                 Apple_APFS ⁨Container disk3⁩         499.9 GB   disk1s2

/dev/disk2 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     FDisk_partition_scheme                        *120.0 GB   disk2
   1:                  Apple_HFS ⁨vbox⁩                    120.0 GB   disk2s1

/dev/disk3 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +499.9 GB   disk3
                                 Physical Store disk1s2
   1:                APFS Volume ⁨Home - Data⁩             168.7 GB   disk3s1
   2:                APFS Volume ⁨Home⁩                    15.3 GB    disk3s2
   3:              APFS Snapshot ⁨com.apple.os.update-...⁩ 15.3 GB    disk3s2s1
   4:                APFS Volume ⁨Preboot⁩                 508.1 MB   disk3s3
   5:                APFS Volume ⁨Recovery⁩                625.7 MB   disk3s4
   6:                APFS Volume ⁨VM⁩                      2.1 GB     disk3s5

/dev/disk4 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     FDisk_partition_scheme                        *500.1 GB   disk4
   1:                  Apple_HFS ⁨Media⁩                   500.1 GB   disk4s1

/dev/disk5 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +1000.0 GB  disk5
                                 Physical Store disk0s2
   1:                APFS Volume ⁨Other⁩                   349.9 GB   disk5s1
drat-0.1.3 % diskutil apfs list
APFS Containers (2 found)
|
+-- Container disk3 441E001F-0596-4B99-A975-332968F2DC9A
|   ====================================================
|   APFS Container Reference:     disk3
|   Size (Capacity Ceiling):      499898105856 B (499.9 GB)
|   Capacity In Use By Volumes:   187464822784 B (187.5 GB) (37.5% used)
|   Capacity Not Allocated:       312433283072 B (312.4 GB) (62.5% free)
|   |
|   +-< Physical Store disk1s2 65A0CD99-7EF7-460B-A485-26D09C2FAFEA
|   |   -----------------------------------------------------------
|   |   APFS Physical Store Disk:   disk1s2
|   |   Size:                       499898105856 B (499.9 GB)
|   |
|   +-> Volume disk3s1 97094914-0638-41CD-9FF7-C3F187D061E3
|   |   ---------------------------------------------------
|   |   APFS Volume Disk (Role):   disk3s1 (Data)
|   |   Name:                      Home - Data (Case-insensitive)
|   |   Mount Point:               /System/Volumes/Data
|   |   Capacity Consumed:         168678100992 B (168.7 GB)
|   |   Sealed:                    No
|   |   FileVault:                 No
|   |
|   +-> Volume disk3s2 2104C312-125B-4F9E-9E5C-FEE8A948FD5D
|   |   ---------------------------------------------------
|   |   APFS Volume Disk (Role):   disk3s2 (System)
|   |   Name:                      Home (Case-insensitive)
|   |   Mount Point:               Not Mounted
|   |   Capacity Consumed:         15333896192 B (15.3 GB)
|   |   Sealed:                    Broken
|   |   FileVault:                 No
|   |   |
|   |   Snapshot:                  7BD98F2F-6B3A-46DA-A4D2-348E84D51D9F
|   |   Snapshot Disk:             disk3s2s1
|   |   Snapshot Mount Point:      /
|   |   Snapshot Sealed:           Yes
|   |
|   +-> Volume disk3s3 B2CFE273-1658-46D6-9BE6-58B24F1FD3A8
|   |   ---------------------------------------------------
|   |   APFS Volume Disk (Role):   disk3s3 (Preboot)
|   |   Name:                      Preboot (Case-insensitive)
|   |   Mount Point:               /System/Volumes/Preboot
|   |   Capacity Consumed:         508104704 B (508.1 MB)
|   |   Sealed:                    No
|   |   FileVault:                 No
|   |
|   +-> Volume disk3s4 36074125-4395-4A85-AB17-B26529B4DFB7
|   |   ---------------------------------------------------
|   |   APFS Volume Disk (Role):   disk3s4 (Recovery)
|   |   Name:                      Recovery (Case-insensitive)
|   |   Mount Point:               Not Mounted
|   |   Capacity Consumed:         625659904 B (625.7 MB)
|   |   Sealed:                    No
|   |   FileVault:                 No
|   |
|   +-> Volume disk3s5 6EBCA5C6-0B82-49C8-8325-260F9034CEDA
|       ---------------------------------------------------
|       APFS Volume Disk (Role):   disk3s5 (VM)
|       Name:                      VM (Case-insensitive)
|       Mount Point:               /System/Volumes/VM
|       Capacity Consumed:         2148552704 B (2.1 GB)
|       Sealed:                    No
|       FileVault:                 No
|
+-- Container disk5 C5B66826-570B-408A-857A-F5F9E84F88CD
    ====================================================
    APFS Container Reference:     disk5
    Size (Capacity Ceiling):      999995129856 B (1000.0 GB)
    Capacity In Use By Volumes:   350252339200 B (350.3 GB) (35.0% used)
    Capacity Not Allocated:       649742790656 B (649.7 GB) (65.0% free)
    |
    +-< Physical Store disk0s2 9D99A1A0-6418-4ECD-9D93-2F12B2CEFDFE
    |   -----------------------------------------------------------
    |   APFS Physical Store Disk:   disk0s2
    |   Size:                       999995129856 B (1000.0 GB)
    |
    +-> Volume disk5s1 B312E750-E7AF-404F-B524-B56959EF3D8C
        ---------------------------------------------------
        APFS Volume Disk (Role):   disk5s1 (No specific role)
        Name:                      Other (Case-insensitive)
        Mount Point:               Not Mounted
        Capacity Consumed:         349941567488 B (349.9 GB)
        Sealed:                    No
        FileVault:                 No

Is there any way i can recover data from this drive?

jivanpal commented 3 years ago

Use disk5 instead of disk5s1 🙂

rohitagre commented 3 years ago 
drat-0.1.3 %  diskutil list
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *500.1 GB   disk0
   1:                        EFI ⁨EFI⁩                     209.7 MB   disk0s1
   2:                 Apple_APFS ⁨Container disk4⁩         499.9 GB   disk0s2

/dev/disk1 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     FDisk_partition_scheme                        *500.1 GB   disk1
   1:                  Apple_HFS ⁨Media⁩                   500.1 GB   disk1s1

/dev/disk2 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *1.0 TB     disk2
   1:                 Apple_APFS ⁨Container disk5⁩         1000.0 GB  disk2s2

/dev/disk3 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     FDisk_partition_scheme                        *120.0 GB   disk3
   1:                  Apple_HFS ⁨vbox⁩                    120.0 GB   disk3s1

/dev/disk4 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +499.9 GB   disk4
                                 Physical Store disk0s2
   1:                APFS Volume ⁨Home - Data⁩             169.8 GB   disk4s1
   2:                APFS Volume ⁨Home⁩                    15.3 GB    disk4s2
   3:              APFS Snapshot ⁨com.apple.os.update-...⁩ 15.3 GB    disk4s2s1
   4:                APFS Volume ⁨Preboot⁩                 508.1 MB   disk4s3
   5:                APFS Volume ⁨Recovery⁩                625.7 MB   disk4s4
   6:                APFS Volume ⁨VM⁩                      2.1 GB     disk4s5

/dev/disk5 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +1000.0 GB  disk5
                                 Physical Store disk2s2
   1:                APFS Volume ⁨Other⁩                   349.9 GB   disk5s1
   2:                APFS Volume ⁨Untitled2⁩               2.1 MB     disk5s2

I tried sudo ./drat inspect /dev/disk5

drat-0.1.3 % sudo ./drat inspect /dev/disk5
Password:
Opening file at `/dev/disk5` in read-only mode ... 
ABORT: Unknown error.

I also tried sudo ./drat inspect /dev/disk2

drat-0.1.3 % sudo ./drat inspect /dev/disk2
Opening file at `/dev/disk2` in read-only mode ... OK.
Simulating a mount of the APFS container.
Reading container superblock at address 0x0, assuming default block size of 4096 bytes ... Actual block size stated in container superblock is 0 bytes; re-reading block 0x0 using new block size ... ABORT: read_blocks: Unexpected beaviour --- `fread` read fewer blocks than expected, but `feof` did not report EOF and `ferror` did not detect an error.

The APFS volume Other is inaccessible. :( I created another volume on the APFS drive Untitled2 and it is working fine.

rohitagre commented 3 years ago

Success on 

drat-0.1.3 % sudo ./drat inspect /dev/disk2s2
Opening file at `/dev/disk2s2` in read-only mode ... OK.
Simulating a mount of the APFS container.
Reading container superblock at address 0x0, assuming default block size of 4096 bytes ... validating checksum ... OK.

Details of block 0x0:
--------------------------------------------------------------------------------
Stored checksum:    0x2bc86d47b8aa28b6
OID:                0x1
XID:                0xd618
Storage type:       Ephemeral
Type flags:         (no flags)
Type:               Container superblock
Subtype:            (invalid type / no subtype)
Keybag location: none (spans 0 blocks)
Media keybag location: none (spans 0 blocks)
Magic string:       NXSB
Latest version of Apple APFS software that mounted this container: 1525.359.282.613.640
Block size:         4096 bytes
Block count:        244139436 (last block 0xe8d45ab)
Supported features:
- The volumes in this container support defragmentation.
Supported read-only compatible features:
- No flags.
Backward-incompatible features:
- This container uses APFS version 2, as implemented in macOS 10.13 and iOS 10.3.
UUID:       C5B66826-570B-408A-857A-F5F9E84F88CD
Next OID:                       0x470d3
Next XID:                       0xd619
Space manager Ephemeral OID:    0x400
Object map Physical OID:        0x289c69
Reaper Ephemeral OID:           0x401
Other flags:
- No flags.
--------------------------------------------------------------------------------

Locating the checkpoint descriptor area:
- Its length is 280 blocks.
- It is contiguous.
- The address of its first block is 0x1.
Loading the checkpoint descriptor area into memory ... OK.
Locating the most recent well-formed container superblock in the checkpoint descriptor area:
- It lies at index 249 within the checkpoint descriptor area.

Details of this container superblock:
--------------------------------------------------------------------------------
Stored checksum:    0x2bcb34f2b8a76010
OID:                0x1
XID:                0xd62b
Storage type:       Ephemeral
Type flags:         (no flags)
Type:               Container superblock
Subtype:            (invalid type / no subtype)
Keybag location: none (spans 0 blocks)
Media keybag location: none (spans 0 blocks)
Magic string:       NXSB
Latest version of Apple APFS software that mounted this container: 1525.359.282.613.640
Block size:         4096 bytes
Block count:        244139436 (last block 0xe8d45ab)
Supported features:
- The volumes in this container support defragmentation.
Supported read-only compatible features:
- No flags.
Backward-incompatible features:
- This container uses APFS version 2, as implemented in macOS 10.13 and iOS 10.3.
UUID:       C5B66826-570B-408A-857A-F5F9E84F88CD
Next OID:                       0x470d3
Next XID:                       0xd62c
Space manager Ephemeral OID:    0x400
Object map Physical OID:        0x289aed
Reaper Ephemeral OID:           0x401
Other flags:
- No flags.
--------------------------------------------------------------------------------
- The corresponding checkpoint starts at index 248 within the checkpoint descriptor area, and spans 2 blocks.

Loading the corresponding checkpoint ... OK.

Details of each block in this checkpoint:
--------------------------------------------------------------------------------
Stored checksum:    0x8c355ff6b3c77c87
OID:                0xf9
XID:                0xd62b
Storage type:       Physical
Type flags:         (no flags)
Type:               Checkpoint map
Subtype:            (invalid type / no subtype)
Flags:
- Last checkpoint-mapping block in the corresponding checkpoint.
Number of mappings: 5
--------------------------------------------------------------------------------
Stored checksum:    0x2bcb34f2b8a76010
OID:                0x1
XID:                0xd62b
Storage type:       Ephemeral
Type flags:         (no flags)
Type:               Container superblock
Subtype:            (invalid type / no subtype)
Keybag location: none (spans 0 blocks)
Media keybag location: none (spans 0 blocks)
Magic string:       NXSB
Latest version of Apple APFS software that mounted this container: 1525.359.282.613.640
Block size:         4096 bytes
Block count:        244139436 (last block 0xe8d45ab)
Supported features:
- The volumes in this container support defragmentation.
Supported read-only compatible features:
- No flags.
Backward-incompatible features:
- This container uses APFS version 2, as implemented in macOS 10.13 and iOS 10.3.
UUID:       C5B66826-570B-408A-857A-F5F9E84F88CD
Next OID:                       0x470d3
Next XID:                       0xd62c
Space manager Ephemeral OID:    0x400
Object map Physical OID:        0x289aed
Reaper Ephemeral OID:           0x401
Other flags:
- No flags.
--------------------------------------------------------------------------------

Details of each checkpoint-mapping in this checkpoint:
--------------------------------------------------------------------------------
Ephemeral OID:                      0x400
Logical block address on disk:      0x6194
Object type:                        Space manager
Object subtype:                     (invalid type / no subtype)
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x401
Logical block address on disk:      0x6195
Object type:                        Container reaper
Object subtype:                     (invalid type / no subtype)
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x403
Logical block address on disk:      0x6196
Object type:                        B-tree (root node)
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x405
Logical block address on disk:      0x6197
Object type:                        B-tree (root node)
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x414
Logical block address on disk:      0x6198
Object type:                        Container reaper list
Object subtype:                     (invalid type / no subtype)
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
- There are 5 checkpoint-mappings in this checkpoint.

Reading the Ephemeral objects used by this checkpoint ... OK.
Validating the Ephemeral objects ... OK.

Details of the Ephemeral objects:
--------------------------------------------------------------------------------
Stored checksum:    0x4d5dbcf91a46872e
OID:                0x400
XID:                0xd62b
Storage type:       Ephemeral
Type flags:         (no flags)
Type:               Space manager
Subtype:            (invalid type / no subtype)
--------------------------------------------------------------------------------
Stored checksum:    0x9b8cc7d8a46c1d95
OID:                0x401
XID:                0xd62b
Storage type:       Ephemeral
Type flags:         (no flags)
Type:               Container reaper
Subtype:            (invalid type / no subtype)
--------------------------------------------------------------------------------
Stored checksum:    0xb1f81dcc9dd11b59
OID:                0x403
XID:                0xd62b
Storage type:       Ephemeral
Type flags:         (no flags)
Type:               B-tree (root node)
Subtype:            Space manager free-space queue
--------------------------------------------------------------------------------
Stored checksum:    0xaea3ab85750ee69f
OID:                0x405
XID:                0xd62b
Storage type:       Ephemeral
Type flags:         (no flags)
Type:               B-tree (root node)
Subtype:            Space manager free-space queue
--------------------------------------------------------------------------------
Stored checksum:    0x3aebaa32fe9cfb78
OID:                0x414
XID:                0xd62b
Storage type:       Ephemeral
Type flags:         (no flags)
Type:               Container reaper list
Subtype:            (invalid type / no subtype)
--------------------------------------------------------------------------------

The container superblock states that the container object map has Physical OID 0x289aed.
Loading the container object map ... OK.
Validating the container object map ... OK.

Details of the container object map:
--------------------------------------------------------------------------------
Stored checksum:    0x85f488d8b9b96b10
OID:                0x289aed
XID:                0xd62b
Storage type:       Physical
Type flags:         (no flags)
Type:               Object map
Subtype:            (invalid type / no subtype)
Flags:
- No snapshot support
Object mappings tree:
- Storage type:         Physical
- Type flags:           (no flags)
- Type:                 B-tree (root node)
- Object ID:            0x289aee
Snapshots tree:
- Storage type:         Physical
- Type flags:           (no flags)
- Type:                 B-tree (root node)
- Object ID:            0x0
- Number of snapshots:  0 snapshots
- Latest snapshot XID:  0x0
In-progress revert:
- Minimum XID:          0x0
- Maximum XID:          0x0
--------------------------------------------------------------------------------

Reading the root node of the container object map B-tree ... OK.
Validating the root node of the container object map B-tree ... OK.

Details of the container object map B-tree:
--------------------------------------------------------------------------------
Stored checksum:    0x92c6ce641cf07063
OID:                0x289aee
XID:                0xd62b
Storage type:       Physical
Type flags:         (no flags)
Type:               B-tree (root node)
Subtype:            Object map
Flags:
- Root node
- Leaf node
- Fixed size for keys and values
Number of child levels:         0
Number of keys in this node:    2
Location of table of contents:
- Offset from start of node data area:  0x0 = 0
- Length (bytes):                       0x1c0 = 448
Location of key–value shared free space:
- Offset from start of keys area:       0x30 = 48
- Length (bytes):                       0xd80 = 3456

Info relating to the entire B-tree:
- Flags:
- This B-tree is currently undergoing a series of sequential inserts --- optimise operations if possible
- Child nodes are referred to using Physical OIDs
- Node size:                4096 bytes
- Key size:                 16 bytes
- Value size:               16 bytes

- Length of longest key:    16 bytes
- Length of longest value:  16 bytes
- Number of keys:           2
- Number of nodes:          1
--------------------------------------------------------------------------------

The container superblock lists 2 APFS volumes, whose superblocks have the following Virtual OIDs:
- 0x402
- 0x470b6

Reading the APFS volume superblocks ... OK.
Validating the APFS volume superblocks ... OK.

Details of these volume superblocks:
--------------------------------------------------------------------------------
Stored checksum:    0x984f4e7ebe499c16
OID:                0x402
XID:                0xd57c
Storage type:       Virtual
Type flags:         (no flags)
Type:               APFS volume
Subtype:            (invalid type / no subtype)

Magic string:                           APSB
Index within container volume array:    0

Volume name:        ### Other ###
Role:               (no role)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
- Defragmentation is supported.
Supported read-only compatible features:
- No flags.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.

Last unmount time:                  Tue Sep  7 23:52:27 2021
Last modification time:             Tue Sep  7 23:52:26 2021

Reserved blocks:                    0 blocks
Block quota:                        0 blocks
Allocated blocks:                   85434953 blocks

Volume object map Physical OID:     0x290af9

Root tree info:
- OID:              0x404
- Storage type:     Virtual
- Type flags:       (no flags)
- Object type:      B-tree (root node)

Extent-reference tree info:
- OID:              0x1cfbe5
- Storage type:     Physical
- Type flags:       (no flags)
- Object type:      B-tree (root node)

Snapshot metadata tree info:
- OID:              0x1cf6ea
- Storage type:     Physical
- Type flags:       (no flags)
- Object type:      B-tree (root node)

On next mount, revert to:
- snapshot with this XID:                           0x0
- APFS volume superblock with this Physical OID:    0x0

Next file-system object ID that will be assigned:   0x18e353
Next document ID that will be assigned:             0x3

Number of:

- regular files:                552849
- directories:                  22620
- symbolic links:               26
- other file-system objects:    0

- snapshots:                    8
- block allocations ever made:  342152544
- block liberations ever made:  256851948

UUID:   B312E750-E7AF-404F-B524-B56959EF3D8C
Formatted by:
- ID: diskmanagementd (1412.120.2)
- Timestamp: Mon Oct 19 14:21:45 2020
- Last XID: 2

Last modified by:
- ID: apfs_kext (1677.141.1)
- Timestamp: Tue Sep  7 23:52:27 2021
- Last XID: d57c
--------------------------------------------------------------------------------
Stored checksum:    0x2c4680eb8c1c1ef2
OID:                0x470b6
XID:                0xd62b
Storage type:       Virtual
Type flags:         (no flags)
Type:               APFS volume
Subtype:            (invalid type / no subtype)

Magic string:                           APSB
Index within container volume array:    1

Volume name:        ### Untitled2 ###
Role:               (no role)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
- Defragmentation is supported.
Supported read-only compatible features:
- No flags.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.

Last unmount time:                  Mon Sep 27 23:58:53 2021
Last modification time:             Tue Sep 28 11:07:38 2021

Reserved blocks:                    0 blocks
Block quota:                        0 blocks
Allocated blocks:                   511 blocks

Volume object map Physical OID:     0x289aeb

Root tree info:
- OID:              0x470b7
- Storage type:     Virtual
- Type flags:       (no flags)
- Object type:      B-tree (root node)

Extent-reference tree info:
- OID:              0x148e2a
- Storage type:     Physical
- Type flags:       (no flags)
- Object type:      B-tree (root node)

Snapshot metadata tree info:
- OID:              0x148de4
- Storage type:     Physical
- Type flags:       (no flags)
- Object type:      B-tree (root node)

On next mount, revert to:
- snapshot with this XID:                           0x0
- APFS volume superblock with this Physical OID:    0x0

Next file-system object ID that will be assigned:   0x12d
Next document ID that will be assigned:             0x3

Number of:

- regular files:                83
- directories:                  18
- symbolic links:               0
- other file-system objects:    0

- snapshots:                    3
- block allocations ever made:  1040
- block liberations ever made:  579

UUID:   B984CC26-7BDE-4489-B7ED-14D5D6DB1B1D
Formatted by:
- ID: storagekitd (1677.141.2)
- Timestamp: Mon Sep 27 20:40:44 2021
- Last XID: d57d

Last modified by:
- ID: apfs_kext (1677.141.2)
- Timestamp: Mon Sep 27 23:58:53 2021
- Last XID: d618
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
--------------------------------------------------------------------------------

Simulating a mount of volume 0 (Other).

The volume object map has Physical OID 0x290af9.
Reading the volume object map ... OK.
Validating the volume object map ... OK.

Details of the volume object map:
--------------------------------------------------------------------------------
Stored checksum:    0xfe8a6b834104f921
OID:                0x290af9
XID:                0xd57b
Storage type:       Physical
Type flags:         (no flags)
Type:               Object map
Subtype:            (invalid type / no subtype)
Flags:
- No flags.
Object mappings tree:
- Storage type:         Physical
- Type flags:           (no flags)
- Type:                 B-tree (root node)
- Object ID:            0x290afa
Snapshots tree:
- Storage type:         Physical
- Type flags:           (no flags)
- Type:                 B-tree (root node)
- Object ID:            0x1cf6f2
- Number of snapshots:  17 snapshots
- Latest snapshot XID:  0xb8da
In-progress revert:
- Minimum XID:          0x0
- Maximum XID:          0x0
--------------------------------------------------------------------------------

Reading the root node of the volume object map B-tree ... OK.
Validating the root node of the volume object map B-tree ... OK.

Details of the volume object map B-tree:
--------------------------------------------------------------------------------
Stored checksum:    0x64ade39c40d8d678
OID:                0x290afa
XID:                0xd57b
Storage type:       Physical
Type flags:         (no flags)
Type:               B-tree (root node)
Subtype:            Object map
Flags:
- Root node
- Fixed size for keys and values
Number of child levels:         2
Number of keys in this node:    15
Location of table of contents:
- Offset from start of node data area:  0x0 = 0
- Length (bytes):                       0x240 = 576
Location of key–value shared free space:
- Offset from start of keys area:       0x150 = 336
- Length (bytes):                       0xb68 = 2920

Info relating to the entire B-tree:
- Flags:
- This B-tree is currently undergoing a series of sequential inserts --- optimise operations if possible
- Child nodes are referred to using Physical OIDs
- Node size:                4096 bytes
- Key size:                 16 bytes
- Value size:               16 bytes

- Length of longest key:    16 bytes
- Length of longest value:  16 bytes
- Number of keys:           134293
- Number of nodes:          1628
--------------------------------------------------------------------------------

The file-system tree root for this volume has Virtual OID 0x404.
Looking up this Virtual OID in the volume object map ... corresponding block address is 0x1cfc4c.
Reading ... validating ... OK.

Details of the file-system B-tree root node:
--------------------------------------------------------------------------------
Stored checksum:    0x7e4fd0ae3e2e7488
OID:                0x404
XID:                0xd57b
Storage type:       Virtual
Type flags:         (no flags)
Type:               B-tree (root node)
Subtype:            File-system records tree
Flags:
- Root node
Number of child levels:         3
Number of keys in this node:    14
Location of table of contents:
- Offset from start of node data area:  0x0 = 0
- Length (bytes):                       0x80 = 128
Location of key–value shared free space:
- Offset from start of keys area:       0x4ec = 1260
- Length (bytes):                       0x994 = 2452

Info relating to the entire B-tree:
- Flags:
- This B-tree is currently undergoing a series of sequential inserts --- optimise operations if possible
- 8-byte alignment of keys and values is not required
- Node size:                4096 bytes
- Key size:                 0 bytes
- Value size:               0 bytes

- Length of longest key:    268 bytes
- Length of longest value:  1953 bytes
- Number of keys:           2632209
- Number of nodes:          74761
--------------------------------------------------------------------------------

0xa64b2:
No records found with OID 0xa64b2.

Please suggest how to proceed as the docs in the repo point to a different version of drat

much thanks.

jivanpal commented 3 years ago

Hmm, strange that /dev/disk5 didn't work but /dev/disk2s2 did, I shall have to look into that. I am able to reproduce that issue.

Your drat inspect output looks fine, so it would seem that the only issue is with your volume omap (as reported by fsck_apfs). You can try to list the contents of directories with drat list, e.g.

drat list /dev/disk2s2 0 /Users

Try listing various directories/files you're interested in and seeing the output. If you get an error for any particular item, try its parents, e.g. if /Users/john throws an error, try /Users and /. In this way, we can identify which dentries are problematic.

For those files that are successfully listed, you should be able to recover them with drat recover, e.g.

drat recover /dev/disk2s2 0 /Users/john/Desktop/file.txt

will output the file contents to stdout; redirect to file to save the recovered file, e.g.

drat recover /dev/disk2s2 0 /Users/john/Desktop/file.txt > recovered-file.txt

rohitagre commented 3 years ago

Hi, i ended up using libfsapfs to get the data from a ubuntu live usb stick. thanks for your support and for this great tool.

jivanpal commented 3 years ago

@jammer99 , thanks for feeding back. If you are able to provide any info on how you used libfsapfs to your advantage, such as some blog post or article that helped you, that would be much appreciated!

Innoriam commented 2 years ago

Hi, i ended up using libfsapfs to get the data from a ubuntu live usb stick. thanks for your support and for this great tool.

Hey, do you have any info on how to recover the data with libfsapfs? I tried libfsapfs first and ended up here, because that didn't work for me. Problem is, that drat isn't working for me so far either.. I have a few issues, and reading block 0x0... is one of them.

@jivanpal sorry, I'm not sure if I'm allowed to open a new issue and if you have time for that or not..

jivanpal commented 2 years ago

@Innoriam If your Drat problem/output differs from that in the OP (FAILED: read_blocks: An unknown error occurred whilst reading from the stream. ABORT: Failed to successfully read block 0x0.), please create a new issue. I have no experience with libfsapfs, so can't help you there.