Cannot specify block size using argument `--block-size`

JulianLian commented 2 years ago

Greetings. I'm trying release 0.1.3 on Mac Big Sur 11.6.4, and run across error related to block size. Any insights will be highly appreciated.

First, tried inspect:

sudo ./drat-0.1.3 inspect /dev/disk2
Opening file at `/dev/disk2` in read-only mode ... OK.
Simulating a mount of the APFS container.
Reading container superblock at address 0x0, assuming default block size of 4096 bytes ... Actual block size stated in container superblock is 0 bytes; re-reading block 0x0 using new block size ... ABORT: read_blocks: Unexpected beaviour --- `fread` read fewer blocks than expected, but `feof` did not report EOF and `ferror` did not detect an error.

Meanwhile, hdiutil stated the block size is 512. Not sure if it's the same block size.

hdiutil imageinfo /dev/disk2
Class Name: CRawDiskImage
Size Information:
    Total Bytes: 253545676800
    Compressed Ratio: 1
    Sector Count: 495206400
    Total Non-Empty Bytes: 253545676800
    Compressed Bytes: 253545676800
    Total Empty Bytes: 0
Checksum Type: None
Format: RAW*
partitions:
    partition-scheme: fdisk
    block-size: 512
    partitions:
        0:
            partition-name: Master Boot Record
            partition-start: 0
            partition-synthesized: true
            partition-length: 1
            partition-hint: MBR
            boot-code: 0x0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
        1:
            partition-name: 
            partition-start: 1
            partition-synthesized: true
            partition-length: 65535
            partition-hint: Apple_Free
        2:
            partition-start: 65536
            partition-number: 1
            partition-length: 495140864
            partition-hint: Apple_HFS
            partition-filesystems:
                HFS+: 
    burnable: false
Format Description:  raw read/write
Checksum Value: 
Properties:
    Encrypted: false
    Kernel Compatible: false
    Checksummed: false
    Software License Agreement: false
    Partitioned: false
    Compressed: no
Segments:
    0: /dev/rdisk2
Backing Store Information:
    URL: file:///dev/rdisk2
    Name: rdisk2
    Class Name: CDevBackingStore
Resize limits (per hdiutil resize -limits):
 min     cur     max 
495206400   495206400   495206400

Then, I want specify the block size when executing drat, but failed:

sudo ./drat-0.1.3 inspect /dev/disk2 --block-size 512
Incorrect number of arguments.
Usage:   inspect <container>
Example: inspect /dev/disk0s2

Finally, I tried sub-container name:

sudo ./drat-0.1.3 inspect /dev/disk2s1
Opening file at `/dev/disk2s1` in read-only mode ... OK.
Simulating a mount of the APFS container.
Reading container superblock at address 0x0, assuming default block size of 4096 bytes ... Actual block size stated in container superblock is 1962963200 bytes; re-reading block 0x0 using new block size ... validating checksum ... FAILED.
!! APFS ERROR !! Checksum of block 0x0 should validate, but it doesn't. Proceeding as if it does.

Details of block 0x0:
--------------------------------------------------------------------------------
Stored checksum:    0x030000003400003b
OID:                0x140000000000acc4
XID:                0x2e006d006f006300
Storage type:       Physical
Type flags:         No-header, Encrypted
Type:               Unknown value (0x6100)
Subtype:            Unknown value (0x7000)
Keybag location: first block 0xd01400000000, spans 21674672718409734 (0x4d01000000f006) blocks (last block 0x4dd1140000f005)
Media keybag location: none (spans 0 blocks)
Magic string:       
Latest version of Apple APFS software that mounted this container: 37632.0.0.12.9
Block size:         1962963200 bytes
Block count:        7926441998712594688 (last block 0x6e006100720060ff)
Supported features:
- No flags.
Supported read-only compatible features:
- No flags.
Backward-incompatible features:
- No flags.
UUID:       30303832-3B36-3163-3961-6237333B7068
Next OID:                       0x796c616e616f746f
Next XID:                       0x3400003b64736973
Space manager Ephemeral OID:    0x1000000065006e00
Object map Physical OID:        0x0
Reaper Ephemeral OID:           0x323830301d000000
Other flags:
- No flags.
--------------------------------------------------------------------------------

!! APFS ERROR !! Block 0x0 should be a container superblock, but it isn't. Proceeding as if it is.

!! APFS ERROR !! Container superblock at 0x0 doesn't have the correct magic number. Proceeding as if it does.
Locating the checkpoint descriptor area:
- Its length is 50331648 blocks.
- It is contiguous.
- The address of its first block is 0x6f00630014000000.
Loading the checkpoint descriptor area into memory ... read_blocks: Reached end-of-file after reading 0 blocks.

ABORT: Failed to read all blocks in the checkpoint descriptor area.

jivanpal commented 2 years ago

Hi, can you first provide the output of diskutil apfs list to make sure you have the right disk/partition path?

As for --block-size and proper automatic block size detection, these are not in v0.1.3. You can compile the main branch to get that functionality, as well as some of the other functionality described in the v0.2 docs that has been implemented so far.

Meanwhile, hdiutil stated the block size is 512.

That is your drive's reported sector size, not the APFS logical block size, which must be at least 4096 bytes.

JulianLian commented 2 years ago

@jivanpal Thank you for your quick reply. Only got container /dev/disk1 with diskutil apfs list. That is the mbp built-in disk. And /dev/disk2 is my SD card which pulgged in the laptop. Unfortunatly, it cannot be read after I upgraded macOS to 11.6.3.

diskutil apfs list
APFS Container (1 found)
|
+-- Container disk1 A0C372B1-520A-4B75-BEF2-3CE38C1927BF
    ====================================================
    APFS Container Reference:     disk1
    Size (Capacity Ceiling):      121123069952 B (121.1 GB)
    Capacity In Use By Volumes:   102902693888 B (102.9 GB) (85.0% used)
    Capacity Not Allocated:       18220376064 B (18.2 GB) (15.0% free)
    |
    +-< Physical Store disk0s2 A52645D3-F945-4EAD-989C-7E5A20F46EAE
    |   -----------------------------------------------------------
    |   APFS Physical Store Disk:   disk0s2
    |   Size:                       121123069952 B (121.1 GB)
    |
    +-> Volume disk1s1 F34352C2-B574-3904-9387-F48C8D4BE0BC
    |   ---------------------------------------------------
    |   APFS Volume Disk (Role):   disk1s1 (Data)
    |   Name:                      Macintosh HD - 数据 (Case-insensitive)
    |   Mount Point:               /System/Volumes/Data
    |   Capacity Consumed:         82904895488 B (82.9 GB)
    |   Sealed:                    No
    |   FileVault:                 Yes (Unlocked)
    |
    +-> Volume disk1s2 E797E96E-3B24-460D-A700-13C58328B508
    |   ---------------------------------------------------
    |   APFS Volume Disk (Role):   disk1s2 (Preboot)
    |   Name:                      Preboot (Case-insensitive)
    |   Mount Point:               /System/Volumes/Preboot
    |   Capacity Consumed:         698134528 B (698.1 MB)
    |   Sealed:                    No
    |   FileVault:                 No
    |
    +-> Volume disk1s3 6CFAD64E-0305-4633-A0DC-96287235447A
    |   ---------------------------------------------------
    |   APFS Volume Disk (Role):   disk1s3 (Recovery)
    |   Name:                      Recovery (Case-insensitive)
    |   Mount Point:               Not Mounted
    |   Capacity Consumed:         623628288 B (623.6 MB)
    |   Sealed:                    No
    |   FileVault:                 No
    |
    +-> Volume disk1s4 438F8EA5-AFF2-498E-BCDE-0FEDD0C91FFD
    |   ---------------------------------------------------
    |   APFS Volume Disk (Role):   disk1s4 (VM)
    |   Name:                      VM (Case-insensitive)
    |   Mount Point:               /System/Volumes/VM
    |   Capacity Consumed:         3222466560 B (3.2 GB)
    |   Sealed:                    No
    |   FileVault:                 No
    |
    +-> Volume disk1s5 D7B8230E-B7EC-4E5F-B0FD-EEFF51A192D1
        ---------------------------------------------------
        APFS Volume Disk (Role):   disk1s5 (System)
        Name:                      Macintosh HD (Case-insensitive)
        Mount Point:               Not Mounted
        Capacity Consumed:         15323054080 B (15.3 GB)
        Sealed:                    Broken
        FileVault:                 Yes (Unlocked)
        Encrypted:                 No
        |
        Snapshot:                  29C19B24-B315-43B3-8A9A-97CE19E16874
        Snapshot Disk:             disk1s5s1
        Snapshot Mount Point:      /
        Snapshot Sealed:           Yes

jivanpal commented 2 years ago

You are trying to recover data from your SD card? Presumably it was FAT-formatted, though your hdiutil output suggests HFS+. In either case, Drat will not help you, it is specifically for APFS. Take a look at TestDisk and PhotoRec.

JulianLian commented 2 years ago

Hi @jivanpal, I am using an old MBP (mid2014) which has a SD slot built-in. And I have a SD card plugged always. Also it was formatted to "macOS extend journal" which I think belongs to APFS. Unfortunately, the SD card cannot read after OS upgraded to Big Sur 11.6.3.

jivanpal commented 2 years ago

"macOS Extended" is HFS+, Drat will not help you — sorry! As well as the tools I mentioned previously, you may also want to try out Disk Drill.

JulianLian commented 2 years ago

@jivanpal Thank you so much! I am just about to research more on APFS. Really appreciate that you guide me the right direction.

jivanpal / drat

Cannot specify block size using argument `--block-size` #36