libyal / libfsapfs

Library and tools to access the Apple File System (APFS)
GNU Lesser General Public License v3.0
342 stars 38 forks source link

Device not configured and "libfsapfs_container_superblock_read_data: unknown30" #27

Closed joerg-wille closed 3 years ago

joerg-wille commented 4 years ago

My current system is macOS Mojave 10.14.6 and I want to mount an external USB drive created with macOS High Sierra 10.13. This USB drive is the original 500GB SSD from my MacBookPro which I replaced and put in an external enclosure. Accessing this drive worked for some time, but for some unknown reasons, the "Macintosh HD" is not mountable any more.

I did following steps:

cd libfsapfs-20200727
CC="xcrun gcc" ./configure --enable-verbose-output --enable-debug-output
make -j12

Container disk4 57534593-854D-4765-B4A1-8504A0DE215D
====================================================
APFS Container Reference:     disk4
Size (Capacity Ceiling):      436013608960 B (436.0 GB)
Capacity In Use By Volumes:   386666848256 B (386.7 GB) (88.7% used)
Capacity Not Allocated:       49346760704 B (49.3 GB) (11.3% free)
|
+-< Physical Store disk3s2 E3842D11-748D-4EF8-952F-F35804569FA3
|   -----------------------------------------------------------
|   APFS Physical Store Disk:   disk3s2
|   Size:                       436013608960 B (436.0 GB)
|
+-> Volume disk4s1 93D88FDF-6663-370F-9C18-8CFDBA0BEB85
|   ---------------------------------------------------
|   APFS Volume Disk (Role):   disk4s1 (No specific role)
|   Name:                      Macintosh HD (Case-insensitive)
|   Mount Point:               Not Mounted
|   Capacity Consumed:         384895508480 B (384.9 GB)
|   FileVault:                 Yes (Unlocked)
|
+-> Volume disk4s2 80CAC219-9D7D-4EC4-8B29-22876F71792A
|   ---------------------------------------------------
|   APFS Volume Disk (Role):   disk4s2 (Preboot)
|   Name:                      Preboot (Case-insensitive)
|   Mount Point:               Not Mounted
|   Capacity Consumed:         23052288 B (23.1 MB)
|   FileVault:                 No
|
+-> Volume disk4s3 3282B8C9-251C-4ED6-BEA8-CD976347F4D7
|   ---------------------------------------------------
|   APFS Volume Disk (Role):   disk4s3 (Recovery)
|   Name:                      Recovery (Case-insensitive)
|   Mount Point:               Not Mounted
|   Capacity Consumed:         518995968 B (519.0 MB)
|   FileVault:                 No
|
+-> Volume disk4s4 0EA9399E-569D-4176-9E27-42D90E901B66
    ---------------------------------------------------
    APFS Volume Disk (Role):   disk4s4 (VM)
    Name:                      VM (Case-insensitive)
    Mount Point:               Not Mounted
    Capacity Consumed:         1073766400 B (1.1 GB)
    FileVault:                 No

sudo ./fsapfsinfo -f 1 -p jbw /dev/disk3s2

`fsapfsinfo 20200727
 Apple File System (APFS) information:
 Container information:
  Identifier        : 57534593-854d-4765-b4a1-8504a0de215d
  Number of volumes : 4

 Volume: 1 information:
  Identifier        : 93d88fdf-6663-370f-9c18-8cfdba0beb85
  Name          : Macintosh HD

 Volume: 2 information:
  Identifier        : 80cac219-9d7d-4ec4-8b29-22876f71792a
  Name          : Preboot

 Volume: 3 information:
  Identifier        : 3282b8c9-251c-4ed6-bea8-cd976347f4d7
  Name          : Recovery

 Volume: 4 information:
  Identifier        : 0ea9399e-569d-4176-9e27-42d90e901b66
  Name          : VM`

mkdir drive (or sudo umount drive)
sudo ./fsapfsmount -f 1 -p jbw -v -X volicon=/Library/Filesystems/osxfuse.fs/Contents/Resources/Volume.icns /dev/disk3s2 ./drive &> ./debug.log

If I try to ls -al in the "drive" I get:
ls: .: Device not configured

In the debug.log file, I see:
libfsapfs_container_superblock_read_data: unknown30

Is this the problem? And is there anything I can do to solve this?
(As I read from other issues, I also tried out "iBoysoft Data Recovery". This tool can read all files of the "Macintosh HD". So I have good hopes, that the drive is not corrupt.)

joachimmetz commented 4 years ago

Thx for the detailed report, this makes it very easy to follow the steps you've taken.

This is is the issue:

libfsapfs_object_map_btree_get_sub_node: invalid object type: 0x40000002.
libfsapfs_object_map_btree_get_entry_by_identifier: unable to retrieve B-tree sub node from block: 810507.
libfsapfs_object_map_btree_get_descriptor_by_object_identifier: unable to retrieve entry from B-tree.
libfsapfs_internal_volume_get_file_system_btree: unable to retrieve object map descriptor for file system root object identifier: 1028.
libfsapfs_volume_get_file_entry_by_utf8_path: unable to determine file system B-tree.
mount_file_system_get_file_entry_by_path: unable to retrieve file entry 
mount_handle_get_file_entry_by_path: unable to retrieve file entry.
mount_fuse_getattr: unable to retrieve value for: /.

libfsapfs is seeing a file system block/object (0x40000002) where it would expect to get an object map block/object (0x0000000b) type. Also see https://github.com/libyal/libfsapfs/blob/master/documentation/Apple%20File%20System%20(APFS).asciidoc#44-object-types

As I read from other issues, I also tried out "iBoysoft Data Recovery". This tool can read all files of the "Macintosh HD". So I have good hopes, that the drive is not corrupt.

I'm not familiar with the inner workings of this tool, but judging from the name it is focused on recovery so it might use additional recovery methods.

joerg-wille commented 4 years ago

Thanks Joachim,

libfsapfs is seeing a file system block/object (0x40000002) where it would expect to get an object map block/object (0x0000000b) type.

So, what is the problem? Is libfsapfs's expectation wrong or is the block object type wrong on my disk? And, for the latter, could I - theoretically - use an Hex Editor and change this block object type on disk to get libfsapfs to mount my drive and if possible, would you suggest doing so? Also, I have no idea how to use a disk editor for an encrypted volume, I am trying 010 Editor with a template for APFS.

What would you think, it is possible to access the Macintosh HD for copying the data files using libfsapfs?

Thanks

joachimmetz commented 4 years ago

So, what is the problem? Is libfsapfs's expectation wrong or is the block object type wrong on my disk?

Is possible the library is still experimental and not every edge case is supported.

Without the actual APFS container and its history hard for me to tell. Based on this issue tracker it appears not uncommon for APFS to get corrupted. So the file system corruption hypothesis would be more likely I would say.

Can you open this file system with the native Mac OS APFS implementation?

libfsapfs_btree_node_read_object_data: object checksum          : 0x785443db36a215d1
libfsapfs_btree_node_read_object_data: object identifier        : 810507
libfsapfs_btree_node_read_object_data: object transaction identifier    : 1030670
libfsapfs_btree_node_read_object_data: object type          : 0x40000002
libfsapfs_btree_node_read_object_data: object subtype           : 0x0000000b

Also, I have no idea how to use a disk editor for an encrypted volume, I am trying 010 Editor with a template for APFS.

That might be more complicated than you want.

Another possible work-around is to remove the safeguard from libfsapfs in your local copy.

joachimmetz commented 3 years ago

No additional input regarding issue, unable to fix without complete information. Closing