search

sgan81 / apfs-fuse

FUSE driver for APFS (Apple File System)
GNU General Public License v2.0
1.78k stars 164 forks source link

apfs-fuse saved my stuff #175

Open mikejsavage opened 1 year ago

mikejsavage commented 1 year ago

Hi, this isn't actually an issue so feel free to just close it. It could have been an email too but this specific error isn't on Google yet, so hopefully this helps someone else in the future too. :)

I have an old MacBook with an encrypted boot partition, and some combination of resizing the partition and upgrading macOS fried it to the point where disk utility in recovery mode doesn't recognise it as APFS and fsck returns a scary error:

# fsck_apfs /dev/disk0s2
** Checking the container superblock.
   Checking the checkpoint with transaction ID 191941.
** Checking the EFI jumpstart record.
** Checking the space manager.
** Checking the space manager free queue trees.
** Checking the object map.
** Checking the encryption key structures.
error: container keybag (14666476+1): failed to get keybag: Inappropriate file type or format
   Encryption key structures are invalid.
** The container /dev/disk0s2 could not be verified completely.

and after going nowhere with Apple support I decided to google "Linux APFS" and found this, which took less than two minutes to compile and as far as I can tell works flawlessly.

Looks like I will still have to waste some time reinstalling but your project at least saved my data, so thank you!

RJVB commented 1 year ago

Kudos!

Did you actually use encryption on that disk?

FWIW, I've lost a ZFS pool once because of a problem with encryption but IIRC it still mounted in RO mode (or I had a backup of the data on it). Since then I avoid filesystem-level encryption. I do use encrypted DMGs on Mac, but I assume those are exactly that, encrypted images of a disk.

mikejsavage commented 1 year ago

On Thu, 16 Feb 2023, at 8:52 PM, René Bertin wrote:

Did you actually use encryption on that disk?

I did! So doubly impressive this worked out.

sgan81 commented 1 year ago

Interesting ... I'm actually also surprised that this worked. I wonder what was broken in your keybag. But then, apfs-fuse might sometimes be more tolerant than Apple's APFS ...

mikejsavage commented 1 year ago

I messed around a bit after creating this issue, if you uncomment this it blows up with both my password and the recovery key: https://github.com/sgan81/apfs-fuse/blob/master/ApfsLib/KeyMgmt.cpp#L478

but that comes after you enter a decryption key so I dunno. I saved the superblock/keybag blocks if you're curious (not asking you to fix my stuff for free, that partition is gone already anyway)