search

sgan81 / apfs-fuse

FUSE driver for APFS (Apple File System)
GNU General Public License v2.0
1.8k stars 164 forks source link

"Unable to get volume!" because I mutilated the fusion drive #86

Open Crazor opened 5 years ago

Crazor commented 5 years ago

So I had a slip while juggling around data and accidentally did a diskutil eraseDisk on the HDD of a Fusion drive. I immediately Ctrl+Ced, while diskutil was still unmounting the drive, but unfortunately, data must have already been written, because now the volumes are gone. The partitioning scheme was in fact still intact, and the virtual device of the fusion drive still shows up on macOS, but the volumes must have been deleted or corrupted. Demos of commercial tools are able to mount the fusion drive and give me a completely intact listing of the drives' contents. The data is not important enough to warrant paying for them, but I thought I take a peek with apfs-fuse.

So when I try to mount the fusion drive, I get:

Device /dev/sdb2 opened. Size is 499898105856
Device /dev/sdc2 opened. Size is 3000383225856
Found more recent xid 430390 than superblock 0 contained (430255).
starting LoadKeybag
 all blocks verified
Unable to get volume!

I suppose those commercial tools read some kind of older state to find the now missing volumes. I'm not that firm on APFS terminology, but I suppose that that is an older copy of the superblock that is read? I would like to try and patch apfs-fuse to enable going back to an older state of the drive. I'm capable of hacking C++ code, but I'm neither familiar with APFS nor with the codebase, so I need some guidelines here...

Crazor commented 5 years ago

so right now macOS 10.14.4 has the following to say to that array:

nx_kernel_mount:1210: /dev/disk4: initializing cache w/hash_size 8192 and cache size 32768
nx_kernel_mount:1461: /dev/disk4: checkpoint search: largest xid 430391, best xid 430390 @ 22
nx_kernel_mount:1463: /dev/disk4: reloading after unclean unmount, checkpoint xid 430390, superblock xid 430255
Banaanhangwagen commented 5 years ago

This is not an issue of apfs-fuse. Since your data is (partially) erased on a file system level, you need to reconstruct it manually or use recovery-tools. What commercial tool did you try?

Maybe you have some luck with this tool: https://github.com/cugu/afro In the readme, you'll find links to useful documentation.

Crazor commented 5 years ago

Of course this is not an issue. I know that using the issue tracker as some kind of "forum" is frowned upon by many projects, but there's not always a good way to reach knowledgeable people elsewhere.

I tried iBoyboft Data Recovery, which showed me my intact file system. I also patched apfs-fuse a little to see if older superblocks would be useful, but so far I had no luck. I'll upload my patches later and post the results I get.

Crazor commented 5 years ago

Here are the changes I made so I can pass a xid on the command line: crazor@458f212

Crazor commented 5 years ago

@Banaanhangwagen Can you elaborate on your suggestion of manually reconstructing?