No records found with OID 0x2. #19

tarik02 · 2021-03-17T19:19:38Z

tarik02
Mar 17, 2021

Hello. I need help with recoverting filesystem that was broken due to some strange incident.

My brother had a laptop with significant uptime with installed macOS. At some point of time it freezed during normal work, then it was rebooted and it was not booting at all. I tried to boot it from live linux flash, it booted successfully.
In conclusion to this, the main problem was that partition table was clean. I tried to restore partiton table and it was successful. There was a partition with GRUB (working flawlessly) and partition with macOS. Then I tried to boot macOS partiton, Apple logo appeared on screen and it just rebooted. Then, it stopped booting (Apple logo for short time and then reboot).
Then I did backup of internal ssd to a file on external ssd in order to recover it some time later and reinstalled the OS on that laptop.

So, I tried using this utility to restore, but I couldn't do anything valuable. As I said, I have a backup (of whole disk), so I did a little patch to read_blocks and write_blocks functions in order to skip blocks till the actual APFS filesystem.

Output of sudo fdisk -lu /mnt/i/disk.img:

Disk /mnt/i/disk.img: 223.58 GiB, 240057409536 bytes, 468862128 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 80312927-28A9-8031-441F-3180EF1D3180

Device             Start       End   Sectors   Size Type
/mnt/i/disk.img1    2048    391167    389120   190M EFI System
/mnt/i/disk.img2 1050624   1460223    409600   200M EFI System
/mnt/i/disk.img3 2099200 280119295 278020096 132.6G unknown

Modified code (functions read_blocks/write_blocks):

    if (fseek(nx, 2099200 * 512 + start_block * nx_block_size, SEEK_SET) == -1) {

Output of ./drat read /mnt/i/disk.img 0:

Opening file at `/mnt/i/disk.img` in read-only mode ... OK.

Reading block 0x0 ... validating ... OK.

Details of block 0x0:
--------------------------------------------------------------------------------
Stored checksum:    0xbe7e7ebf4157b036
OID:                0x1
XID:                0x2ee68d
Storage type:       Ephemeral
Type flags:         (none)
Type:               Container superblock
Subtype:            (invalid type / no subtype)
Keybag location: first block 0x15aeaeb, spans 1 (0x1) blocks (last block 0x15aeaeb)
Media keybag location: none (spans 0 blocks)
Magic string:       NXSB
Latest version of Apple APFS software that mounted this container: 1284.305.552.845.64
Block size:         4096 bytes
Block count:        34752512 (last block 0x21247ff)
Supported features:
- No feature flags are set.
Supported read-only compatible features:
- No read-only compatible feature flags are set.
Backward-incompatible features:
- No backward-incompatible feature flags are set.
UUID:       0xe35aafc02f3cffbe244bde8093a8a0d5
Next OID:                       0x3ab99d
Next XID:                       0x2ee68e
Space manager Ephemeral OID:    0x1ba2b
Object map Physical OID:        0x81494
Reaper Ephemeral OID:           0x401
Other flags:
- No other flags are set.
--------------------------------------------------------------------------------

END: All done.

Output of `./drat inspect /mnt/i/disk.img`:

Opening file at `/mnt/i/disk.img` in read-only mode ... OK.
Simulating a mount of the APFS container.
Validating checksum of block 0x0 ... OK.

Details of block 0x0:
--------------------------------------------------------------------------------
Stored checksum:    0xbe7e7ebf4157b036
OID:                0x1
XID:                0x2ee68d
Storage type:       Ephemeral
Type flags:         (none)
Type:               Container superblock
Subtype:            (invalid type / no subtype)
Keybag location: first block 0x15aeaeb, spans 1 (0x1) blocks (last block 0x15aeaeb)
Media keybag location: none (spans 0 blocks)
Magic string:       NXSB
Latest version of Apple APFS software that mounted this container: 1284.305.552.845.64
Block size:         4096 bytes
Block count:        34752512 (last block 0x21247ff)
Supported features:
- No feature flags are set.
Supported read-only compatible features:
- No read-only compatible feature flags are set.
Backward-incompatible features:
- No backward-incompatible feature flags are set.
UUID:       0xe35aafc02f3cffbe244bde8093a8a0d5
Next OID:                       0x3ab99d
Next XID:                       0x2ee68e
Space manager Ephemeral OID:    0x1ba2b
Object map Physical OID:        0x81494
Reaper Ephemeral OID:           0x401
Other flags:
- No other flags are set.
--------------------------------------------------------------------------------

Locating the checkpoint descriptor area:
- Its length is 280 blocks.
- It is contiguous.
- The address of its first block is 0xeb6e.
Loading the checkpoint descriptor area into memory ... OK.
Locating the most recent well-formed container superblock in the checkpoint descriptor area:
- !! APFS ERROR !! Block at index 90 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 91 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 92 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 93 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 94 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 95 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 96 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 97 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 98 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 99 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 100 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 102 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 103 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 104 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 105 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 106 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 107 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 108 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 109 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 110 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 111 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 112 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 113 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 114 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 115 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 116 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 117 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 118 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 119 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 120 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 121 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 122 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 124 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 125 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 126 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 128 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 129 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 130 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 131 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 132 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 134 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 135 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 136 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 138 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 139 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 140 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 141 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 142 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 144 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 145 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 146 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 147 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 148 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 150 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 151 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 152 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 153 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 154 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 155 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 156 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 157 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 158 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 159 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 160 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 162 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 163 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 164 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 165 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 166 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 167 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 168 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 169 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 170 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 171 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 172 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 173 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 174 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 175 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 176 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 177 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 178 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 180 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 181 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 182 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 183 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 184 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 185 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 186 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 187 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 188 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 190 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 191 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 192 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 193 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 194 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 196 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 198 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 199 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 200 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 201 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 202 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 203 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 204 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 206 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 207 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 208 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 209 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 210 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 211 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 212 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 214 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 215 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 216 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 217 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 218 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 219 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 220 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 221 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 222 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 223 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 224 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 226 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 228 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 229 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 230 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 231 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 232 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 234 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 235 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 236 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS WARNING !! Block at index 237 within this area failed checksum validation. Skipping it.
- !! APFS ERROR !! Block at index 238 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 239 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 240 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 241 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 242 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 243 within this area is not a container superblock or checkpoint map. Skipping it.
- !! APFS ERROR !! Block at index 244 within this area is not a container superblock or checkpoint map. Skipping it.
- It lies at index 257 within the checkpoint descriptor area.

Details of this container superblock:
--------------------------------------------------------------------------------
Stored checksum:    0x1e15440ae1a21c55
OID:                0x1
XID:                0x2f7230
Storage type:       Ephemeral
Type flags:         (none)
Type:               Container superblock
Subtype:            (invalid type / no subtype)
Keybag location: first block 0x15aeaeb, spans 1 (0x1) blocks (last block 0x15aeaeb)
Media keybag location: none (spans 0 blocks)
Magic string:       NXSB
Latest version of Apple APFS software that mounted this container: 1284.305.552.845.64
Block size:         4096 bytes
Block count:        34752512 (last block 0x21247ff)
Supported features:
- No feature flags are set.
Supported read-only compatible features:
- No read-only compatible feature flags are set.
Backward-incompatible features:
- No backward-incompatible feature flags are set.
UUID:       0xe35aafc02f3cffbe244bde8093a8a0d5
Next OID:                       0x3b2cb2
Next XID:                       0x2f7231
Space manager Ephemeral OID:    0x1ba2b
Object map Physical OID:        0x86e8d
Reaper Ephemeral OID:           0x401
Other flags:
- No other flags are set.
--------------------------------------------------------------------------------
- The corresponding checkpoint starts at index 256 within the checkpoint descriptor area, and spans 2 blocks.

Loading the corresponding checkpoint ... OK.

Details of each block in this checkpoint:
--------------------------------------------------------------------------------
Stored checksum:    0x8f5a4fc4afd76291
OID:                0xec6e
XID:                0x2f7230
Storage type:       Physical
Type flags:         (none)
Type:               Checkpoint map
Subtype:            (invalid type / no subtype)
Flags:
- Last checkpoint-mapping block in the corresponding checkpoint.
Number of mappings: 7
--------------------------------------------------------------------------------
Stored checksum:    0x1e15440ae1a21c55
OID:                0x1
XID:                0x2f7230
Storage type:       Ephemeral
Type flags:         (none)
Type:               Container superblock
Subtype:            (invalid type / no subtype)
Keybag location: first block 0x15aeaeb, spans 1 (0x1) blocks (last block 0x15aeaeb)
Media keybag location: none (spans 0 blocks)
Magic string:       NXSB
Latest version of Apple APFS software that mounted this container: 1284.305.552.845.64
Block size:         4096 bytes
Block count:        34752512 (last block 0x21247ff)
Supported features:
- No feature flags are set.
Supported read-only compatible features:
- No read-only compatible feature flags are set.
Backward-incompatible features:
- No backward-incompatible feature flags are set.
UUID:       0xe35aafc02f3cffbe244bde8093a8a0d5
Next OID:                       0x3b2cb2
Next XID:                       0x2f7231
Space manager Ephemeral OID:    0x1ba2b
Object map Physical OID:        0x86e8d
Reaper Ephemeral OID:           0x401
Other flags:
- No other flags are set.
--------------------------------------------------------------------------------

Details of each checkpoint-mapping in this checkpoint:
--------------------------------------------------------------------------------
Ephemeral OID:                      0x401
Logical block address on disk:      0xa357
Object type:                        Container reaper
Object subtype:                     (invalid type / no subtype)
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x405
Logical block address on disk:      0xa358
Object type:                        B-tree (root node)
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x1ba2b
Logical block address on disk:      0xa359
Object type:                        Space manager
Object subtype:                     (invalid type / no subtype)
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x1ba2c
Logical block address on disk:      0xa35a
Object type:                        B-tree (root node)
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x1f31ce
Logical block address on disk:      0xa35b
Object type:                        Container reaper list
Object subtype:                     (invalid type / no subtype)
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x3b2c4c
Logical block address on disk:      0xa35c
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
Ephemeral OID:                      0x3b2cb1
Logical block address on disk:      0xa35d
Object type:                        B-tree (non-root) node
Object subtype:                     Space manager free-space queue
Object size:                        4096 bytes
Associated volume OID (virtual):    0x0
--------------------------------------------------------------------------------
- There are 7 checkpoint-mappings in this checkpoint.

Reading the Ephemeral objects used by this checkpoint ... OK.
Validating the Ephemeral objects ... OK.

Details of the Ephemeral objects:
--------------------------------------------------------------------------------
Stored checksum:    0x3592977509ff0787
OID:                0x401
XID:                0x2f7230
Storage type:       Ephemeral
Type flags:         (none)
Type:               Container reaper
Subtype:            (invalid type / no subtype)
--------------------------------------------------------------------------------
Stored checksum:    0x31179a253b7fcee7
OID:                0x405
XID:                0x2f7230
Storage type:       Ephemeral
Type flags:         (none)
Type:               B-tree (root node)
Subtype:            Space manager free-space queue
--------------------------------------------------------------------------------
Stored checksum:    0x5f3da7a8cf940dba
OID:                0x1ba2b
XID:                0x2f7230
Storage type:       Ephemeral
Type flags:         (none)
Type:               Space manager
Subtype:            (invalid type / no subtype)
--------------------------------------------------------------------------------
Stored checksum:    0x9be909fb8afb5e3a
OID:                0x1ba2c
XID:                0x2f7230
Storage type:       Ephemeral
Type flags:         (none)
Type:               B-tree (root node)
Subtype:            Space manager free-space queue
--------------------------------------------------------------------------------
Stored checksum:    0x04ba53adb11307c8
OID:                0x1f31ce
XID:                0x2f7230
Storage type:       Ephemeral
Type flags:         (none)
Type:               Container reaper list
Subtype:            (invalid type / no subtype)
--------------------------------------------------------------------------------
Stored checksum:    0x3e0ec125e13eb47f
OID:                0x3b2c4c
XID:                0x2f7230
Storage type:       Ephemeral
Type flags:         (none)
Type:               B-tree (non-root) node
Subtype:            Space manager free-space queue
--------------------------------------------------------------------------------
Stored checksum:    0x5abfeca701b91ca8
OID:                0x3b2cb1
XID:                0x2f7230
Storage type:       Ephemeral
Type flags:         (none)
Type:               B-tree (non-root) node
Subtype:            Space manager free-space queue
--------------------------------------------------------------------------------

The container superblock states that the container object map has Physical OID 0x86e8d.
Loading the container object map ... OK.
Validating the container object map ... OK.

Details of the container object map:
--------------------------------------------------------------------------------
Stored checksum:    0x4009e914ffb5c77b
OID:                0x86e8d
XID:                0x2f7230
Storage type:       Physical
Type flags:         (none)
Type:               Object map
Subtype:            (invalid type / no subtype)
Flags:
- No snapshot support
Object mappings tree:
- Storage type:         Physical
- Type flags:           (none)
- Type:                 B-tree (root node)
- Object ID:            0x86ea2
Snapshots tree:
- Storage type:         Physical
- Type flags:           (none)
- Type:                 B-tree (root node)
- Object ID:            0x0
- Number of snapshots:  0 snapshots
- Latest snapshot XID:  0x0
In-progress revert:
- Minimum XID:          0x0
- Maximum XID:          0x0
--------------------------------------------------------------------------------

Reading the root node of the container object map B-tree ... OK.
Validating the root node of the container object map B-tree ... OK.

Details of the container object map B-tree:
--------------------------------------------------------------------------------
Stored checksum:    0x78aa74943537cdd9
OID:                0x86ea2
XID:                0x2f7230
Storage type:       Physical
Type flags:         (none)
Type:               B-tree (root node)
Subtype:            Object map
Flags:                          Root node, Leaf node, Fixed size for keys and values
Number of child levels:         0
Number of keys in this node:    5
Location of table of contents:
- Offset from start of node data area:  0x0 = 0
- Length (bytes):                       0x1c0 = 448
Location of key�value shared free space:
- Offset from start of keys area:       0x60 = 96
- Length (bytes):                       0xd20 = 3360

Info relating to the entire B-tree:
- Flags:
  - This B-tree is currently undergoing a series of sequential inserts --- optimise operations if possible
  - Child nodes are referred to using Physical OIDs
- Node size:                4096 bytes
- Key size:                 16 bytes
- Value size:               16 bytes

- Length of longest key:    16 bytes
- Length of longest value:  16 bytes
- Number of keys:           5
- Number of nodes:          1
--------------------------------------------------------------------------------

The container superblock lists 5 APFS volumes, whose superblocks have the following Virtual OIDs:
- 0x402
- 0x408
- 0x40a
- 0x40c
- 0x44c

Reading the APFS volume superblocks ... OK.
Validating the APFS volume superblocks ... OK.

Details of these volume superblocks:
--------------------------------------------------------------------------------
Stored checksum:    0xb2f848ccc24d0259
OID:                0x402
XID:                0x2f722f
Storage type:       Virtual
Type flags:         (none)
Type:               APFS volume
Subtype:            (invalid type / no subtype)

Magic string:                           APSB
Index within container volume array:    0

Volume name:        ### macOS - Data ###
Role:               Data (contains mutable data)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
- This volume supports mounting a system and data volume as a single user-visible volume.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.
- At least one snapshot with no data exists for this volume.

Last unmount time:                  Sun Jan 17 18:33:00 2021
Last modification time:             Tue Jan 26 16:57:40 2021

Reserved blocks:                    0 blocks
Block quota:                        0 blocks
Allocated blocks:                   27423593 blocks

Volume object map Physical OID:     0x832be

Root tree info:
- OID:              0x404
- Storage type:     Virtual
- Type flags:       (none)
- Object type:      B-tree (root node)

Extent-reference tree info:
- OID:              0x821fc
- Storage type:     Physical
- Type flags:       (none)
- Object type:      B-tree (root node)

Snapshot metadata tree info:
- OID:              0xd5446
- Storage type:     Physical
- Type flags:       (none)
- Object type:      B-tree (root node)

On next mount, revert to:
- snapshot with this XID:                           0x0
- APFS volume superblock with this Physical OID:    0x0

Next file-system object ID that will be assigned:   0x1e9c7d2
Next document ID that will be assigned:             0x9c

Number of:

- regular files:                1031200
- directories:                  175840
- symbolic links:               42650
- other file-system objects:    74

- snapshots:                    0
- block allocations ever made:  781445649
- block liberations ever made:  754153816

UUID:   0xe81812b2d15ac9a3674004f9f781f183
--------------------------------------------------------------------------------
Stored checksum:    0xd29310dd1db977fc
OID:                0x408
XID:                0x2365cf
Storage type:       Virtual
Type flags:         (none)
Type:               APFS volume
Subtype:            (invalid type / no subtype)

Magic string:                           APSB
Index within container volume array:    1

Volume name:        ### Preboot ###
Role:               Preboot (contains files needed to boot from an encrypted volumes)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.

Last unmount time:                  Sat Jul  4 13:27:02 2020
Last modification time:             Sat Jul  4 13:27:02 2020

Reserved blocks:                    0 blocks
Block quota:                        0 blocks
Allocated blocks:                   20644 blocks

Volume object map Physical OID:     0xeafdd

Root tree info:
- OID:              0x409
- Storage type:     Virtual
- Type flags:       (none)
- Object type:      B-tree (root node)

Extent-reference tree info:
- OID:              0xeafd6
- Storage type:     Physical
- Type flags:       (none)
- Object type:      B-tree (root node)

Snapshot metadata tree info:
- OID:              0x3a9c6
- Storage type:     Physical
- Type flags:       (none)
- Object type:      B-tree (root node)

On next mount, revert to:
- snapshot with this XID:                           0x0
- APFS volume superblock with this Physical OID:    0x0

Next file-system object ID that will be assigned:   0x4e0
Next document ID that will be assigned:             0x3

Number of:

- regular files:                63
- directories:                  19
- symbolic links:               0
- other file-system objects:    0

- snapshots:                    0
- block allocations ever made:  791584
- block liberations ever made:  770957

UUID:   0xc3b904e6ab5bd0941c4e662e9248c197
--------------------------------------------------------------------------------
Stored checksum:    0x05266ee88c8ca6bb
OID:                0x40a
XID:                0x2ee6cc
Storage type:       Virtual
Type flags:         (none)
Type:               APFS volume
Subtype:            (invalid type / no subtype)

Magic string:                           APSB
Index within container volume array:    2

Volume name:        ### Recovery ###
Role:               Recovery (contains a recovery system)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.

Last unmount time:                  Sun Jan 17 18:36:22 2021
Last modification time:             Sat Jul  4 10:20:15 2020

Reserved blocks:                    0 blocks
Block quota:                        0 blocks
Allocated blocks:                   128924 blocks

Volume object map Physical OID:     0xd4182

Root tree info:
- OID:              0x40b
- Storage type:     Virtual
- Type flags:       (none)
- Object type:      B-tree (root node)

Extent-reference tree info:
- OID:              0x86d2b
- Storage type:     Physical
- Type flags:       (none)
- Object type:      B-tree (root node)

Snapshot metadata tree info:
- OID:              0x3a9cd
- Storage type:     Physical
- Type flags:       (none)
- Object type:      B-tree (root node)

On next mount, revert to:
- snapshot with this XID:                           0x0
- APFS volume superblock with this Physical OID:    0x0

Next file-system object ID that will be assigned:   0xb1
Next document ID that will be assigned:             0x3

Number of:

- regular files:                38
- directories:                  5
- symbolic links:               0
- other file-system objects:    0

- snapshots:                    0
- block allocations ever made:  515466
- block liberations ever made:  386552

UUID:   0xb185c57b0f2931b557477d8852a55bb9
--------------------------------------------------------------------------------
Stored checksum:    0x1a170217e4c43227
OID:                0x40c
XID:                0x2ee90d
Storage type:       Virtual
Type flags:         (none)
Type:               APFS volume
Subtype:            (invalid type / no subtype)

Magic string:                           APSB
Index within container volume array:    3

Volume name:        ### VM ###
Role:               Virtual memory (used as swap space for virtual memory)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.

Last unmount time:                  Sun Jan 17 18:32:58 2021
Last modification time:             Mon Jan 18 19:46:30 2021

Reserved blocks:                    0 blocks
Block quota:                        0 blocks
Allocated blocks:                   262436 blocks

Volume object map Physical OID:     0x8df33

Root tree info:
- OID:              0x40d
- Storage type:     Virtual
- Type flags:       (none)
- Object type:      B-tree (root node)

Extent-reference tree info:
- OID:              0x8faa6
- Storage type:     Physical
- Type flags:       (none)
- Object type:      B-tree (root node)

Snapshot metadata tree info:
- OID:              0x3a988
- Storage type:     Physical
- Type flags:       (none)
- Object type:      B-tree (root node)

On next mount, revert to:
- snapshot with this XID:                           0x0
- APFS volume superblock with this Physical OID:    0x0

Next file-system object ID that will be assigned:   0x2f7
Next document ID that will be assigned:             0x3

Number of:

- regular files:                2
- directories:                  0
- symbolic links:               0
- other file-system objects:    0

- snapshots:                    0
- block allocations ever made:  165937152
- block liberations ever made:  165674752

UUID:   0x396d64c8eb1ed2aa3c41348f9159efa3
--------------------------------------------------------------------------------
Stored checksum:    0x48aa47a9e2f13984
OID:                0x44c
XID:                0x2f7230
Storage type:       Virtual
Type flags:         (none)
Type:               APFS volume
Subtype:            (invalid type / no subtype)

Magic string:                           APSB
Index within container volume array:    4

Volume name:        ### macOS ###
Role:               System (contains a root directory for the system)
Flags:
- Volume is unencrypted.
Supported features:
- This volume has hardlink map records.
- This volume supports mounting a system and data volume as a single user-visible volume.
Supported read-only compatible features:
- No read-only compatible volume feature flags are set.
Backward-incompatible features:
- Filenames on this volume are case-insensitive.
- At least one snapshot with no data exists for this volume.

Last unmount time:                  Wed Apr 22 18:14:44 2020
Last modification time:             Fri Jan 29 21:35:12 2021

Reserved blocks:                    0 blocks
Block quota:                        0 blocks
Allocated blocks:                   2756218 blocks

Volume object map Physical OID:     0x819fd

Root tree info:
- OID:              0x44d
- Storage type:     Virtual
- Type flags:       (none)
- Object type:      B-tree (root node)

Extent-reference tree info:
- OID:              0x8687f
- Storage type:     Physical
- Type flags:       (none)
- Object type:      B-tree (root node)

Snapshot metadata tree info:
- OID:              0xd5384
- Storage type:     Physical
- Type flags:       (none)
- Object type:      B-tree (root node)

On next mount, revert to:
- snapshot with this XID:                           0x0
- APFS volume superblock with this Physical OID:    0x0

Next file-system object ID that will be assigned:   0xfffffff000affd2
Next document ID that will be assigned:             0x3

Number of:

- regular files:                372740
- directories:                  108851
- symbolic links:               6524
- other file-system objects:    0

- snapshots:                    0
- block allocations ever made:  5391813
- block liberations ever made:  2684437

UUID:   0x6b89045f599234a5e84df68c9592fc86
--------------------------------------------------------------------------------


--------------------------------------------------------------------------------
--------------------------------------------------------------------------------

Simulating a mount of volume 0 (macOS - Data).

The volume object map has Physical OID 0x832be.
Reading the volume object map ... OK.
Validating the volume object map ... OK.

Details of the volume object map:
--------------------------------------------------------------------------------
Stored checksum:    0x3e3d32620182f222
OID:                0x832be
XID:                0x2f722f
Storage type:       Physical
Type flags:         (none)
Type:               Object map
Subtype:            (invalid type / no subtype)
Flags:
- No flags are set.
Object mappings tree:
- Storage type:         Physical
- Type flags:           (none)
- Type:                 B-tree (root node)
- Object ID:            0x8367f
Snapshots tree:
- Storage type:         Physical
- Type flags:           (none)
- Type:                 B-tree (root node)
- Object ID:            0x0
- Number of snapshots:  0 snapshots
- Latest snapshot XID:  0x0
In-progress revert:
- Minimum XID:          0x0
- Maximum XID:          0x0
--------------------------------------------------------------------------------

Reading the root node of the volume object map B-tree ... OK.
Validating the root node of the volume object map B-tree ... OK.

Details of the volume object map B-tree:
--------------------------------------------------------------------------------
Stored checksum:    0x86f7c9abb59b2762
OID:                0x8367f
XID:                0x2f722f
Storage type:       Physical
Type flags:         (none)
Type:               B-tree (root node)
Subtype:            Object map
Flags:                          Root node, Fixed size for keys and values
Number of child levels:         2
Number of keys in this node:    18
Location of table of contents:
- Offset from start of node data area:  0x0 = 0
- Length (bytes):                       0x240 = 576
Location of key�value shared free space:
- Offset from start of keys area:       0x3e0 = 992
- Length (bytes):                       0x790 = 1936

Info relating to the entire B-tree:
- Flags:
  - This B-tree is currently undergoing a series of sequential inserts --- optimise operations if possible
  - Child nodes are referred to using Physical OIDs
- Node size:                4096 bytes
- Key size:                 16 bytes
- Value size:               16 bytes

- Length of longest key:    16 bytes
- Length of longest value:  16 bytes
- Number of keys:           114773
- Number of nodes:          1580
--------------------------------------------------------------------------------

The file-system tree root for this volume has Virtual OID 0x404.
Looking up this Virtual OID in the volume object map ... corresponding block address is 0x846d2.
Reading ... validating ... OK.

Details of the file-system B-tree root node:
--------------------------------------------------------------------------------
Stored checksum:    0x6eef9918862ccec8
OID:                0x404
XID:                0x2f722f
Storage type:       Virtual
Type flags:         (none)
Type:               B-tree (root node)
Subtype:            File-system records tree
Flags:                          Root node
Number of child levels:         3
Number of keys in this node:    17
Location of table of contents:
- Offset from start of node data area:  0x0 = 0
- Length (bytes):                       0xc0 = 192
Location of key�value shared free space:
- Offset from start of keys area:       0x68d = 1677
- Length (bytes):                       0x783 = 1923

Info relating to the entire B-tree:
- Flags:
  - This B-tree is currently undergoing a series of sequential inserts --- optimise operations if possible
  - 8-byte alignment of keys and values is not required
- Node size:                4096 bytes
- Key size:                 0 bytes
- Value size:               0 bytes

- Length of longest key:    208 bytes
- Length of longest value:  2973 bytes
- Number of keys:           4807374
- Number of nodes:          114772
--------------------------------------------------------------------------------


0xa64b2:

ABORT: get_fs_records: Checksum of node at block 0xd326c did not validate.

Also, I tried using search command and I found out that there are references to files in data partition - I can find some source files. What about other filesystems - they're easily readable, but there are no any useful data.

So, there's the following APFS volumes:

 Volume list
================
 0: macOS - Data
 1: Preboot
 2: Recovery
 3: VM
 4: macOS

Volumes 4 is readable:

Records for file-system object 0x2 -- `/` --
- INODE
- DIR REC || Dirctry || target ID = 0xfffffff0007e5a3 || name = EFI-Backups
- DIR REC || Dirctry || target ID = 0xfffffff0000001f || name = usr
- DIR REC || RegFile || target ID = 0xfffffff00005837 || name = .DS_Store
- DIR REC || Dirctry || target ID = 0xfffffff00005838 || name = bin
- DIR REC || Dirctry || target ID = 0xfffffff00005881 || name = sbin
- DIR REC || RegFile || target ID = 0xfffffff000058e7 || name = .file
- DIR REC || Symlink || target ID = 0xfffffff000058e8 || name = etc
- DIR REC || Symlink || target ID = 0xfffffff0007e4db || name = var
- DIR REC || Dirctry || target ID = 0xfffffff0007e4dc || name = Library
- DIR REC || Dirctry || target ID = 0xfffffff0007e54d || name = .Trashes
- DIR REC || Dirctry || target ID = 0xfffffff000058e9 || name = System
- DIR REC || Symlink || target ID = 0xfffffff0007e4de || name = .VolumeIcon.icns
- DIR REC || Dirctry || target ID = 0xfffffff00000010 || name = .fseventsd
- DIR REC || Dirctry || target ID = 0xfffffff0007e4dd || name = private
- DIR REC || Dirctry || target ID = 0xfffffff0007e4df || name = .vol
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e6 || name = Users
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e4 || name = Applications
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e0 || name = opt
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e1 || name = dev
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e2 || name = Volumes
- DIR REC || Symlink || target ID = 0xfffffff0007e4e3 || name = tmp
- DIR REC || Dirctry || target ID = 0xfffffff0007e4e5 || name = cores

END: All done.

But Volume 0 is not (./drat list /mnt/i/disk.img 0 /):

The volume object map has Physical OID 0x832be.
Reading the volume object map ... OK.
Validating the volume object map ... OK.
Reading the root node of the volume object map B-tree ... OK.
Validating the root node of the volume object map B-tree ... OK.
The file-system tree root for this volume has Virtual OID 0x404.
Looking up this Virtual OID in the volume object map ... corresponding block address is 0x846d2.
Reading ... validating ... OK.
No records found with OID 0x2.

I can't do literally anything with this volume. FileVault wasn't enabled.
Also, I used command search with custom filters and I found that there's files with names like index.js and etc that were stored on this volume. Trying recover-raw does not give anything useful.

Any suggestions? Thank you.

jivanpal · 2021-03-18T21:27:19Z

jivanpal
Mar 18, 2021
Maintainer

Firstly, well done for figuring out how to adjust read_blocks() and drat search for your scenario 🙂

Regarding the macOS - Data volume, since the records for / (FS OID 0x2) cannot be found, you will have to use search to find the FS OIDs of any items you are interested in. I would try to figure out the FS OID of items in the user's home directory, so if that is /Users/john, search for Users, john, Documents, Desktop, Library, etc.; the name of any item you know to be somewhere beneath /Users/john will be helpful.

If you can find out the FS OID of /Users or /Users/john, then you can use drat list-raw with that OID to see the contents of that directory (assuming the records for that directory are intact). If you can find the FS OID of something within /Users/john, e.g. /Users/john/Documents, /Users/john/Desktop/random-file.txt, etc., then drat list-raw should be able to tell you the FS OID of that object's parent, allowing you to determine the Virtual OID of something useful such as /Users/john/Desktop, if not /Users/john itself... Actually, now that I think about it, only drat explore-fs-tree displays the Parent ID field, so you will need to add this output to drat list-raw by modifying print_fs_records(); change /src/apfs/print-fs-records.c:46 to the following:

fprintf(stderr, "INODE || Parent ID: %#"PRIx64"\n", val->parent_id);

Trying recover-raw does not give anything useful.

Are you sure you're using it correctly? drat recover-raw takes an FS OID (in contrast to drat recover, which takes a filepath, and won't work in your case since / is unresolvable), so if e.g. 0x123abc turns out to be the FS OID of /Users/john/Desktop/random-file.txt, then you should be able to recover it with drat recover-raw /mnt/i/disk.img 0 0x123abc > output-file.txt; without redirection, the contents of the file should be output to the terminal.

If you have any other questions, feel free to ask, and good luck!

13 replies

jivanpal Mar 24, 2021
Maintainer

Ah, I have just realised that the block address range being searched by drat search needs to be changed for your container (start_addr and end_addr variables in the source, search.c:161), so you are probably missing search results. The existing values were taken from a 480GB container, so if your container is much larger than that, this is almost certainly what is causing you not to see the entries you're expecting. You can use drat search-last-btree-node to figure out the block address of the last B-tree node on disk. This technically requires scanning the entire container, but the last node is probably within the first few percent of the disk, so you can probably stop searching (interrupt with CTRL+C) once the "Last match" value remains stable for a few minutes. You can then use the "First match" and "Last match" figures for start_addr and end_addr, respectively.

I would advise you search for everything listed in the default list, rather than just .zshrc. That is, assuming a conventional home directory, the following files/directories are guaranteed to exist in it:

Applications
Desktop
Documents
Downloads
Library
Movies
Music
Pictures

.localized is a file that appears within all of the above directories, and .DS_Store is also a good file to search for, because they'll be all over the place, assuming you use Finder often.

I would also like to point out the the term "Virtual OID" is incorrectly used in the output of explore-fs-tree; it should say "FSOID" instead. Apologies for any confusion.

tarik02 Mar 25, 2021
Author

It seems to be ok with end add_addr:

$ ./drat search-last-btree-node /mnt/i/disk.img
Opening file at `/mnt/i/disk.img` in read-only mode ... OK.
Reading block 0x0 to obtain block count ... OK.
The specified device has 34752512 = 0x2124800 blocks. Commencing search:

First match: 0xa5e3b
Last match:  0xf1311
Reading 0x13adf1 ...

Finished search; found 61385 results.

Will try to search for other files/directories.

tarik02 Mar 25, 2021
Author

No.. still can't recover from there. There's a few blocks looking like home directory:

Reading block   0xb29a3 ( 16.88%) ... LEAF NODE // OID = 0xaab4 // XID = 0x28cd18 ... Inspecting entries contained in this node ...
- Entry 18 ... DENTRY ... MATCHED --- query = Music --- match = Music
- Entry 20 ... DENTRY ... MATCHED --- query = Pictures --- match = Pictures
- Entry 21 ... DENTRY ... MATCHED --- query = Desktop --- match = Desktop
- Entry 22 ... DENTRY ... MATCHED --- query = Library --- match = Library
- Entry 23 ... DENTRY ... MATCHED --- query = Movies --- match = Movies
- Entry 24 ... DENTRY ... MATCHED --- query = Documents --- match = Documents
- Entry 25 ... DENTRY ... MATCHED --- query = Downloads --- match = Downloads

Reading block   0xb49af ( 19.54%) ... LEAF NODE // OID = 0x35140f // XID = 0x2821a0 ... Inspecting entries contained in this node ...
- Entry 4 ... DENTRY ... MATCHED --- query = Music --- match = Music
- Entry 6 ... DENTRY ... MATCHED --- query = Pictures --- match = Pictures
- Entry 7 ... DENTRY ... MATCHED --- query = Desktop --- match = Desktop
- Entry 8 ... DENTRY ... MATCHED --- query = Library --- match = Library
- Entry 9 ... DENTRY ... MATCHED --- query = Movies --- match = Movies
- Entry 10 ... DENTRY ... MATCHED --- query = Documents --- match = Documents
- Entry 11 ... DENTRY ... MATCHED --- query = Downloads --- match = Downloads

Reading block   0xea245 ( 90.64%) ... LEAF NODE // OID = 0x9eb4a // XID = 0x2365cc ... Inspecting entries contained in this node ...
- Entry 0 ... DENTRY ... MATCHED --- query = Pictures --- match = Pictures
- Entry 1 ... DENTRY ... MATCHED --- query = Desktop --- match = Desktop
- Entry 2 ... DENTRY ... MATCHED --- query = Library --- match = Library
- Entry 3 ... DENTRY ... MATCHED --- query = Movies --- match = Movies
- Entry 4 ... DENTRY ... MATCHED --- query = Documents --- match = Documents
- Entry 5 ... DENTRY ... MATCHED --- query = Downloads --- match = Downloads

Reading block   0xeba97 ( 92.66%) ... LEAF NODE // OID = 0x21370f // XID = 0x2365d2 ... Inspecting entries contained in this node ...
- Entry 9 ... DENTRY ... MATCHED --- query = Music --- match = Music
- Entry 11 ... DENTRY ... MATCHED --- query = Pictures --- match = Pictures
- Entry 12 ... DENTRY ... MATCHED --- query = Desktop --- match = Desktop
- Entry 13 ... DENTRY ... MATCHED --- query = Library --- match = Library
- Entry 14 ... DENTRY ... MATCHED --- query = Movies --- match = Movies
- Entry 15 ... DENTRY ... MATCHED --- query = Documents --- match = Documents
- Entry 16 ... DENTRY ... MATCHED --- query = Downloads --- match = Downloads

A lot of them belong to older dates when old user did exist. But they're all not readable. Recover command always show the same output:

ABORT: get_fs_records: Need to descend to node with Virtual OID 0x13ee4b, but the volume object map lists no objects with this Virtual OID.

jivanpal Mar 25, 2021
Maintainer

Firstly, can you share the command(s) you ran which gave that ABORT output? Again, just want to check that you are providing the right parameters.

tarik02 Mar 28, 2021
Author

Sorry for delay. I will show one example:
I used block from the output I provided above (0xb29a3) and supplied it to explore-fs-tree command:

Output

$ drat explore-fs-tree /mnt/i/disk.img 0xb29a3 0x8367f
Opening file at `/mnt/i/disk.img` in read-only mode ... OK.

Reading the file-system tree root node (block 0xb29a3) ... validating ... OK.

Reading the object map root node (block 0x8367f) ... validating ... OK.


Node details:
--------------------------------------------------------------------------------
Stored checksum:    0xa509f6aaa7e03bde
OID:                0xaab4
XID:                0x28cd18
Storage type:       Virtual
Type flags:         (none)
Type:               B-tree (non-root) node
Subtype:            File-system records tree
Flags:                          Leaf node
Number of child levels:         0
Number of keys in this node:    31
Location of table of contents:
- Offset from start of node data area:  0x0 = 0
- Length (bytes):                       0x140 = 320
Location of key–value shared free space:
- Offset from start of keys area:       0x771 = 1905
- Length (bytes):                       0xc3 = 195
--------------------------------------------------------------------------------


Node has 31 entries, as follows:
-   0:           0x615f = Virtual OID   ||    4 = 0x4 = Type
-   1:           0x615f = Virtual OID   ||    4 = 0x4 = Type
-   2:           0x615f = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =         0xe081bb   ||   Dentry name = com.apple.nsurlsessiond-launchd
-   3:           0x615f = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =         0xe01920   ||   Dentry name = 70D3879BCCBED0C0730B02BAF6FCDD03E3D14D00
-   4:           0x615f = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =         0xe01921   ||   Dentry name = bundles.plist
-   5:           0x615f = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x6189   ||   Dentry name = 1E63E8DC1D830BBB0C56F20CBC3704604A8057D0
-   6:           0x615f = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =         0xe081ba   ||   Dentry name = com.apple.nsurlsessiond
-   7:           0x615f = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =         0x3d1a5c   ||   Dentry name = .dat.nosync00ce.86kD38
-   8:           0x615f = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =         0xdfe672   ||   Dentry name = 352486D457D41AF10392FA452CEDE99DECF3461E
-   9:           0x6160 = Virtual OID   ||    3 = 0x3 = Type
-  10:           0x6160 = Virtual OID   ||    4 = 0x4 = Type
-  11:           0x6160 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =         0xe01992   ||   Dentry name = nsurlsessiond.launch
-  12:           0x6161 = Virtual OID   ||    3 = 0x3 = Type
-  13:           0x6161 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x6162   ||   Dentry name = com.apple.geod
-  14:           0x6162 = Virtual OID   ||    3 = 0x3 = Type
-  15:           0x6162 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =         0xe081f1   ||   Dentry name = Container.plist
-  16:           0x6162 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x6163   ||   Dentry name = Data
-  17:           0x6163 = Virtual OID   ||    3 = 0x3 = Type
-  18:           0x6163 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x6179   ||   Dentry name = Music
-  19:           0x6163 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x616e   ||   Dentry name = .CFUserTextEncoding
-  20:           0x6163 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x617a   ||   Dentry name = Pictures
-  21:           0x6163 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x6184   ||   Dentry name = Desktop
-  22:           0x6163 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x6164   ||   Dentry name = Library
-  23:           0x6163 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x6178   ||   Dentry name = Movies
-  24:           0x6163 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x616f   ||   Dentry name = Documents
-  25:           0x6163 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x617e   ||   Dentry name = Downloads
-  26:           0x6164 = Virtual OID   ||    3 = 0x3 = Type
-  27:           0x6164 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x6165   ||   Dentry name = Application Support
-  28:           0x6164 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x6323   ||   Dentry name = Filters
-  29:           0x6164 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x617b   ||   Dentry name = Saved Application State
-  30:           0x6164 = Virtual OID   ||    9 = 0x9 = Type = `dentry`   ||   Dentry Virtual OID =           0x6167   ||   Dentry name = Calendars
Choose an entry [0-30]: 24
Key size:           22 bytes
Value size:         18 bytes
ID and type field:  0x9000000000006163

Virtual OID:    0x6163
Object type:    Directory entry

Dentry name length:     10 UTF-8 bytes (including terminating NULL (U+0000) byte)
Dentry name hash:       0x32b8ad
Dentry name:            ### Documents ####
Dentry Virtual OID:     0x616f
Time added:             Sun Dec 15 22:31:53 2019
Dentry type:            Directory
No. extended fields:    0

Here I've got "Dentry Virtual OID" field with value 0x616f and I supplied this value to recover-raw command:

Output

$ drat recover-raw /mnt/i/disk.img 0 0x616f
Opening file at `/mnt/i/disk.img` in read-only mode ... OK.
Simulating a mount of the APFS container.
Validating checksum of block 0x0 ... OK.
Locating the checkpoint descriptor area:
- Its length is 280 blocks.
- It is contiguous.
- The address of its first block is 0xeb6e.
Loading the checkpoint descriptor area into memory ... OK.
Locating the most recent well-formed container superblock in the checkpoint descriptor area:
- Block at index 90 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 91 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 92 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 93 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 94 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 95 within this area failed checksum validation. Skipping it.
- Block at index 96 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 97 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 98 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 99 within this area failed checksum validation. Skipping it.
- Block at index 100 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 102 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 103 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 104 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 105 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 106 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 107 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 108 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 109 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 110 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 111 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 112 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 113 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 114 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 115 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 116 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 117 within this area failed checksum validation. Skipping it.
- Block at index 118 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 119 within this area failed checksum validation. Skipping it.
- Block at index 120 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 121 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 122 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 124 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 125 within this area failed checksum validation. Skipping it.
- Block at index 126 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 128 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 129 within this area failed checksum validation. Skipping it.
- Block at index 130 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 131 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 132 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 134 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 135 within this area failed checksum validation. Skipping it.
- Block at index 136 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 138 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 139 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 140 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 141 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 142 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 144 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 145 within this area failed checksum validation. Skipping it.
- Block at index 146 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 147 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 148 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 150 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 151 within this area failed checksum validation. Skipping it.
- Block at index 152 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 153 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 154 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 155 within this area failed checksum validation. Skipping it.
- Block at index 156 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 157 within this area failed checksum validation. Skipping it.
- Block at index 158 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 159 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 160 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 162 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 163 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 164 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 165 within this area failed checksum validation. Skipping it.
- Block at index 166 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 167 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 168 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 169 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 170 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 171 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 172 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 173 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 174 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 175 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 176 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 177 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 178 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 180 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 181 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 182 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 183 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 184 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 185 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 186 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 187 within this area failed checksum validation. Skipping it.
- Block at index 188 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 190 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 191 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 192 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 193 within this area failed checksum validation. Skipping it.
- Block at index 194 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 196 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 198 within this area failed checksum validation. Skipping it.
- Block at index 199 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 200 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 201 within this area failed checksum validation. Skipping it.
- Block at index 202 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 203 within this area failed checksum validation. Skipping it.
- Block at index 204 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 206 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 207 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 208 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 209 within this area failed checksum validation. Skipping it.
- Block at index 210 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 211 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 212 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 214 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 215 within this area failed checksum validation. Skipping it.
- Block at index 216 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 217 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 218 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 219 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 220 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 221 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 222 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 223 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 224 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 226 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 228 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 229 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 230 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 231 within this area failed checksum validation. Skipping it.
- Block at index 232 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 234 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 235 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 236 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 237 within this area failed checksum validation. Skipping it.
- Block at index 238 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 239 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 240 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 241 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 242 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 243 within this area is not a container superblock or checkpoint map. Skipping it.
- Block at index 244 within this area is not a container superblock or checkpoint map. Skipping it.
- It lies at index 257 within the checkpoint descriptor area.
- The corresponding checkpoint starts at index 256 within the checkpoint descriptor area, and spans 2 blocks.

Loading the corresponding checkpoint ... OK.
- There are 7 checkpoint-mappings in this checkpoint.

Reading the Ephemeral objects used by this checkpoint ... OK.
Validating the Ephemeral objects ... OK.
The container superblock states that the container object map has Physical OID 0x86e8d.
Loading the container object map ... OK.
Validating the container object map ... OK.
Reading the root node of the container object map B-tree ... OK.
Validating the root node of the container object map B-tree ... OK.
The container superblock lists 5 APFS volumes, whose superblocks have the following Virtual OIDs:
- 0x402
- 0x408
- 0x40a
- 0x40c
- 0x44c

Reading the APFS volume superblocks ... OK.
Validating the APFS volume superblocks ... OK.

 Volume list
================
 0: macOS - Data
 1: Preboot
 2: Recovery
 3: VM
 4: macOS
The volume object map has Physical OID 0x832be.
Reading the volume object map ... OK.
Validating the volume object map ... OK.
Reading the root node of the volume object map B-tree ... OK.
Validating the root node of the volume object map B-tree ... OK.
The file-system tree root for this volume has Virtual OID 0x404.
Looking up this Virtual OID in the volume object map ... corresponding block address is 0x846d2.
Reading ... validating ... OK.

ABORT: get_fs_records: Need to descend to node with Virtual OID 0xb8e37, but the volume object map lists no objects with this Virtual OID.

I did the same with other blocks from output above and did not get any useful results.

jivanpal · 2021-08-12T23:31:49Z

jivanpal
Aug 12, 2021
Maintainer

Hi @tarik02, apologies for my absence in recent months. Would you still like help with this issue? If not, I will lock this thread soon.

2 replies

tarik02 Aug 13, 2021
Author

Hi @tarik02, apologies for my absence in recent months. Would you still like help with this issue? If not, I will lock this thread soon.

Hi. I deleted the dump of that disk a few days ago. Thank you for your help, sad we couldn't recover the data.

jivanpal Aug 13, 2021
Maintainer

Ouch, talk about bad timing... I'll lock the thread, then.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

No records found with OID 0x2. #19

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 15 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

No records found with OID 0x2. #19

tarik02 Mar 17, 2021

Replies: 2 comments · 15 replies

jivanpal Mar 18, 2021 Maintainer

jivanpal Mar 24, 2021 Maintainer

tarik02 Mar 25, 2021 Author

tarik02 Mar 25, 2021 Author

jivanpal Mar 25, 2021 Maintainer

tarik02 Mar 28, 2021 Author

jivanpal Aug 12, 2021 Maintainer

tarik02 Aug 13, 2021 Author

jivanpal Aug 13, 2021 Maintainer

tarik02
Mar 17, 2021

Replies: 2 comments 15 replies

jivanpal
Mar 18, 2021
Maintainer

jivanpal Mar 24, 2021
Maintainer

tarik02 Mar 25, 2021
Author

tarik02 Mar 25, 2021
Author

jivanpal Mar 25, 2021
Maintainer

tarik02 Mar 28, 2021
Author

jivanpal
Aug 12, 2021
Maintainer

tarik02 Aug 13, 2021
Author

jivanpal Aug 13, 2021
Maintainer