sparsebundle corrupt: "no mountable file system" & "not a character device"

Question

Level 1

20 points

sparsebundle corrupt: "no mountable file system" & "not a character device"

Hi,

I cannot mount and open the 20GB encrypted Personal.sparsebundle disk image. I have been using the disk image okay for over a year now. It's modified several times a day; therefore, it's excluded from the TimeMachine backup. The contents are EXTREMELY important and I CANNOT afford to lost it.

In Finder I double-click the sparsebundle file to mount & open it. I'm prompted for the password, I enter it, and then an error message "no mountable file system".

I've tried:
(1) sudo fsck_hfs -p -df /Volumes/DHD1/Users/don/Personal.sparsebundle
and got:
/Volumes/DHD1/Users/don/Personal.sparsebundle: starting
/Volumes/DHD1/Users/don/Personal.sparsebundle: /Volumes/DHD1/Users/don/Personal.sparsebundle is not a character device
/Volumes/DHD1/Users/don/Personal.sparsebundle: UNEXPECTED INCONSISTENCY; RUN fsck_hfs MANUALLY.

(2) sudo fsck_hfs -r -df /Volumes/DHD1/Users/don/Personal.sparsebundle
and got:
/Volumes/DHD1/Users/don/Personal.sparsebundle is not a character device
CONTINUE? [yn] y
** /Volumes/DHD1/Users/don/Personal.sparsebundle (NO WRITE)
Can't get device block size

I created a new encrypted sparsebundle disk image and added some files. Then used HexFiend to look inside at the hex representation of each disk image's band contents. The encryption hid everything as I expected, so no clues were found. The corrupted disk image has a 123KB token file and the new encrypted disk image has a 0KB token file.

I tried a trial version of Data Rescue 3, but I couldn't mount the corrupted encrypted disk image, so Data Rescue 3 was unable to help. In Expert mode I added the encrypted disk image to the volume list, but still no help.

I couldn't find a trial version of DiskWarrior. All the Google search results contained information that DiskWarrior was used by others without success.

I'm a Unix newbie, so I've been reading through as many MAN pages that I think have to do with volumes, directories, and files. But I'm not making any progress.

I've been working on this problem for a couple of days now.

Does anyone have any ideas?

Thank you in advance,
Don Leckie

Mac Pro 2 x 2.8GHz Quad-Core Intel Xeon, Mac OS X (10.6.2), 18GB RAM, 3 1TB disks, 30" Cinema Display, Logitech WebCam, 2TB TimeCapsule

Posted on Dec 2, 2009 7:08 AM

Reply

Answer 1

V.K.

Level 9

56,238 points

Dec 2, 2009 8:21 AM in response to DonLeckie

oh brother, you have some crucial data encrypted and you specifically exclude it from any backups?! what exactly were you thinking of? sparse bundles were specifically designed so that TM can back them up efficiently. only changed bands are backed up afresh on each TM backups. everything else is hard linked to existing backup copies. but even if you don't want to use TM, back it up with something else. a corrupted encrypted sparse bundle is *almost never* recoverable.

the terminal command you are trying to run can not work because you are trying to run it on a sparse bundle which is not attached yet. you can't do it that way. you need to attach the sparse bundle first.


sudo hdiutil attach /path/to/sparsebundle -nomount

if the command succeeds you can try repairing it. the output of the command will tell you which device it was attached to. look at the one that says Apple_HFS . it will have the device number along the lines /dev/disk5s2
then run


sudo fsck_hfs -f /dev/disk5s2

any luck? run it several times if need be.

Reply

Answer 2

DonLeckie Author

Level 1

20 points

Dec 2, 2009 9:07 AM in response to V.K.

Hi V.K.,

Thank you. I did everything you wrote, but it looks like the contents are lost. Please see Terminal output below.

I mistakenly thought that the entire 20GB Personal.sparsebundle would be backed up because I was looking the sparsebundle as a file. That would quickly fill up the TimeMachine backup with hourly backups. Thank you for explaining that only the changed bands will be backed up. I will now use TM for backing up sparsebundles.

Thrice a day I had been saving another copy of Personal.sparsebundle on another disk as a backup. Unfortunately, when I discovered first thing in the morning that the Personal.sparsebundle was corrupt, the backup was also corrupt.

Thank you again,
Don

MacPro:~ don$ sudo hdiutil attach /Volumes/DHD1/Users/don/Personal.sparsebundle -nomount
Enter password to access "Personal.sparsebundle":
/dev/disk3

MacPro:~ don$ sudo fsck_hfs -f -d /dev/disk3
** /dev/rdisk3
Using cacheBlockSize=32K cacheTotalBlock=73728 cacheSize=2359296K.
Executing fsck_hfs (version diskdev_cmds-491~1).
Block 2 is not an MDB or Volume Header
Block 41943102 is not an MDB or Volume Header
unknown volume type
primary MDB is at block 0 0x00
alternate MDB is at block 0 0x00
primary VHB is at block 0 0x00
alternate VHB is at block 0 0x00
sector size = 512 0x200
VolumeObject flags = 0x01
total sectors for volume = 41943104 0x2800040
total sectors for embedded volume = 0 0x00
CheckForClean - unknown volume type

MacPro:~ don$ sudo hdiutil attach /Volumes/DHD1/Users/don/Personal.sparsebundle -nomount
/dev/disk3

MacPro:~ don$ sudo fsck_hfs -r -f -d /dev/disk3
** /dev/rdisk3
Using cacheBlockSize=32K cacheTotalBlock=73728 cacheSize=2359296K.
Executing fsck_hfs (version diskdev_cmds-491~1).
Block 2 is not an MDB or Volume Header
Block 41943102 is not an MDB or Volume Header
unknown volume type
primary MDB is at block 0 0x00
alternate MDB is at block 0 0x00
primary VHB is at block 0 0x00
alternate VHB is at block 0 0x00
sector size = 512 0x200
VolumeObject flags = 0x01
total sectors for volume = 41943104 0x2800040
total sectors for embedded volume = 0 0x00
CheckForClean - unknown volume type

Reply

Answer 3

V.K.

Level 9

56,238 points

Dec 2, 2009 9:14 AM in response to DonLeckie

this does not look promising but try repairing just the device for the HFS partition. don't repair the whole disk3. after the first attach command it should say something like this


/dev/disk5 Applepartitionscheme 
/dev/disk5s1 Applepartitionmap 
/dev/disk5s2 Apple_HFS

so you need disk5s2 not disk5 for fsck. try that please.

Reply

Answer 4

DonLeckie Author

Level 1

20 points

Dec 2, 2009 11:46 AM in response to V.K.

Unfortunately, that's the problem. The partition map and file system either no longer exist or too corrupted to access.

/dev/disk3 is the only output from hdiutil attach.

I've been experimenting with other hdiutil verbs and options without success. I thought maybe if the sparsebundle could be decrypted, then maybe other Unix tools might recover some of the data. Maybe hacking or extracting from the decrypted sparsebundle with Hex Fiend might be possible. At least I could view the sparsebundle's character contents in Hex Fiend.

Reply

Answer 5

DonLeckie Author

Level 1

20 points

Dec 2, 2009 11:48 AM in response to DonLeckie

Here's a sample of what I've been doing today:

MacPro:~ don$ sudo hdiutil isencrypted /Volumes/DHD1/Personal_copy.sparsebundle
Password:
encrypted: YES
blocksize: 4096
uuid: 7D1175DE-8D95-485B-9ABB-A49E553A57D8
private-key-count: 0
passphrase-count: 1
max-key-count: 1
version: 2

MacPro:~ don$ sudo hdiutil imageinfo /Volumes/DHD1/Personal_copy.sparsebundle -encryption AES-256 -format
Enter password to access "Personal_copy.sparsebundle":
UDSB

MacPro:~ don$ sudo hdiutil pmap /Volumes/DHD1/Personal_copy.sparsebundle -complete
Enter password to access "Personal_copy.sparsebundle":
scheme: none
block size: 512
_ ## Type _______________ Name _______________ Start _ Size __
+ unknown partition whole disk 0 41943104
+ synthesized

MacPro:~ don$ sudo hdiutil convert /Volumes/DHD1/Personal_copy.sparsebundle -format UDSB -o /Volumes/DHD1/Personal_Glenda.sparsebundle -pmap
Enter password to access "Personal_copy.sparsebundle":
Reading whole disk (unknown partition : 0)…
................................................................................ ................................................................................ ...................................
Elapsed Time: 4m 47.600s
Speed: 71.2Mbytes/sec
Savings: 0.0%
created: /Volumes/DHD1/Personal_Glenda.sparsebundle

Reply

Answer 6

V.K.

Level 9

56,238 points

Dec 2, 2009 1:02 PM in response to DonLeckie

DonLeckie wrote:
Unfortunately, that's the problem. The partition map and file system either no longer exist or too corrupted to access.

then this is beyond my meager skills to fix. you can try asking in the unix forum under os x technologies. there are a few very knowledgeable people there who don't frequent the SL forum. but as I said, I'm quite pessimistic about the possibility of recovering anything now.

/dev/disk3 is the only output from hdiutil attach.

Reply

Answer 7

DonLeckie Author

Level 1

20 points

Dec 2, 2009 1:15 PM in response to V.K.

Hi V.K.,

Thank you for your valuable. I much appreciate.

I'll take your advice and look into unix forums.

Thank you again,
Don

Reply

Answer 8

Dec 9, 2009 12:16 PM in response to DonLeckie

Have you checked file permissions for token, info.plist, and the other files inside the package besides the bands?

I got a "no mountable filesystem" error and when I set the permissions for those files, I could mount the image again and use DiskWarrior to attempt to repair it.

info.plist and token should be read/write and owned by the user that initiated the backup. It's also important that everyone have no access.

Reply

Answer 9

Tim N

Level 1

5 points

Dec 20, 2009 12:49 AM in response to DonLeckie

I am at least unsure if Unix experts can help you there. A usual sparseimage (aka sparsebundle) file consists of three different partitions that are each crucial for unencrypting the file. Try this nevertheless:

*hdiutil convert shortusername.sparseimage -format UDRW -o shortusername.dmg*

If you can -for whatever reason- unencrypt the file, tools like Diskwarrior or DataRescue (I personally prefer DataRescue) will find file headers and restore at least tome files. On the encrypted disk both tools won't find any files..

Reply