Bootstrapper Crash Need to Backup FileVault Home Folder Before Rebuilding

Couldn't figure out how to edit post, but here is an update

I thought the purpose of the sparse bundle bands was to allow for some file recovery in the sparse bundle when some bands become corrupted... I must have misunderstood something... been reading for hours.

After plowing through too many pages to count I tried the following:

hdiutil isencrypted mtkessel.sparsebundle

The answer, as expected, was "YES" with a plethora of other information.

Then I tried the following:

hdiutil attach -encryption -noverify -ignorebadchecksums mtkessel.sparsebundle

Reponse: attach failed - no mountable file system

To verify that the result was not an authentication problem I tried it again with an invalid password.

Reponse: attach failed - Authentication error

So it appears that the errors in bands 1 and 10 have killed the sparse bundle? Seems like a weak approach unless there is a decryption relationship I am misunderstanding. I.e., password correct, but decryption failing due to error in bands such that the attach fails?

I need to read through the rest of the options to see if anything is recoverable.

Hopefully someone with a better understanding of this will pop up soon. :-)

Aha!

-nomount ... as in...

hdiutil attach -encryption -noverify -ignorebadchecksums -nomount mtkessel.sparsebundle

Displayed the following:

/dev/disk9 Apple_partition_scheme

/dev/disk9s1 Apple_partition_map

/dev/disk9s2 Apple_HFS

Which I suppose means the sparse bundle is "attached"... still not entirely sure how to get to the data... but working on it!

Since I am still working from the OS X install DVD I am having to switch between the Disk Utility and Terminal applications... cumbersome, but slow and steady progress...

From Disk Utility the sparse bundle now appears as disk9s2 in the left hand pane.

This device would not mount (as was discovered with the hdiutil)

Running Verify on this device (disk image) identifies an "Invalid B-tree node size"

Unfortunately "Repair" says the same things and then says it can't fix it strangely after printing out that the repair is complete followed by updating a boot support partition... should I believe it? Repeating repair several times yields the same result... no progress, at least one B-tree node size is still incorrect.

So the question now is how to mount the virtual device even when it is "broken"...

Anyone?

Yep, I was perusing their website just about the same time you posted!

Local Apple store opens at 10:00 am... Hopefully they have it in stock.

Everything was going well (was able to copy most of the corrupted sparsebundle), attach the original "corrupted" image, and finally got the fsck (Disk Utility) to pretty much tell me what was obvious... kind of lacking that Apple does not provide the full repair solution with OS X... but $50 isn't so bad...

This was much easier 30 years ago with my Apple II+...

Thanks for replying.

Yes, my first thought, but my backups are about 3 months out of date (bad, Mike, bad). Normally, I incrementally back up every day and full once a month, but a lot of early to work and late getting home over the last few months... well, here we are.

I really wouldn't lose much... e-mail receipts, and some little league picts that I e-mailed to family (which could get e-mailed back)... but $100 is really much to try considering the time it will take to re-collect (as well as re-build Application states from updates).

Anyway, many of the other threads suggest DW for even the most dire situations, so I figure I'll give it a try.

Thanks for the reply!

Ah, yes, I see that now that I've had my coffee...

I'll post back regardless of the results...

DiskWarrior appears to be a B+ product; had a few crashes with it but in the end replacing the directory structure on the original disk is not an option due to the 200+ physical malfunctions detected. So I'll be replacing the internal drive on my 6 year old iMac... maybe I'll by a new one and let the kids use the older one... hmmm.

The Preview version of the directory structure looks mostly okay with about 500+ recovered files, several which appear to be bands from the FileVault sparsebundle. Looking at the copy I made earlier is appears that 3 of the bands are damaged, being smaller than the standard size (explaining the I/O errors I saw earlier); this may be what prevents me from using anything in the sparsebundle. I need to re-run the DW Rebuild due to the previous crash so I can try to backup the image to another drive, then I can move the recovered files to their correct locations (if possible) and try to launch from that disk.

If that does not work I will just re-build a disk from scratch and then restore from the backup.

The only last thought is whether there is a utility to extract information from each of the bands directly even if the image won't mount... there must be something...

So, remember when I said, earlier, that I copied the FileVault sparsebundle? Well, not exactly. While the copy had expected errors in some of the bands, the total size was suspiciously small.

The sparsebundle bands are 8.4 MB each, so for a 75 GB home folder there should be more than 9000 bands. Only 500-ish were copied from the damaged HD.

Fortunately, DW did actually locate all of the bands (intact or otherwise). 9017 bands were in the sparsebundle where they should have been, and 85 bands were in the "Rescued" folder. Most of the damage was to the directory structure outside the sparsebundle, although some bands are damaged as well.

After I get all of the bands re-grouped into the sparsebundle on a different HD I will see if DW can repair it (i.e., at least 4 bands appear to be damaged, which may prevent mounting, but I should be able to attach the sparsebundle as a device and then it should be repairable). Okay, I am hoping....

If it weren't for the occasional "unexpected error" and crash from DW, I would upgrade my rating to A-, for what that is worth.

mk

It took many hours to copy the FileVault sparsebundle (both size and device issues I suppose), but I managed to re-assemble it, including the "Rescued Items"; I just used the unix cp -R on the sparsebundle file to force the copy to report the I/O errors... about a dozen or so of the 9000+ bands are damaged.

Could not really tell if anything other than the "Rescued Items" were missing since bands can be deleted during normal use.

I then attached the sparsebundle (which is encrypted) with a shadow (i.e., this sparsebundle is not mountable)

This is the command I used from the directory containing the COPY of the sparsebundle.

hdiutil attach -encryption -noverify -ignorebadchecksums -nomount mtkessel.sparsebundle -shadow bundle.shadow

I am not entirely sure, but the shadow option allows read-only behaviors on the device to be circumvented by allowing write through the shadow...

Enter the password and then I had he "device" appeared in the dropdown menu in DW and then I was able to re-build it.

Then in Preview I was able to see a fully mounted device from which I have started copying. The damage was "easily corrected" according to DW. It may take several hours to copy as well (this time probably due to the decryption as it copies)

I am starting to experiment with the Mail import features to see if I can recover the e-mails... my first attempts of importing from both Apple mailboxes as well as mbox format did not work. And, simply copying the emlx files into the mbox destinations does not work... The items simply don't show up in Mail... I am sure I will figure it out eventually, but any advice on importing the emlx files would be much appreciated!

mk

Sorry, I forgot to create a final post on this.

Everything worked fine. I only lost a few photos as near as I can tell.

All of the e-mail was recovered as well... but I don't remember how I did that 7 month later.

The final point is that a damaged sparsebundle on a damaged drive is not as catastrophinc as it sounds, just time consuming. Total time to recover the data to a temporary drive, install a new internal drive, rebuild the system, and move the data back was about 1 week... mostly copying files.

My boys had fun disassembling the bad hard drive and degaussing it... it was cool, as they said.

Hopefully this thread will help someone else fix any similar problems.

Backups are regularly scheduled, now, including full images periodically (saving me from having to re-install upgrades)

Cheers,

mk