Restoring a File Vault User from Time Capsule fails

Question

Restoring a File Vault User from Time Capsule fails

Hi!

Summary:

I can't restore a FileVault User Account from a Time Machine to its original state. The user account is said to be corrupted, the offered repair always fails.

So here's the details:

There's a MacBook Pro that has been upgraded to Lion. After 2 days, it went bananas, with the whole HD content seemingly being erased. Someone else restored it to a Snow Leopard native state (no users). Upon arriving at home, the recovery process was started from the "Welcome to Macintosh" assistant. All went well (during the whole night) until in the morning, OS X wouldn't let the user log in, saying the user has been damaged and has to be repaired, afterwards failing in the repair process.

Another attempt with a full recovery (starting from an external drive, choosing the Time Machine Recovery Utility) resulted in the same state. For this, an older Time Machine Setpoint was chosen, which was before the Lion install.

A third attempt: A fully updated 10.6.8 with a separate admin user was installed, and the migration assistant was launched. The file vault user account could not be restored, of course. After activation of the root user in directory services and a login as same, this still was the result: Settings and Applications could be restored, but not the Filevaulted User account.

What can I do?

Any help would be greatly appreciated! 10 years of photos are waiting for restoration... (And yes: FileVault will be deactivated once this is over 😉)

Regards,

Immo

Posted on Jul 28, 2011 4:57 AM

Reply

Answer 1

Best reply

Pondini

Level 8

38,863 points

Jul 28, 2011 4:14 PM in response to Immo Junghaertchen

This might help: http://www.thexlab.com/faqs/fixfilevault.html

Reply

Answer 2

Linc Davis

Level 10

209,547 points

Jul 28, 2011 4:58 PM in response to Immo Junghaertchen

I find it hard to believe that all Time Machine backups of the FileVault sparsebundle are corrupt.

Although it's generally a bad idea to access a TM repository in the Finder, in this case it's warranted. Turn off Time Machine. Check "Ignore permissions on this disk" in the Info dialog for the TM volume. Drill down into the Backups.backupdb folder until you find the FV user's home folder, in which there is a file called "something.sparsebundle." Open that file. Does it mount? If not, try an older one. Do not move the sparsebundle file out of the repository.

If you do manage to find a mountable sparsebundle, delete and recreate the user. Then restore his files manually from the mounted disk image.

Reply

Answer 3

Jul 29, 2011 5:24 AM in response to Pondini

Hi!

Thanks for the link! Unfortunately, this is a single user system, so since there is only one user and it's corrupt, I can't login as admin. Trying to add a new user via terminal from a different boot volume fails. There is a master keyword set, but the root user is not activated. And whenever I try grafting the filevaulted user to an existing OS with an admin user, the migration assistant won't let me import FileVault users. So there's one dilemma.

I also tried opening the spare bundle from the other drive, but I only get the message that there aren't any launchable file systems. So repair from Disk Util and/or Warrior won't be possible either.

Reply

Answer 4

Jul 29, 2011 5:34 AM in response to Linc Davis

Me too - so I started going through all the save-points, navigated to the Users folder, and tried opening the sparse bundle. From "latest" down to mid-January, I always get the message that it can't activate any file systems. Further back in time, I get "not recognized".

I'm at my wit's end now. I tried repairing the time machine sparse bundles, first on an external disk onto which I archived the Time Capsule content to, then on the Time Capsule itself. Either everything is fine (surrounding sparse bundle) or even the verification is impossible (single user sparsebundles).

Any more ideas, anybody?

Reply

Answer 5

Linc Davis

Level 10

209,547 points

Jul 29, 2011 6:10 AM in response to Immo Junghaertchen

Further back in time, I get "not recognized".

What exactly is the error message? Are permissions ignored on the drive?

Reply

Answer 6

Jul 29, 2011 6:21 AM in response to Linc Davis

"Keine aktivierbaren Dateisysteme", and further back in time, I get "nicht erkannt". Since this is all in German, I can only guess the English version. Erkennen = to perceive, identify, recognize, find out, detect. So it's not perceived, identified, recognized, found out, or detected.

The Archive of the Time Capsule contents is on an external volume, so the permissions are ignored by default (I just checked), and on Time Capsule itself, the option to ignore permissions is missing from the info dialog.

Do you have an idea? Please say yes! 😀

Reply

Answer 7

Linc Davis

Level 10

209,547 points

Jul 29, 2011 6:39 AM in response to Immo Junghaertchen

The Archive of the Time Capsule contents is on an external volume...

I'm not sure I understand this. Did you copy the Time Capsule's data to another device? When?

Reply

Answer 8

Jul 29, 2011 6:44 AM in response to Linc Davis

Yesterday (after all the problems occurred, as a security measure). When logging into TimeCapsule via the Airport Utility, there's a handy "archive" functionality which copies the contents from TimeCapsule's internal HD to a USB-connected drive. The problems are the same on either drive, so I didn't elaborate.

Reply

Answer 9

Linc Davis

Level 10

209,547 points

Jul 29, 2011 7:25 AM in response to Immo Junghaertchen

Drag one of the copied FV images into the volume list in a Disk Utility window. Select it and run "Repair Disk." What is the output?

Reply

Answer 10

Jul 29, 2011 7:59 AM in response to Linc Davis

"Invalid Node Size of B-Tree header. The Volume "" can not be repaired. Please copy as many files as possible, re-format the drive and restore your files."

Reply

Answer 11

Linc Davis

Level 10

209,547 points

Jul 29, 2011 8:21 AM in response to Immo Junghaertchen

I'm having a hard time understanding what happened here, but evidently you're in a recovery situation. I don't have experience in that area.

I've read that the commercial product Disk Warrior can repair disk images that don't mount. I suggest you contact the vendor, Alsoft, or otherwise determine whether that's true. If so, you should consider trying it. DW is capable of recovering, at least partially, some damaged HFS volumes that Disk Utility can't repair.

If the lost data is of high value to you, you should also consult with a professional data recovery service such as DriveSavers to find out whether they can help. Their services are very expensive, but probably also more effective than anything you could do yourself.

Reply