Please help! Invalid node structure and invalid record count

Just a heads up I'm not one for long posts, but I wanted to include all the details for anyone who finds themselves in the same situation.😉

I was working on an iMac (mid-2007) on 10.6.8 in Pages (eternally a trouble free event), and as I was finishing making some pdf's, saving and doing some other things. A bit later I noticed an odd save dialog box in Pages, so I checked what I had just done and it was fine. I quit and moved on other things off the computer. When I came back a while later, I went to launch Pages and the dock icon just bounced, and bounced and bounced before stopping with no small light underneath. The force quit dialog showed it was open, and if I tried to force quit it took a very long time. I went through that process a few times with no luck. Other programs seemed to work such as Safari and Mail. I decided to see what Disk Utility would tell me about the internal hard drive. it said I had an "invalid node structure" and had to repair the disk.

I have a back up external FW drive connected, so I booted into that drive to repair the hard drive. I tried Disk Utility (without high expectations), it started, then it said it could not repair the disk and it needed to be reformatted. It then said the disk would now be read only and I could copy files from it but not save to the disk. When I would restart it would get to the gray Apple screen, start to load, then the whole machine would just shut down. The back up is a few days old, so I could just have moved any files that were between the back up and the current state, reformatted the drive, take the reformatted drive and clone the back up back to the drive and try to fit in any differences between the two. Not easy or fun, but possible.😟

My next thought was to move to something like TechTool, before finally resorting to the reformat, but I decided to do some research on the node issue first. I landed on this thread and although it didn't work right out of the box, it gave me more than enough for a great foundation to fix my node issue on the internal hard drive. So many thanks to all of the posters, especially Chris Watts!

When I officially launched the Terminal (running from the external) I ran the "sudo /sbin/fsck_hfs -yprd /dev/disk0s2" command (disk0s2 the designation of the drive from Disk Utility info) and got: "starting, NO WRITE ACCESS UNEXPECTED INCONSISTENCY; RUN fsck_hfs MANUALLY". So I tried this few more times with no luck. I did a little more investigation and found it would help to unmount the disk and try again. I launched Disk Utility (still running from external) and tried to unmount the disk (partition). No luck, it said the drive could not be unmounted, so I did more investigation and found the following terminal command to force unmount: "sudo diskutil unmountDisk force /dev/disk0s2". This worked, the disk was now unmounted.

So back to the Terminal and then I did the command: "sudo /sbin/fsck_hfs -yprd /dev/disk0s2". This time it worked and was doing its business but stopped midway through with an error. I recalled one of Chris Watts' posts in this thread: "But don't despair. Try this, and don't give up till you've tried it at least three times", so I did it again in the Terminal AND THE REPAIR FULLY WORKED! I did it one more time just to make sure!

I then went back to Disk Utility and was able to remount the disk (partition) without issue. I also did a verify in Disk Utility, and it resulted in a positive report as well. I went to System Preferences: Start Up Disk and chose the internal drive partition and rebooted. Everything is working as it did before the "Node Issue".

Yes it was tedious and scary and a little frustrating at times, but everything is fine now; and I give my deepest thanks to the posters here for making me believe!

Hi Chris. I did it 5 times so far. The result is the same.

The invalid nod is in a partition of an external drive that i use for time machine. The other partition is fine.

(And i also tried to delete the partition in disk utility but it freezes during unmounting.)

The disk is western digitals Black.

sudo /sbin/fsck_hfs -yprd /dev/disk2s2

Password:

/dev/rdisk2s2: starting

Using cacheBlockSize=32K cacheTotalBlock=24576 cacheSize=786432K.

Executing fsck_hfs (version diskdev_cmds-491.6~3).

Journal replay returned error = 6

** Checking Journaled HFS Plus volume.

** Checking extents overflow file.

** Checking catalog file.

** Rebuilding catalog B-tree.

hfs_UNswap_BTNode: invalid node height (1)

** Rechecking volume.

** Checking Journaled HFS Plus volume.

** Checking extents overflow file.

** Checking catalog file.

Incorrect number of thread records

(4, 29734)

CheckCatalogBTree: fileCount = 2194332, fileThread = 2194441

** Checking multi-linked files.

Incorrect number of file hard links

Error getting link=4268182 for inode=2000044

filelink prime buckets do not match

** Checking catalog hierarchy.

Invalid directory item count

(It should be 1372 instead of 1396)

Invalid directory item count

(It should be 4984 instead of 5013)

Invalid directory item count

(It should be 50335 instead of 50391)

** Checking extended attributes file.

hfs_swap_BTNode: record #42 invalid offset (0x000C)

Invalid node structure

(8, 131918)

** The volume TIME_MACHINE could not be verified completely.

volume check failed with error 7

volume type is pure HFS+

primary MDB is at block 0 0x00

alternate MDB is at block 0 0x00

primary VHB is at block 2 0x02

alternate VHB is at block 2539062502 0x975704e6

sector size = 512 0x200

VolumeObject flags = 0x07

total sectors for volume = 2539062504 0x975704e8

total sectors for embedded volume = 0 0x00

It doesn't work for me:

sudo /sbin/fsck_hfs -yprd /dev/disk2s2

/dev/rdisk2s2: starting

journal_replay(/dev/disk2s2) returned 22

Using cacheBlockSize=32K cacheTotalBlock=32768 cacheSize=1048576K.

Executing fsck_hfs (version hfs-305.10.1).

Block 2 is not an MDB or Volume Header

CheckForClean - could not get VHB/MDB at block 819122278

** Checking Journaled HFS Plus volume.

hfs_swap_HFSPlusBTInternalNode: catalog key #65534 offset too big (0x0000)

Invalid node structure

(4, 0)

** The volume could not be verified completely.

volume check failed with error 7

volume type is pure HFS+

primary MDB is at block 0 0x00

alternate MDB is at block 0 0x00

primary VHB is at block 2 0x02

alternate VHB is at block 819122278 0x30d2d066

sector size = 512 0x200

VolumeObject flags = 0x05

total sectors for volume = 819122280 0x30d2d068

total sectors for embedded volume = 0 0x00

CheckForClean - could not get VHB/MDB at block 819122278

CheckHFS returned -1317, fsmodified = 0

I have an USB disk with two partitions (4 actually, it was the internal disk of my old MacBook with Lion and Yosemite installed plus the recoveries). What drives me mad is that it has been the new magnificent Disk Utility in El Capitan killing the partitions!!

All right, guys. I ran into this problem early today and it looks like I manage to get my MacBook Air up and running. As I am on vacation there are no any Apple Geniuses areound for 1 thsnd miles min 😉 And I wanted my laptop back badly ) So I had to do something..

Problem diagnosis

1. Rebooted my MacBook Air (El Capitan, latest), an Apple logo and progress bar appears.. progress bar moved almost to the end and black screen and see my mac as it was switched off. Repeated 3 times - same result. Computer shuts down before showing users welcome screen.

2. Cmd + I and see what logs are saying. I am sorry, I did not realized I will be writing this - I did not take screenshot. Anyway - on the disk mounting process /sbin/fsck started, diagnosed some errors, failed to repair (split second) and shot system down.

3. Cmd + S and have a single user mode. Thanks G.. it did not reboot. Also it did not mount fs. It proposes to run two commands

/sbin/fsck -yf

/sbin/mount /

4. I ran fsck - with an interesting result - it stuck with "CreateNewBTree returned -34" and then "disk full"

5. Checked with "df" command - I had 8GB free space of 512GB. Small. Let's kill rm -rf /Users/<my user>/Downloads. Now i have 24GB - no way.

6. fsck - no luck, still the same result. Then I realized it tries to rebuild BTree - it does not cares about size of the files. It cares about number of nodes (# of dirs and files!). And recently I played with git and created thousands of files in my development dir.

SO, diagnosis:

1) IT LOOKS LIKE FS NODES INDEX GOT CURRUPTED SOMEHOW

2) TOO MANY FILES (NODES) IN FS MADE IT IMPOSSIBLE FOR FSCK (AND GUI REPAIR TOOL) TO COPE WITH IT

Solutions research

#1: turn of fsck check on boot and then clean up the drive

#2: clean up nodes

I choosed to try #1 and failed. Did a lot of research on how to turn off fsck in /etc/fstab etc.. You should get device UID and make a custom line in /etc/fstab file with 0 0 at the end to prevent fsck to check this device. Too risky, not clear how it will work on El Capitan.

Then I went to #2..

Solution

1. Cmd + S

2. rm -rf /Users/<my user>/Sites (here a LOT of files was created by git)

..after 1-2 min of deletion..

3. /sbin/fsck -yprd /dev/disk0

..now it fixes things..

4. shutdown -r now

5. Let it boot up (will take a LOOONG time). Then for mee it booted up in Safe mode.

6. Reboot once again - ok, we have system up and running.

Few comments to Apple guys -

1) how f. did you come up with error -34 for this situation??? Can you make this whole fsck_hfs messaging more clear and helpful? Like "Okay, you have too many nodes and FS got corrupted. Pleas rm -rf ..X..files.. and press Y to repair."

2) there is need an easy way to turn off fsck on bootup manualy without risking to crush the system (fstab and /sbin/vifs are ridiculus stupid rudiments in 21st century)

3) repair tool (GUI) should be more clever than fsck. Now it is not (I suppose it is just dumb GUI for fsck_hfs).

As you can imagine, all these steps are made with back and forth try-and-error approach. Frankly I am really upset I've lost 4 hours wrestling back and forward to get my Mac back working. There is no really deep advise on this topic in Google, and a lot of people struggling with this symptoms. That's why I wrote this post (another +0,5 hour lost).

Hopefully, this will save a few hours of yours. Russian engineering force is awaken 🙂 All best wishes! Peace! Andrey

Did not work for me having done exactly the fix suggested.

At the end I get the following:

hfs_swap_HFSPlusBTInternalNode: unrecognized catalog record type (0x0000; record #40)

RebuildBTree - Record length validation (file 4) failed!

RebuildBTree - Record 40 in node 19332 is not recoverable

The volume could not be repaired

Awesome man! Helped me so much! I just fooled around with my windows partition which of course is on the same disk as my macintosh hd.. Well I hadn't backed up for three weeks so that was one of the very big reasons to keep trying to boot this machine up. Your instructions were really clear and simple and of course the result is this text that I'm writing with my working machine!

Thank you so much! You should be awarded for helping this many people on solving this problem which also the "geniuses" I bet wouldn't be able to solve...

Hi Chris,

This command saved my day! Actually my weekend!! And of course all my files 😉

Thank you very much!!!

This may be a little late, but you should try starting from a bootable OS install CD. and then retry the above steps...

You want to type this in the terminal. You will see Terminal as a menu option when booting from the installer disk.

chris

Hi Chris,

Your magic worked like a charm!

Thanks for sharing,

1800ITplace

HHi Chris,

i have tried this and I get the following

starting

no write access

unexpected inconsistency run fsck_hfs manually.

Now what?

Chris ... this was VERY helpful. I did have to drop the "sudo" part of it, but I just wanted to say thanks for helping us all out with this solution. I appreciate it.

Larry

Loved this solution. Thanks a lot.

Chris, you have been a massive help. I thought i'd lost all my files.

Much appreciated!