Recovering Disk Images with DiskWarrior

I did a dumb thing. I was playing around as root, investigating a potentially cool hack, and discovered a reproducible kernel panic instead.

The dumb part was that I was logged into my FileVault enabled home account at the time. Whenever the machine crashes catastrophically, there is always a chance of file corruption. The same holds true for disk images.

Upon reboot, I could no longer access my home account. Yay. I have a corrupted, encrypted, disk image containing all of my data on it…

(Fortunately, I back up everything 2 or 3 times a week. But restoring from a backup sucks.)

DiskWarrior generally does a great job of recovering disks. I don’t know how it compares to Tech Tool Pro (or others).

And DiskWarrior can recover corrupted disk images. It just isn’t very straightforward, in some cases.

The steps that have worked for me:

– If the corrupted disk image resides upon the same volume as your boot partition, you must boot from some other partition. Use FireWire target mode if you have to. Just don’t boot from the partition with the corrupted image because it may cause further damage as the physical volume might well be corrupt, too.

– Once booted, run DiskWarrior and repair the volume upon which the corrupted disk image resides.

– Double-click the corrupted disk image. Enter the image’s password, if necessary. If recovering a FileVault user disk image, you will find said image in the normal Users directory. Look for shortusername.sparseimage.

– If you are lucky, the image will mount and be detected by DiskWarrior. Repair away.

If you aren’t so lucky (I wasn’t)…

To put this into perspective, DiskWarrior does an abysmal job of reporting what actually went wrong. Most failures are summed up with the line “DiskWarrior could not repair the volume because of a system service failure” (or similar vague nonsense). If you look in the console, you might catch one or two four digit error codes — no explanation as to what they mean.

Check to see if the disk image was mounted readwrite.

Easy enough to do from the terminal:

% hdiutil info
image-path      : /Volumes/Data/Users/.bbum/bbum.sparseimage
writeable       : FALSE

If it isn’t, then unmount it (in the Finder or Disk Utility) and:

% hdiutil mount -readwrite /Volumes/Data/Users/.bbum/bbum.sparseimage
% hdiutil info
image-path      : /Volumes/Data/Users/.bbum/bbum.sparseimage
writeable       : TRUE

Try DiskWarrior again. If it still fails, then check the ownership and permissions on the volume.

If you can’t mount the volume at all…

The volume may be corrupt enough that the system will tell you that it can’t be mounted as there are no mountable partitions. This is bad.

But you can usually work around it by telling hdiutil to attach without mounting:

% hdiutil mount -nomount -readwrite /Volumes/Data/Users/.bbum/bbum.sparseimage

At this point, the image should be attached to the system such that Disk Utility and DiskWarrior can see it. Hopefully, you can repair it.

Beyond this, if DiskWarrior still gives the cryptic “due to system services failure”, then you may be out of luck. I have had this happen and DW has eventually worked after numerous reboots from different partitions. I have no idea what the key variable was, just that it worked eventually and I lost no data.

Speaking of data loss…. time to trigger a backup.

Yes, I use Apple’s BackUp. Why? Because, for me, it has worked flawlessly, is incredibly easy to use, and does exactly what I want it to do; one click backups to an external hard drive.

I know that recovery works because it has saved my ass a number of times.

Deprecated: link_pages is deprecated since version 2.1.0! Use wp_link_pages() instead. in /srv/www/friday/bbum/wp-includes/functions.php on line 4713

14 Responses to “Recovering Disk Images with DiskWarrior”

  1. Jonathan Wight says:

    I’ve had this happen to me. Enough times that I dont use FileVault on my development machines. One thing to look for is corrupted preferences files, these files are written pretty often. I’d check any preference file with a modification timestamp that is just before when the accident happened.

  2. Adrian says:

    Disk image corruption is exactly the problem why I tried FileVault once and never used it again. But I’m not complaining as solving these issues pays my bills.

  3. macuser says:

    Typo: The correct name is Tech Tool Pro.

  4. Kevin says:

    Hello bbum.

    At the beginning of the post you mention that restoring from backup sucks. Is this due to the restore process with Apple’s Backup? I’ve never used it as I’m a satisfied customer of Shirt Pocket Software’s “SuperDuper!” program. I hate that exclamation point in the name but what can you do?

    Anyway, restoring from within that software is dead simple and very reliable. I would never bother with the stages you mentioned (other than as a learning experience) when I’ve got a full backup on an external disk. This is not to shoot down the usefulness of this information by any means though. Just thought I’d point you towards some software that might make your life a little easier.

  5. bbum says:

    Neat product. From the company that did netTunes — I used that all the time when it first came out.

    Restoring from backup always sucks because, invariably, you have lost some number of hours of data. And if it is your home account you are restoring, then there is always the need to verify that system configuration is restored correctly, something that super-duper avoids.

    With a cost, though. It appears to always make an image of the drive? I have found that I occasionally end up with “data eating bit rot” type filesystem corruption. The kind I might not notice for a few days or weeks that is gradually causing data loss. I really need incremental backups so I can go back in time and find the good copy of something.

    Now — one might be asking why I am experiencing such catastrophes on a seemingly rock solid system. It is because I’m regularly poking around in things on the other side of the user/kernel wall and/or I have something far far from production quality installed. I.e. I’m doing this to myself as a part of my day job.

  6. Kevin says:

    I can definitely see the added safety you get from incremental backups. I’ve very rarely experienced that kind of data loss personally. The other thing you could do is keep an external disk of backup images that you rotate through. It will happily back up to a disk image and that leaves you with a bit more wiggle room in case of the problem you mentioned. I imagine the best solution is some kind of combination of the two techniques though. A full clone to make restoring a working system easy with incremental backups for your really important working data that isn’t already in something like Subversion.

  7. Keith says:

    I agree DiskWarrior can be a great tool. However, when DiskWarrior fails, and you don’t have a good backup, then Data Rescue X is a life saver. I keep my Users data on a seperate internal harddisk. After I upgraded to 10.4, I made the mistake of running Tech Tool Pro. At taht time that version of Tech Tool Pro had issues with a Mac OS X 10.4 system, and ended up corrupting my Users disk. DiskWarrior, Disk Utility, and AppleJack (fsck) were not able to repair the drive. After a couple of days trying in vain to repair my drive I finally found Data Rescue X and was able to at least recover most of my data to a networked drive and reformat the disk.

    Unfortunately, I’ve now don’t use Tech Tool Pro anymore. I also abbonned Norton many moons ago. I’ve been burned to many times. The only repari tool I use anymore is AppleJack. Thankfully, I don’t even have to use it too often. Can anybody recommend a safe and reliable harddisk (and system) repair tool?

    I now use a homegrown backup system built around rsync to keep all my critical files backed up on a network drive. I too would like an incremental back up system, but have not found a good system yet. With the kernel sending out notifications of every filesystem change (for spotlight) seems like an excellent way to create an incremental back system. Check out FSLogger if you want to see every file system modification on a 10.4 system.

  8. DHerren says:

    I’ve been very happily using ProSoft Engineering’s Data Backup. It does everything you would typically want in a backup solution, doesn’t require a dot mac account, and best of all for me, can be configured to automatically backup whenever the backup volume mounts. I have an external firewire drive I back up to, and all I have to do is plug it in in the morning, grab a cup of coffee, and by the time I’m back, I can eject the drive and unplug it with no additional intervention. It does run a daemon to watch for the mount, and launch the command line backup. There is a decent gui for configuration, and if you really need that “one click” you can run the gui.

  9. In-side » Blog Archive » links for 2006-02-22 says:

    […] Recovering Disk Images with DiskWarrior good knowledge from bbum (tags: bbum diskwarrior corruption diskimage recover osx) […]

  10. DV for Teachers » Blog Archive » Recovering Disk Images with DiskWarrior says:

    […] bbum’s weblog-o-mat » Blog Archive » Recovering Disk Images with DiskWarrior […]

  11. bowmasters says:

    So, what can one do if an image is so corrupt that the “hdiutil mount -nomount -readwrite” command doesn’t even allow the image to mount?

  12. nevrozel says:

    I I’m having the same problem with a Time Machine corrupt HDD. Every time I connect it to the Mac, I instantly get kernel panics. I tried to enter the terminal command before attaching the drive but I get an error: “hdiutil: mount failed – No such file or directory”. When I connect the drive, it mounts and I get the kernel panic.

    Can somebody tell me how exactly should I use the terminal in order to be able to attach the Time Machine drive without mounting it?

    Thank you very much.

  13. bbum says:

    I don’t think Terminal is going to help you much. You might have some more luck w/one of the disk recovery utilities, but I don’t know if they support TM volumes properly yet or not (I think they do).

  14. Dead iMac Hard Drive Recovery « Austin’s Weblog says:

    […] Websites which made this all possible: […]

Leave a Reply

Line and paragraph breaks automatic.
XHTML allowed: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>