Corrupt HFS+ catalog file

I’m very happy with my Mac, no doubt about it, but like in any computer system things can go wrong. In this case something was wrong with my primary filesystem (root filesystem). Whenever I rebooted (and you don’t have to do that often with a Mac) I got ‘recovered files’ in my trashcan. These were typical small files (like 8k) so this led me to believe that diskblocks were not properly allocated to files. Although I make backups regularly (Time-Machine works great) I don’t want to run my system with an inconsistent filesystem.

Fortunately OS X comes with a tool called ‘Disk Utility’. I started the Disk Utility and did a ‘verify disk’. The check fails when inspecting the catalog file. This may be due to the fact the filesystem is currently mounted since the corrupt filesystem is the root filesystem. I better boot OS X from DVD and retry the disk check. Booting from the OS X install DVD starts the installer that has a menu entry ‘Utilities’ where you can find the ‘Disk Utility’.

Update: you always find the best information after you’re done: hfsdebug.

When I did the ‘verify disk’ again on the unmounted filesystem I got the same thing: verification fails on the catalog file check. Trying a ‘repair disk’ fails as well since it starts out with a ‘verify disk’. What now? The ‘catalog file’ on a HFS+ filesystem is a B*tree that contains records for all files and directories on the filesystem. So problems with the catalog file can be potential very bad. Of course I do have regular time-machine backups, still this might be bad. Since the catalog file is a separate entry in a HFS filesystem there may be a possibility to rebuild the catalog from the actual allocation information. It took me quiet some time to figure this out but you indeed can rebuild the catalog file.

Rebuilding the catalog file of a HFS+ filesystem can be done with the fsck command (more specifically the fsck_hfs command). Use the ‘-r’ option to fsck_hfs but please be warned by the quote from the manual page of fsck_hfs:

-r Rebuild the catalog file on the specified file system.
This option currently will only work if there is enough
contiguous space on the specified file system for a new
catalog file and if there is no damage to the leaf nodes in
the existing catalog file.

I don’t know if there is any damage to the leafnodes? How should I know? So I made some extra backups of some important stuff I need. Afterwards I rebuild the catalog file… fingers crossed…

The rebuilding of the catalog file worked like a charm without complaining without warnings and without errors but are all my files and directories still here? I rebooted the Mac from the repaired filesystem and the system started up like normal. I inspected the files I need most and all was still there so that’s one bit of good news. The other bit of good news is that there were no more ‘recovered files’ in the trashcan after the reboot.

There is one more piece of information in the manual page that made me have second thoughts on HFS. I hope Apple will adopt another filesystem in the future like zfs or at least base its filesystem on some other filesystem. This is what the manual page says:

BUGS
fsck_hfs is not able to fix some inconsistencies that it detects.

What would they mean by that? I understand that fsck_hfs can’t fix inconsistencies for which the correct information can’t be determined but that’s not a bug of fsck_hfs in my opinion.

2 Responses to “Corrupt HFS+ catalog file”

  1. [BOFH]Basilisk Says:

    Hehehe, scary shit dude ;-)

  2. budims Says:

    Well that’s why Torvalds calls OSX’s filesystem “utter crap”. Heh.

Leave a Reply