How to repair HFS+ extended attributes file?

Question

Is there any tool able to repair/rebuild extended attributes file?

For now I tried fsck_hfs from Mac OS X 10.6.3 Retail DVD, fsck.hfsplus from GParted 0.5.2 livecd and Paragon Partition Manager 11. All without any success.

This man page states that fsck_hfs have -R option to specify which B-trees need to be rebuilt, but I've not found anywhere fsck_hfs binary that accepts this option.

Now I have HDD with broken HFS+ attached to VM in VirtualBox over network (via FreeBSD's GEOM gate), because I currently have no SATA-USB adapter.

Solution

Specify the option as

-Re

If you command fsck_hfs with no option, then the list of options presented under 'usage' may be less than the options that are truly accepted. This is, I believe, a documentation bug.

Update — 2011-07-30

If the -R option is unrecognised by fsck_hfs in Mac OS X 10.6.3, assume that it was introduced in a later version of 10.6.x — for the manual page referenced in the opening post, between 10.5 and 10.6.6 there's nothing.

Snow Leopard in the Apple Store (UK) remains at 10.6.3 so if you require bootable media with the more capable version of fsck_hfs I should recommend either of the following:

• upgrade an installation of Snow Leopard to 10.6.8 or greater

• await Apple's production of Lion on a USB thumb drive (beware of known risks and unknowns associated with things hacked from 11A511).

For reference, here's a transcript from 10.7 (Build 11A511):

[macbookpro08-centrim:~] gjp22% date
Sat 30 Jul 2011 08:25:39 BST
[macbookpro08-centrim:~] gjp22% uname -a
Darwin macbookpro08-centrim.home 11.0.0 Darwin Kernel Version 11.0.0: Sat Jun 18 12:56:35 PDT 2011; root:xnu-1699.22.73~1/RELEASE_X86_64 x86_64
[macbookpro08-centrim:~] gjp22% diskutil list
/dev/disk0
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *320.1 GB   disk0
   1:                        EFI                         209.7 MB   disk0s1
   2:          Apple_CoreStorage                         318.1 GB   disk0s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3
   4:              Apple_Journal                         536.9 MB   disk0s4
   5:                  Apple_HFS scratchy                536.9 MB   disk0s5
/dev/disk1
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS speedy                 *317.8 GB   disk1
[macbookpro08-centrim:~] gjp22% sudo /sbin/fsck_hfs -R
/sbin/fsck_hfs: option requires an argument -- R
usage: fsck_hfs [-b [size] B [path] c [size] Edfglx m [mode] npqruy] special-device
  b size = size of physical blocks (in bytes) for -B option
  B path = file containing physical block numbers to map to paths
  c size = cache size (ex. 512m, 1g)
  E = exit on first major error
  d = output debugging info
  f = force fsck even if clean (preen only) 
  g = GUI output mode
  x = XML output mode
  l = live fsck (lock down and test-only)
  m arg = octal mode used when creating lost+found directory 
  n = assume a no response 
  p = just fix normal inconsistencies 
  q = quick check returns clean, dirty, or failure 
  r = rebuild catalog btree 
  u = usage 
  y = assume a yes response 
[macbookpro08-centrim:~] gjp22% sudo diskutil unmount /Volumes/scratchy
Volume scratchy on disk0s5 unmounted
[macbookpro08-centrim:~] gjp22% sudo /sbin/fsck_hfs -Re /dev/disk0s5
** /dev/rdisk0s5
   Executing fsck_hfs (version diskdev_cmds-540.1~34).
** Checking Journaled HFS Plus volume.
   The volume name is scratchy
** Checking extents overflow file.
** Checking catalog file.
** Rebuilding extents overflow B-tree.
** Rechecking volume.
** Checking Journaled HFS Plus volume.
   The volume name is scratchy
** Checking extents overflow file.
** Checking catalog file.
** Checking multi-linked files.
** Checking catalog hierarchy.
** Checking extended attributes file.
** Checking volume bitmap.
** Checking volume information.
   Invalid volume file count
   (It should be 336 instead of 226)
   Invalid volume directory count
   (It should be 37 instead of 52)
   Invalid volume free block count
   (It should be 124541 instead of 125082)
   Volume header needs minor repair
(2, 0)
** Repairing volume.
** Rechecking volume.
** Checking Journaled HFS Plus volume.
   The volume name is scratchy
** Checking extents overflow file.
** Checking catalog file.
** Checking multi-linked files.
** Checking catalog hierarchy.
** Checking extended attributes file.
** Checking volume bitmap.
** Checking volume information.
** The volume scratchy was repaired successfully.
[macbookpro08-centrim:~] gjp22% sudo /sbin/fsck_hfs -fn /dev/disk0s5
** /dev/rdisk0s5 (NO WRITE)
   Executing fsck_hfs (version diskdev_cmds-540.1~34).
** Checking Journaled HFS Plus volume.
   The volume name is scratchy
** Checking extents overflow file.
** Checking catalog file.
** Checking multi-linked files.
** Checking catalog hierarchy.
** Checking extended attributes file.
** Checking volume bitmap.
** Checking volume information.
** The volume scratchy appears to be OK.
[macbookpro08-centrim:~] gjp22% 

Comments

[NiiTii]

Nope, it's still says "fsck_hfs: illegal option -- R"

[Graham Perrin]

I'm curious: why do you wish to rebuild this particular B-tree? Is the need to rebuild actively suggested by someone or something? Or is the rebuild an attempt to work around something that puzzles you?

[NiiTii]

I wanted to rebuild it because it was broken and system failed to boot.

[Graham Perrin]

@gelraen thanks. If a rebuild is required, it will be automated by the system. Rule of thumb: if the automated rebuild fails, then attempting a manual rebuild, using the same fsck_hfs but booted from a different volume, will be no more likely to succeed. More modern versions of fsck_hfs have less stringent free space requirements but still, if free space is not suitable then rebuild will be refused. Developments in Lion allow some tricks, discuss in Ask Different Chat if you like.