2

I'm trying to recover data from an encrypted sparsebundle on macOS Mojave (10.14.6) that I just discovered became corrupted at some point in the past. It was created several years ago.

I have the password for it but I can't get it to mount, and attaching it via hdiutil (hdiutil attach -nomount -noverify -noautofsck -stdinpass Personal.sparsebundle) reveals that it has no file system anymore.

My issue seems similar to the one in this thread, but I don't have the expertise to be able to work out a solution specific to my situation from what's been presented in klanomath's answer.

Here are the same info results posted by that thread's op:

diskutil list /dev/disk3

/dev/disk3 (disk image):
#:                       TYPE NAME                    SIZE       IDENTIFIER
0:                                                   +4.6 GB     disk3

diskutil info /dev/disk3

Device Identifier:         disk3
   Device Node:               /dev/disk3
   Whole:                     Yes
   Part of Whole:             disk3
   Device / Media Name:       Disk Image

   Volume Name:               Not applicable (no file system)
   Mounted:                   Not applicable (no file system)
   File System:               None

   Content (IOContent):       None
   OS Can Be Installed:       No
   Media Type:                Generic
   Protocol:                  Disk Image
   SMART Status:              Not Supported

   Disk Size:                 4.6 GB (4613734400 Bytes) (exactly 9011200 512-Byte-Units)
   Device Block Size:         512 Bytes

   Read-Only Media:           No
   Read-Only Volume:          Not applicable (no file system)

   Device Location:           External
   Removable Media:           Removable
   Media Removal:             Software-Activated

   Virtual:                   Yes

fdisk /dev/disk3

Disk: /dev/disk3    geometry: 560/255/63 [9011200 sectors]
Signature: 0x70F0
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: E6  654  20  31 -  129 246  12 [1624655050 - 2384870584] <Unknown ID>
 2: 74  860  66  38 -  581 106   0 [1253546114 - 3399439981] <Unknown ID>
 3: 1E  517  38   4 -  333  65  17 [ 709288943 - 2881760601] <Unknown ID>
 4: C4   32 116  61 -  816 121  22 [2129857911 - 2037640686] DRDOSs < 32M

gpt recover /dev/disk3

gpt recover: /dev/disk3: no primary or secondary GPT headers, can't recover

gpt -r -vv show /dev/disk3

gpt show: /dev/disk3: mediasize=4613734400; sectorsize=512; blocks=9011200
gpt show: /dev/disk3: MBR not found at sector 0
    start     size  index  contents
        0  9011200

I'd really appreciate any help in trying to recover files from this bundle!

Thank you.

Marius Masalar
  • 21
  • This is a different beast ;-). It's not really related to fdisk and the linked q&a. The fdisk command interprets some data in block0 and shows some arbitrary output. Check the max number of cylinders in geometry (560 - which seems legit) and the number of cylinders in the 1st: 654 and 2nd partition: 860. It's important to know when the sparseimage was created. Do you have/remember some approximate date? – klanomath Oct 23 '19 at 19:46
  • Thanks for weighing in! I can actually tell you the exact creation date, which I believe is accurate: August 28th, 2014. It was then modified on June 9th, 2017...I don't remember exactly but I believe that was me resizing it so I could fit some additional files. – Marius Masalar Oct 23 '19 at 23:20
  • Don't try first aid from the disk utility program. In my case (Catalina) it fixed my sparsebundle, but deleted the data (time machine backup) stored on it. There was no warning, that this could happen. – asmaier Jan 29 '22 at 14:34

0 Answers0