APFS Container lost after crash and reboot

Question

My 15" MacBook Pro Late 2016 with a 500GB SSD was occasionally rebooting (but only) during MS-Teams meetings. Anyway, the last crash was destructive and now I get flashing "?" when it is powered up. The disk utility in the rescue mode shows the disk as unpartitioned. My research on the issue indicates that the APFS container (encrypted) is there but it doesn't get recognized.

I have read probably all the posts about recovering missing APFS containers and considered replicating the procedures here and here. However, I can't find the correct values to calculate the container size. So I didn't execute any of the suggested commands (gpt remove/add).

I would appreciate any help bringing me closer to a solution to recover my APFS Container so the MacOs can boot up. (I think I have the version 10.15). Disk Utility's First Aid did not detect any errors in the rescue mode.

Here are the console outputs (in rescue mode cmd+R):

$ fsck_apfs -n /dev/disk0

0000:  0000 0000 0000 0000 0000 0000 0000 0000       |................|
. . .
01b0:  0000 0000 0000 0000 0000 0000 0000 00fe       |................|
01c0:  ffff eefe ffff 0100 0000 13ae 4707 0000       |............G...|
01d0:  0000 0000 0000 0000 0000 0000 0000 0000       |................|
. . .
01f0:  0000 0000 0000 0000 0000 0000 0000 55aa       |..............U.|
0200:  0000 0000 0000 0000 0000 0000 0000 0000       |................|
. . .
0ff0:  0000 0000 0000 0000 0000 0000 0000 0000       |................|
error: Device does not contain a valid APFS container.

$ diskutil apfs list

No APFS Containers found

$ diskutil list <- this is printing about 16 disk images (/dev/disk16, etc) after the actual disk0 , why is that?

$ diskutil list disk0

/dev/disk0 (internal):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                         500.3 GB   disk0
   1:                        EFI EFI                     314.6 MB   disk0s1
   2:                 Apple_APFS                         500.0 GB   disk0s2

$ gpt -r show disk0

      start       size  index  contents
          0          1         PMBR
          1          1         Pri GPT header
          2          4         Pri GPT table
          6      76800      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      76806  122061321      2  GPT part - 7C3457EF-0000-11AA-AA11-00306543ECAC
  122138127          4         Sec GPT table
  122138131          1         Sec GPT header

Above, the numbers add up nicely. But in all other posts the GPT table size is 32, I have 4, why is that? There are also no blank spaces before and after the GPT parts, whereas every other asker has.

$ dd if=/dev/disk0s2 count=1 bs=512 | hexdump -Cv

Here is a problem, the nx_magic (4e 58 53 42) doesn't exist at the hex address 00000020.

1+0 records in
1+0 records out
512 bytes transferred in 0.005559 secs (92103 bytes/sec)
00000000  80 4a 2f 24 cf c3 da 9d  30 29 e2 d9 63 c5 41 83  |.J/$....0)..c.A.|
00000010  a4 8b 8b aa 68 67 12 9e  1f dd 9c 53 b6 7c 89 08  |....hg.....S.|..|
00000020  e0 31 e5 c0 6f 90 25 fe  76 28 f3 33 2b ed 30 d7  |.1..o.%.v(.3+.0.|
00000030  d2 66 99 e5 63 87 73 78  db 8b e8 14 43 43 8e d1  |.f..c.sx....CC..|
00000040  53 c5 08 c7 b1 2d b4 88  62 85 6e 50 f5 05 01 0d  |S....-..b.nP....|
00000050  30 75 22 a0 35 da ee 45  fa a5 da 0f e5 29 31 50  |0u".5..E.....)1P|
00000060  f3 e4 8a 36 98 d1 a6 be  fb 6b 60 7c f4 5e fe 26  |...6.....k`|.^.&|
00000070  75 c7 d2 3e 50 09 73 2f  fe 87 a9 14 89 0c 4f 10  |u..>P.s/......O.|
00000080  a5 ba 50 94 8f 9e dd ab  3c 6d 2d 03 b4 d7 18 35  |..P.....<m-....5|
00000090  93 6e e6 c4 a6 66 13 a2  de c8 eb 3d 3c 73 4a 32  |.n...f.....=<sJ2|
000000a0  94 3a 2c cb 4a 64 35 35  6f ae 59 0a d4 5e 6b 0b  |.:,.Jd55o.Y..^k.|
000000b0  a0 60 a0 30 84 47 b5 0b  30 e2 0b ea 5b 14 af 2d  |.`.0.G..0...[..-|
000000c0  31 b6 28 81 7f a7 46 ab  4b ad 39 f9 bc a6 b7 a2  |1.(...F.K.9.....|
000000d0  28 1b bf b0 c3 1b 76 5b  25 76 d6 1f f6 f8 0e 53  |(.....v[%v.....S|
000000e0  7b 2e 9a d5 ef 48 c4 a4  f2 ab f1 0e c5 29 a9 5e  |{....H.......).^|
000000f0  8a ad f9 b4 3a 44 0e 48  f3 c6 2f 7d cf 47 6c 09  |....:D.H../}.Gl.|
00000100  d5 30 22 ad 8c 2e 12 a0  f8 ab 87 09 ab 36 82 27  |.0"..........6.'|
00000110  52 48 75 96 3c 94 e4 d3  eb 17 26 13 14 7a 17 c9  |RHu.<.....&..z..|
00000120  4d 2d ee f3 68 7a 50 44  21 6a 5d b4 dc 2b b0 2b  |M-..hzPD!j]..+.+|
00000130  81 af 02 b0 3c 1e a8 e0  4e 01 d7 ae 26 07 86 fb  |....<...N...&...|
00000140  c7 50 f0 ea f2 61 e2 42  f1 ac 27 88 3b 36 ac 78  |.P...a.B..'.;6.x|
00000150  68 df e3 b4 9f 9a 86 7f  58 a5 c7 29 6e 30 c8 31  |h.......X..)n0.1|
00000160  05 50 de 72 4c cf ea 8f  bc 1a e3 9a 89 8a 9a 13  |.P.rL...........|
00000170  17 59 18 33 f0 eb bf 03  d6 fa 62 15 1a 2e a3 60  |.Y.3......b....`|
00000180  8d 44 df 2c 88 c6 3f b5  13 90 a8 82 dc 18 13 13  |.D.,..?.........|
00000190  74 5f fb 08 44 8d b5 77  28 ff a6 0b c8 ce 85 9a  |t_..D..w(.......|
000001a0  a8 53 9e 4f 98 ae 71 fe  6a c5 c1 e6 8d 59 81 15  |.S.O..q.j....Y..|
000001b0  a0 bf 8c da cf ff 51 4c  d8 de cb 58 22 b1 22 07  |......QL...X".".|
000001c0  c2 f8 11 06 27 0e 9a 3d  3d b3 7a 35 cb 57 37 a2  |....'..==.z5.W7.|
000001d0  07 75 89 37 26 d4 73 1b  d3 c6 69 74 0b 86 f9 ce  |.u.7&.s...it....|
000001e0  0c 0d e4 7f 9f 1b e4 7e  cb fc c9 37 97 38 95 ec  |.......~...7.8..|
000001f0  9a 32 3d 95 3f fb c2 5f  e3 09 21 13 90 0c 97 b5  |.2=.?.._..!.....|
00000200

$ dd if=/dev/disk0 count=1 bs=512 skip=76806 | hexdump -Cv

The nx_magic value is not here either at the address 00000020

1+0 records in
1+0 records out
512 bytes transferred in 0.005519 secs (92772 bytes/sec)
00000000  69 52 6f 6f 74 28 30 78  30 29 2f 50 63 69 28 30  |iRoot(0x0)/Pci(0|
00000010  78 31 2c 30 78 31 29 2f  50 63 69 28 30 78 30 2c  |x1,0x1)/Pci(0x0,|
00000020  30 78 30 29 2f 50 63 69  28 30 78 32 2c 30 78 30  |0x0)/Pci(0x2,0x0|
00000030  29 2f 50 63 69 28 30 78  30 2c 30 78 30 29 2f 55  |)/Pci(0x0,0x0)/U|
00000040  53 42 28 30 78 33 2c 30  78 30 29 2f 48 44 28 32  |SB(0x3,0x0)/HD(2|
00000050  2c 47 50 54 2c 31 32 31  30 42 42 39 38 2d 46 39  |,GPT,1210BB98-F9|
00000060  33 39 2d 34 44 32 30 2d  38 31 39 37 2d 39 42 41  |39-4D20-8197-9BA|
00000070  32 33 35 43 34 32 34 39  34 2c 30 78 36 34 30 32  |235C42494,0x6402|
00000080  38 2c 30 78 33 34 30 33  35 45 38 29 0d 0a 23 5b  |8,0x34035E8)..#[|
00000090  48 3a 4b 2d 5d 0d 0a 23  5b 42 44 53 7c 42 4f 4f  |H:K-]..#[BDS|BOO|
000000a0  54 5d 20 50 63 69 52 6f  6f 74 28 30 78 30 29 2f  |T] PciRoot(0x0)/|
000000b0  50 63 69 28 30 78 31 2c  30 78 31 29 2f 50 63 69  |Pci(0x1,0x1)/Pci|
000000c0  28 30 78 30 2c 30 78 30  29 2f 50 63 69 28 30 78  |(0x0,0x0)/Pci(0x|
000000d0  32 2c 30 78 30 29 2f 50  63 69 28 30 78 30 2c 30  |2,0x0)/Pci(0x0,0|
000000e0  78 30 29 2f 55 53 42 28  30 78 33 2c 30 78 30 29  |x0)/USB(0x3,0x0)|
000000f0  2f 48 44 28 32 2c 47 50  54 2c 31 32 31 30 42 42  |/HD(2,GPT,1210BB|
00000100  39 38 2d 46 39 33 39 2d  34 44 32 30 2d 38 31 39  |98-F939-4D20-819|
00000110  37 2d 39 42 41 32 33 35  43 34 32 34 39 34 2c 30  |7-9BA235C42494,0|
00000120  78 36 34 30 32 38 2c 30  78 33 34 30 33 35 45 38  |x64028,0x34035E8|
00000130  29 0d 0a 23 5b 48 3a 4b  2d 5d 0d 0a 23 5b 42 44  |)..#[H:K-]..#[BD|
00000140  53 7c 42 4f 4f 54 5d 20  50 63 69 52 6f 6f 74 28  |S|BOOT] PciRoot(|
00000150  30 78 30 29 2f 50 63 69  28 30 78 31 2c 30 78 31  |0x0)/Pci(0x1,0x1|
00000160  29 2f 50 63 69 28 30 78  30 2c 30 78 30 29 2f 50  |)/Pci(0x0,0x0)/P|
00000170  63 69 28 30 78 32 2c 30  78 30 29 2f 50 63 69 28  |ci(0x2,0x0)/Pci(|
00000180  30 78 30 2c 30 78 30 29  2f 55 53 42 28 30 78 33  |0x0,0x0)/USB(0x3|
00000190  2c 30 78 30 29 2f 48 44  28 32 2c 47 50 54 2c 31  |,0x0)/HD(2,GPT,1|
000001a0  32 31 30 42 42 39 38 2d  46 39 33 39 2d 34 44 32  |210BB98-F939-4D2|
000001b0  30 2d 38 31 39 37 2d 39  42 41 32 33 35 43 34 32  |0-8197-9BA235C42|
000001c0  34 39 34 2c 30 78 36 34  30 32 38 2c 30 78 33 34  |494,0x64028,0x34|
000001d0  30 33 35 45 38 29 0d 0a  23 5b 48 3a 4b 2d 5d 0d  |035E8)..#[H:K-].|
000001e0  0a 23 5b 42 44 53 7c 42  4f 4f 54 5d 20 50 63 69  |.#[BDS|BOOT] Pci|
000001f0  52 6f 6f 74 28 30 78 30  29 2f 50 63 69 28 30 78  |Root(0x0)/Pci(0x|
00000200

It is also worth to mention that I can view the filesystem with all the files in it with a third party software* (the spam filter doesn't allow publishing its name). It detects the APFS container properly, but it doesn't help fixing the container. I uploaded its logs here.

I would appreciate any help guiding me into making this disk bootable again.

*Spam filter doesn't prevent an older user from adding the data;) - after comments…

iBoysoft Data Recovery. Part of its log contains:

found apfs volume, start = 947517, flag = 8, vol name: Macintosh HD 
found apfs volume, start = 952756, flag = 8, vol name: Macintosh HD - Data  
found apfs volume, start = 959309, flag = 8, vol name: Macintosh HD - Data  
found apfs volume, start = 961219, flag = 8, vol name: Macintosh HD - Data  
found apfs volume, start = 965235, flag = 8, vol name: Macintosh HD - Data

Update: Block/sector size appears to be 4096, but this information didn't help me find the nx_magic. (below is taken from an Ubuntu live disk)

$ fdisk -l
Disk /dev/nvme0n1: 465.94 GiB, 500277788672 bytes, 122138132 sectors
Disk model: APPLE SSD SM0512L                       
Units: sectors of 1 * 4096 = 4096 bytes
Sector size (logical/physical): 4096 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: EF5AF2C3-557F-479D-80F9-BC5A56AEDFDA

The spam filter might stop a new user from mentioning it in their first post, but it shouldn't bother for a comment underneath ;) — Tetsujin, Jan 21 '22 at 17:46
Thanks for the tip. (I am actually old at Stackoverflow, but not here :) ) It is iBoysoft Data Recovery. Part of its log contains:
found apfs volume, start = 947517, flag = 8, vol name: Macintosh HD found apfs volume, start = 952756, flag = 8, vol name: Macintosh HD - Data found apfs volume, start = 959309, flag = 8, vol name: Macintosh HD - Data found apfs volume, start = 961219, flag = 8, vol name: Macintosh HD - Data found apfs volume, start = 965235, flag = 8, vol name: Macintosh HD - Data — Onur, Jan 21 '22 at 17:50
I dropped the info in at the end. I've never fallen foul of the spam filter, but I guess it's to prevent fly-by spammers from having an easy time of it in first posts;) — Tetsujin, Jan 21 '22 at 18:01
I'm pretty sure you need to run fsck_apfs on the partition that's an APFS container, not the entire disk. Also, according to the man page, you should always run it on the raw device. So try fsck_apfs -n /dev/rdisk0s2. As for all the disk images, they're just how recovery mode works. — Gordon Davisson, Jan 21 '22 at 18:49
Thank you @Tetsujin. Thank you @GordonDavisson, I just tried fsck_apfs -n /dev/rdisk0s2 and still got the same error at the end error: Device does not contain a valid APFS container. (The hex data shown for rdisk0s2 is the same as the first $ dd ... block in the question) — Onur, Jan 21 '22 at 19:26

APFS Container lost after crash and reboot

0 Answers0