Sunday, February 25, 2007

FileVault - How to verify or repair a home directory image

Last December I managed to break the LCD of my beloved PowerBook after successfully launching it from my open backpack. About 2 weeks later and with $850 vanished from my bank account I finally was able to log back into my OS X environment only to be confronted with Apple's equivalent of the Blue Screen of Death (aka Kernel Panic) after only a few minutes of browsing the web and trying to empty my Recycle Bin.





I immediately figured that the physical crash had damaged my hard drive so naturally I tried booting in Single User to manually run a filesystem check. This can be done by pressing Command-S when powering up the machine and typing /sbin/fsck -fy at the root prompt.




localhost:/ root# /sbin/fsck -fy
** /dev/rdisk0s3
** Root file system
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
** Checking multi-linked files.
** Checking Catalog hierarchy.
** Checking Extended Attributes file.
** Checking Volume bitmap.
** Checking Volume information.
** The volume Macintosh HD appears to be OK.


Appears to be OK, that seems odd? I would at least have expected problems in the file system.
A bit confused I rebooted the machine to have a look at the the kernel panic log in /Library/Logs/panic.log and noticed the following entry.



panic(cpu 0 caller 0x00248DE0): hfs: block mark free: trying to free non-existent blocks (1694161930 587573128 24388658)

Latest stack backtrace for cpu 0:
Backtrace:
0x00095138 0x00095650 0x00026898 0x00248DE0 0x00248418 0x00247710 0x0022C068 0x0022C284
0x0023A9F4 0x0023A534 0x000FC4A0 0x000EDF70 0x002AAE28 0x000AB930 0x76EDF7FF
Proceeding back via exception chain:
Exception state (sv=0x2D5B5500)
PC=0x9001AECC; MSR=0x0200F030; DAR=0x00EE0883; DSISR=0x40000000; LR=0x2C038104; R1=0xBFFFF5A0; XCP=0x00000030 (0xC00 - System call)



Obviously the kernel must have panicked at the point I was trying to empty my Recycle Bin when it found out about non-existing blocks in the file system. Oddly enough the fsck earlier didn't turn up any issues with the file system. Then it occurred to me that the kernel was possibly pointing at errors in the FileVault file system for my user.

For quite some time now I've been using Apple's FileVault as the default way to encrypt my user's home directory. Not only is it more secure, it also allows for convenient and fast backups of one's user space. If you (like me) also make sure to place all your software in ~/Applications rather then /Applications then it should be rather easy to setup a brand new machine with your environment by just creating an identical username and copying over the users sparseimage which can be found in /Users/.username/username.sparseimage.

Still I had no idea on how to check FileVault file systems for errors. Luckily Apple's support website turned up this useful article which unfortunately didn't seem to work because other users or even administrators aren't allowed to write (and therefore fix) to another user's file system. When following their steps Disk Utility will show you the following.



Verify and Repair disk "tpennings"
Checking HFS Plus volume.
Checking Extends Overflow file.
Checking Catalog file.
Invalid extend entry
Incorrect block count for file compreg.dat
(It should be 0 instead of -1043562767)
Checking multi-linked files.
Checking Catalog hierarchy.
Checking Extended Attributes file.
Checking Volume bitmap.
Checking Volume information.
Volume repair failed.

Error: The underlying task reported failure on exit

1 HFS volume checked
1 volume could not be repaired because of an error

After some trial and error and with testing I came up with the following (working) steps:

  1. While being logged in as the current user: click the Finder icon in the Dock.
  2. From the Go menu, choose Utilities.
  3. Open NetInfo Manager.






  4. From the Security menu, choose Authenticate... and enter the password for the current user.
  5. From the Security menu, choose Enable Root User and enter the password for the current user once again.
  6. Press Command-Shift-Q and click Logout to confirm logging out your current user.
  7. The logon menu will appear, and you select Other....
  8. Enter as username root, and the password you've chosen for root.
  9. Once logged in click the Finder icon in the Dock.
  10. From the Go menu, choose Utilities.
  11. Open Disk Utility.
  12. Click the Finder icon in the Dock.
  13. From the Go menu, choose Go To Folder.
  14. Type "/Users" and click Go.






  15. Open the folder for the account you want to check. It should have the same name as the account's short name.
  16. Find the ".sparseimage" file, and drag it into the left side of the Disk Utility window.






  17. Select the disk image in Disk Utility.
  18. Click the First Aid tab.
  19. Click the Verify or Repair disk button, as desired.
This completes the tutorial on repairing your FileVault home directory or sparseimage.
Post a Comment