Hey everybody,
I’ve created an image from a harddrive (HFS+ / Mac OS Extended file system) using a Linux machine (Ubuntu 20.04) via
ddrescue -n /dev/sdc2 /dev/sdb1/rescue.img ddrescue_mapfile.log
and
ddrescue -r3 /dev/sdc2 /dev/sdb1/rescue.img ddrescue_mapfile.log
I’ve restored the files from the image to a new harddrive via
tsk_recover -a /media/max/backup_hdd/rescue.img /media/max/new_hdd/
The new harddrive is using the same file system as the old one (HFS+ / Mac OS Extended). I was able to restore most of the files. However, for some image files I’ve got a message like this:
Unsupported file system type (hfs_load_extended_attrs: Unsupported record type: (32)) ( - hfs_load_attrs A)
Error writing file: /media/max/new_hdd///OSMOSE/Unknown1.jpg
Looking at the new harddrive, the file is there but it’s empty.
The old harddrive seems to have some defects but I’m able to mount it and read files from it. The image from the error message above (Unknown1.jpg) is there and I can read it. Therefore it can’t (or shouldn’t be) be corrupted in the image I’ve taken from the old harddrive.
To me it looks like the HFS+ file system is using some attributes which aren’t supported by tsk_recover. Unfortunately I wasn’t able to find out anything regarding this error message.
I’m looking forward to your replies!
Thank you very much in advance!
Max