# \[tsk\_recover\] Recover files from harddrive image -\> Unsupported file system type (hfs\_load\_extended\_attrs: Unsupported record type: (32)) ( - hfs\_load\_attrs A)

**URL:** <https://sleuthkit.discourse.group/t/tsk-recover-recover-files-from-harddrive-image-unsupported-file-system-type-hfs-load-extended-attrs-unsupported-record-type-32-hfs-load-attrs-a/3511>\
**Category:** The Sleuth Kit Help\
**Created:** [December 5, 2022, 12:56pm UTC](https://sleuthkit.discourse.group/t/tsk-recover-recover-files-from-harddrive-image-unsupported-file-system-type-hfs-load-extended-attrs-unsupported-record-type-32-hfs-load-attrs-a/3511 "2022-12-05T12:56:02Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![M4x](https://avatars.discourse-cdn.com/v4/letter/m/8edcca/32.png) [@M4x](https://sleuthkit.discourse.group/u/M4x)\
**Post date:** [December 5, 2022, 12:56pm UTC](https://sleuthkit.discourse.group/t/tsk-recover-recover-files-from-harddrive-image-unsupported-file-system-type-hfs-load-extended-attrs-unsupported-record-type-32-hfs-load-attrs-a/3511/1 "2022-12-05T12:56:02Z")

</div>

Hey everybody,

I’ve created an image from a harddrive (HFS+ / Mac OS Extended file system) using a Linux machine (Ubuntu 20.04) via

```auto
ddrescue -n /dev/sdc2 /dev/sdb1/rescue.img ddrescue_mapfile.log

```

and

```auto
ddrescue -r3 /dev/sdc2 /dev/sdb1/rescue.img ddrescue_mapfile.log

```

I’ve restored the files from the image to a new harddrive via

```auto
tsk_recover -a /media/max/backup_hdd/rescue.img /media/max/new_hdd/

```

The new harddrive is using the same file system as the old one (HFS+ / Mac OS Extended). I was able to restore most of the files. However, for some image files I’ve got a message like this:

```auto
Unsupported file system type (hfs_load_extended_attrs: Unsupported record type: (32)) ( - hfs_load_attrs A)
Error writing file: /media/max/new_hdd///OSMOSE/Unknown1.jpg

```

Looking at the new harddrive, the file is there but it’s empty.

The old harddrive seems to have some defects but I’m able to mount it and read files from it. The image from the error message above (Unknown1.jpg) is there and I can read it. Therefore it can’t (or shouldn’t be) be corrupted in the image I’ve taken from the old harddrive.

To me it looks like the HFS+ file system is using some attributes which aren’t supported by tsk\_recover. Unfortunately I wasn’t able to find out anything regarding this error message.

I’m looking forward to your replies!

Thank you very much in advance!  
Max