Find the HFS+ Volume Header or Alternate Volume Header and the partition start offset

The Volume Header and Alternate Volume Header have important information about the HFS+ file system. Both can be used to find the start of a partition.

Parameter: --find-vh / --find-avh

The Volume Header

The location of the Volume Header is 1024 bytes after the partition start. Finding the Volume Header is a good way to find the partition start. The Volume Header has also important information like the location and size of the Extents Overflow File.

When you lost the partition table or you are working with a hard disk image then it's required to know the start offset of the partition with your HFS+ file system. One solution to get the partition start offset is to find the HFS+ Volume Header with the '--find-vh' parameter. A HFS+ file system has a backup of the Volume Header (the Alternate Volume header). This means that hfsprescue will report a few hits. When you had only one HFS+ partition on the drive, then the first hit should be the right one. You can use the '--first' parameter to limit the output to the first detected HFS+ Volume Header.

A valid HFS+ Volume Header criteria of hfsprescue is the 'lastMountedVersion' field. This field is set by the operating system that mounts the partition. Only Mac OS X and Linux is seen as valid by hfsprescue. When the last mount of the partition has been done by another OS, then use '-f' to ignore the OS limitation. If you need more details during the search process then use the '-v' verbose parameter.

When you use '-o <offset in bytes>' then the search begins at the offset and skips the bytes before.

The result of the search will be logged in the file 'hfsprescue-data/find-vh.log'.

hfsprescue --find-vh [-o <offset in bytes>] [--first] [-f|--force] [-v|--verbose]

Example: Show only the first HFS+ Volume Header.

Command: hfsprescue --find-vh /dev/sdb --first

Sample output:

*** Stop searching after the first Volume Header has been found.

Scanned 200 MB.
============================================
A Volume Header has been found.

Partition start:     209735680 (Byte), 0xc805000, 409640 (LBA Sector), at 200 MB
Volume Header start: 209736704 (Byte), 0xc805400, 409642 (LBA Sector), at 200 MB

Signature:                      0x2b48, H+
LastMountedVersion:             H+Lx, last mount by Linux.
FileCount:                      4362
DirCount:                       144
BlockSize:                      4096
TotalBlocks:                    244190208
AllocationFile StartBlock:      1
ExtentsOverflowFile StartBlock: 7454
CatalogFile StartBlock:         10270

The partition start offset is '209735680'.

Use this value for the '-o <offset in bytes>' parameter in combination with '-s3' and '--one-file'.

Example: hfsprescue -s3 /dev/sdb -o 209735680'

You can extract the Volume Header. See here.

Example: hfsprescue --extract-vh /dev/sdb 409642

The Alternate Volume Header

The Alternate Volume Header is a backup of the Volume Header and is stored 1024 bytes before the end of the partition. When you know the location of the Alternate Volume Header, the block size and total blocks, then its possible to calculate the partition start.

The search for the Alternate Volume Header goes from the end of the hard disk to the beginning.

The resultof the search is stored in 'hfsprescue-data/find-avh.log'.

hfsprescue --find-avh [--first] [-f|--force] [-v|--verbose]

Example: Stop after the first HFS+ Alternate Volume Header.

Command: hfsprescue --find-avh /dev/sdb --first

Sample output:

*** Stop searching after the first Volume Header has been found.

Searching backwards for the Alternate Volume Header.

============================================
A Volume Header has been found.

Volume Header start: 1000412826624 (Byte), 0xe8ed404c00, 1953931302 (LBA Sector), at 954068 MB

Signature:                      0x2b48, H+
LastMountedVersion:             10.0, last mount by Mac OS X.
FileCount:                      0
DirCount:                       0
BlockSize:                      4096
TotalBlocks:                    244190208
AllocationFile StartBlock:      1
ExtentsOverflowFile StartBlock: 7454
CatalogFile StartBlock:         10270

Possible partition start: 209735680 (Byte), 0xc805000, 409640 (LBA Sector), at 200 MB

The possible start is at offset '209735680'.

Use this value for the '-o <offset in bytes>' parameter in combination with '-s3' and '--one-file'.

Example: hfsprescue -s3 /dev/sdb -o 209735680'

You can extract the Volume Header. See here.

Example: hfsprescue --extract-vh /dev/sdb 1953931302

© 2024 by Elmar Hanlhofer