2006-11-02

How To Fix Corrupted Mac Filevaults

Both of these require twice the size of the image.

Version One: The Con-Version


Log in as a administrative user different from the one that owns the corrupt vault, then:

sudo mv image.sparseimage other-name.sparseimage
sudo hdiutil convert -format UDSP -o image.sparseimage [-encryption]

Allegedly fixes filesystem problems; not how I did it.

Version Two: fsck_hfs


[BTW: Change one letter in that headline and you have my feelings in a nutshell.]

This is how I did it:

a) Copy the whole image to a safe location.
b) Compare strong checksums, e.g. MD5 between original and copy.
c) If (a) and (b) turn out OK, log in as a (different!) administrative user. You might have to create that account only now, and likely you're working on the corrupt filesystem in the meantime, so get on with it already.
d) As that user, open a shell and attach the image without mounting it:

sudo hdiutil attach /Users/username/username.sparseimage -nomount

Note the -nomount.
In the case of filevault or other encrypted image, you will be asked for the key. hdiutil will tell you as which device the image was attached. For this post, I'll assume that it's disk2, and that the damaged FS is on slice 2.
e) Check the HFS on the image:

sudo fsck_hfs -f /dev/rdisk2s2

Note the -f, without which fsck_hfs won't touch journaling HFS+s, and the "r" in front of disk — you need to use the character ("raw") device for fsck.
f) If fsck_hfs bails because of too many errors, just repeat until it says the FS is fine. That irks the bejeezus out of me as well, but has always worked for me so far.
g) Detach the volume:

sudo hdiutil detach /dev/disk2

h) Log out, log in as the original user. If you're lucky, it works now.

Oh, and did you note how I said that you need twice the space for the process than for the original image? The tech-savvy among you may have noticed that here, that's "only" the backup. It's not technically needed. Now repeat after me:
I will make the backup. I will make the backup. I will make the backup.

If you don't, and anything at all goes wrong (You know that guy called Murphy?) you are utterly hosed. More hosed, harder hosed, and colder hosed than an inmate on shower day. Imagine that inmate dropping the soap. That's how hosed you will be.
So just don't skip the backup, and verify it, too.

Epilogue: What if that sparseimage you talked about just isn't there?


If you got the corruption that you're trying to fix during a panic, the OS won't have cleaned up the filevault so far.
What you have to do then (this is assuming that you're already logged in as the second administrative user) is remove the file that indicates to Mac OS X that the filevault is in use, move the image in place and remove the temporary directory where you've found it. Then proceed as above.

sudo rm /Users/bhaug/.autodiskmounted
sudo mv /Users/.bhaug/bhaug.sparseimage /Users/bhaug/
sudo rmdir /Users/.bhaug