|
Tutorials 
How To Run fsck To Examine A Non-boot Volume In Mac OS X
By Charles E. Flynn, Contributing Editor
Those of you who have used Mac OS X since the days of the Public Beta,
and those of you who joined this adventure later but have been paying
close attention, are aware of the fact that when the Disk First Aid
portion of Disk Utility is run from the startup volume and asked to
examine the startup volume, it gives unreliable diagnoses. For example,
it often incorrectly reports that there are problems, such as "orphaned
indirect inodes," with the startup volume.
Apple has documented this problem with running the Disk First Aid
portion of Disk Utility from the startup volume in Knowledge Base
article #106270 http://docs.info.apple.com/article.html?artnum=106270 Mac OS X
10.0: Disk Utility Incorrectly Reports Disk Errors on Startup
Volume, and has suggested two solutions:
1. Boot from the Mac OS X Installer CD, and wait for the Menu bar to
appear at the top of the screen. The menu item "Open Disk Utility..." is
in the Installer menu that appears when you boot from this CD. Disk
Utility combines the new Disk First Aid for Mac OS X and Drive Setup
into a single application. Do not be alarmed when the installer says it
is preparing the installation. Open Disk Utility, and use its Disk First
Aid pane to diagnose and repair the internal hard drive. You may also
use it to examine and repair any other mounted volumes.
2. Prepare to boot from an installation of Mac OS X, and then boot into
single-user mode, by holding down Command S during the boot or restart.
Once in single-user mode, use the fsck -y routine to diagnose and repair
the disk. Instructions for using fsck are in the Knowledge Base article
#106214 http://docs.info.apple.com/article.html?artnum=106214 Mac
OS X: Why, When, and How to Run fsck for File System Maintenance.
Similar but not identical instructions for using fsck are conveniently
provided on screen whenever you boot into single-user mode. (So now they
tell us that thoughtfulness does not require a graphical user interface,
however preferable one may be.)
There have been some user reports in the Apple Discussion Forums of
cases in which running fsck repeatedly could make repairs that the Disk
First Aid portion of Disk Utility could not make, even when run from the
Mac OS Installer CD. Keep in mind that if your Mac OS X installation is
the most recent release, it may have Disk First Aid libraries that are
newer than the ones on your Mac OS Installer CD. (The differences could
be due to differences in the Disk First Aid libraries, or to the fact
that fsck runs so early in the boot process.) The most interesting
report I have seen is that fsck run three times in single-user mode was
able to repair an HFS+ disk directory error known as the "keys out of
order" problem. I had never seen a report that the Disk First Aid
application could repair any instance of the "keys out of order"
problem.
Apple's instructions for using fsck are admirably clear, but do not
explain how to use fsck to examine and repair a volume other than the
current boot volume.
We need a way to specify the volume to examine, one that can used by the
operating system in single-user mode. The pathname of the character
device file for the HFS+ volume provides this. We also need to make
certain that the diagnostic and repair routine used can handle HFS+
volumes.
Most of this article is about how to find or construct the complete
pathname of the character device files for the HFS+ volumes. The rest is
easy.
About fsck
The original fsck program was a UNIX utility that performed basic
diagnosis and repair of the UFS formatted disks used by various UNIX
variants (called "flavors") to store their operating systems,
applications, and user files. Fsck performs roughly the same type of
diagnosis and repair for UFS disks that Apple's Disk First Aid performs
for HFS+ formatted volumes.
The best explanation I have seen of what fsck does for UFS formatted disks is in
http://www.amazon.com/exec/obidos/ASIN/0130206016/osxfaq-20 Unix System
Administration Handbook[/url] (third edition) by Evl Nemeth et al, (Prentice
Hall) pages 132-138 ($68)
(not a direct quote; scribbled on a pharmacy receipt for earplugs)
What fsck (file system consistency check) does
fsck fixes the five most common types of UNIX directory damage:
1. unreferenced inodes
2. inexplicably large link counts
3. unused data blocks not recorded in the blockmap
4. data blocks listed as free that are also used in a file
5. incorrect summary information in the superblock
The text describes the superblock, which seems to be similar to the
Volume Information Block on a regular HFS or HFS+ disk. Other
UFS-specific aspects of disks, such as inodes (used to index file
sectors), link counts, and the blockmap, have corresponding aspects on
the HFS+ disks on which most installations of Mac OS X are found.
The authors state that there are commands that allow manual intervention
in the UFS file system, but that these should be used only by persons
planning to start a cult in Texas.
Apple is selling Mac OS X as a flavor of UNIX, and any UNIX-savvy person
is familiar with running fsck in single-user mode to examine the startup
volume. However, the original fsck utility itself cannot diagnose and
repair an HFS+ volume.
When the Mac OS X version of fsck is asked to diagnose and repair an
HFS+ volume, it invokes a program named fsck_hfs (also located in
/sbin), which uses the Disk First Aid libraries to examine and repair
the volume.
Whenever you want to use any of the UNIX commands available in the
Terminal application supplied with Mac OS X, you can open Terminal
(located in /Applications/Utilities) and type "man" followed by the name
of the command. The corresponding man (for "manual") page appears. (Use
the space bar to display more of it, if it does not fit on one screen.)
You can also read the man pages online at this site. This reference
material is quite helpful if you need to consult the man pages, but do
not currently have a Macintosh running Mac OS X in front of you.
Some man pages are relatively easy to understand, while others leave you
confused about the command you looked up, but with a deeper appreciation
of the assessment of man pages, "written by engineers for engineers."
The man page for fsck makes it clear that it should be possible to
specify which filesystem is to be examined, but does not explain how you
should specify it. The engineers know that "filesystem" means a
partition, not a type of disk format, in this context.
Finding the pathname for a volume's character device file using
Terminal:
Every device connected to any UNIX system is represented by a file
called a device file, located in the /dev directory. These files are of
two types, character device files and block device files. In general,
devices that handle their data one character at a time, such as
keyboards, are represented by character device files. Devices that
handle data in blocks (as small as 512 bytes) are represented by block
device files. Just to make learning UNIX even more intellectually
satisfying, partitions on disk drives have both character and device
files.
The Disk Utility program in Mac OS X 10.1.5 does not provide the block
device file pathnames. The pathnames for the corresponding character
device files are not difficult to construct. They all begin with /dev.
They identify the device by number and the partition on the device by a
number. Device numbers are unique for each device (0,1,2,...) but each
device has partitions numbered 1,2,3 and so forth.
Most Mac OS X users use the Drive Setup portion of Disk Utility to
format or partition their disks, and to initialize volumes. The UNIX
utility used to perform these tasks is called pdisk. This is a powerful
and potentially dangerous utility, but it has one highly useful and
completely safe (read-only) command you should know about.
To see the pathnames of the character device files for the volumes on
your internal hard disk, open the Terminal application, located in
/Applications/Utilities.
Type:
df
Press the Return key.
Below is the result when two disks are mounted. My internal hard disk
has Finder partitions named Cube_OS_X, Cube_OS_9.1, Cube_Part_3, and
UFS_Land. Cube_Part_3 is the current boot volume. The volume named
File_Shuttle_hfs+ is a Fujitsu magneto-optical cartridge in an external
Fujitsu DynaMO 1300PE FireWire drive.
The boot volume, /dev/disk0s11 mounted on /, has Finder name
Cube_Part_3, which does not appear in the output of the df command.
If you have a second drive, it is probably shown as /dev/disk1.
The Filesystem column at the left shows the pathname for the block
device file, such as /dev/disk0s9 . Inserting an r before the "disk" in
/dev/disk0s9 gives the pathname for the character device file for the
volume. Both /dev/disk0s9 and /dev/rdisk0s9 appear as files in the /dev
directory. These files are created during the boot. The /dev directory
on an installation of Mac OS X that is not in use is essentially empty.
Unfortunately, when the df command is used in single-user mode, it
displays only the data for the boot volume. I have not been able to use
the mount command while in single-user mode to mount the volumes, making
it possible for the df command to display data for other volumes.
I suggest you save and print the results of the df command used in
Terminal, in case you need them later.
We need a way (or two) to determine the pathname of the character device
file for each HFS+ volume, one that works in single-user mode.
Using the pdisk command to construct the pathnames of the character
device files:
Whenever any disk is formatted, a logical structure called the partition
map is created. The partition map is a very small amount of crucial data
at the start of the disk that defines the various partitions on the
disk, what types they are, where they begin (the base), and how large
they are (the length). Serious damage to the partition map renders a
disk unreadable. Such damage cannot be repaired.
If third-party disk repair utilities cannot see a disk, it would be
helpful to know if the partition map can be read. Pdisk can be safely
used to read the partition map. I would not suggest using it rather than
Disk Utility to modify partitions.
To see the partition map for your internal hard disk, open the Terminal
application.
Type:
sudo -s
You are prompted for your administrative password, the one you created
when you installed Mac OS X. Note that after you enter it, you are the
root user (superuser).
Type:
pdisk /dev/rdisk0 -dump
(The 0 is a zero.) Press the Return key.
Here is the result, for a disk with Finder partitions named Cube_OS_X,
Cube_OS_9.1, Cube_Part_3, and UFS_Land, is:
Pdisk displays the same information about the partition map in
single-user mode.
Note that each partition on rdisk0 has a number in the column at the
left. For each partition, adding the length to the base gives the base
for the next partition.
If you have a second drive, substitute a 1 for the 0 in the pdisk
command above.
If the disk was formatted with Drive Setup in Mac OS 9 rather than Disk
Utility, the correct Finder names for the HFS+ volumes may not be shown;
the volumes may be named "untitled" followed by an integer. (This
problem has been reported to Apple.) If you are familiar with the
volumes, you may be able to correlate the size with the correct Finder
name.
For each of your volumes, save as a text file for future reference the
text description of the partition map shown above, then type:
exit
Press the Return key.
Note that you are now your familiar self, rather than the root user.
You can see the complete pathnames for the character device files for
current volumes by opening Terminal, then typing (press Return after
each line):
cd /dev
ls -lias
Each partition (whether it displays in the Finder or not) on each
mounted volume will have two files in the list for the /dev directory.
The names of the files identify both the device by number and the
partition on the device by its number. You may have to scroll a bit in
the Terminal window to find the files.
Quit the Terminal application.
The pathnames for the character device files for the three HFS+ volumes described above, all on /dev/rdisk0, are:
/dev/rdisk0s - for Apple_HFS Cube_OS_X
/dev/rdisk0s10 - for Apple_HFS Cube_OS_9.1
/dev/rdisk0s11 - for Apple_HFS Cube_Part_3
Note than an s separates the description of the disk (rdisk0) from the
number of the partition on that disk.
My Fujitsu DynaMO 1300FE external drive has the HFS+ volume on one of
its magneto-optical cartridges mount as /dev/rdisk1s5. The number of the
partition sometimes varies, depending on how many different driver
partitions are on the cartridge. (Some of these cartridges have been
used in a SCSI magneto optical drive, and happen to have FWB SCSI
drivers installed on them.)
Finding the pathnames for the character device files in single-user
mode:
When you use fsck in single-user mode to examine a non-boot volume, wait
until the instructions for running fsck -y appear on the screen. Then
wait some more to see if the screen continues scrolling. I was going to
tell you that with Mac OS X 10.1.3, the last text that appears is
"Rereading ROM up to 2e quads". Reading that message in its entire
context made it clear that the ROM was in an external FireWire MO drive.
When that drive is not connected, the instructions for running fsck -y
are two lines from the last text on the screen.
When you are in single-user mode, do not be alarmed if you start typing
a command and before you finish, Darwin puts some more text on the
screen. Just let Darwin finish, then go back to the command line.
If you do not have the name of the character device file for a volume
you wish to examine, you can find it in single-user mode by using the cd
command to list the contents of the /dev directory. The cd command can
make use of the "more" command to display the first screen of output;
press the space bar to see more.
In single-user mode, type:
cd /dev
Press the Return key.
type:
ls -lias | more
The | character is above the \ character. The character is called a pipe
in UNIX, and causes the result of the first command to be passed along
as the input to the second command.
Press the Return key.
Look for files with pathnames such as /dev/rdisk1s5. Unfortunately,
there is no way to see the corresponding Finder names for the volumes by
looking at the contents of the /dev directory, but if you combine this
information with the names shown in the partition map, you should be
able to construct the pathname of the character device file for each
HFS+ volume. In general, the HFS+ volumes are going to be among those
with the higher partition numbers, as you can see in the partition map
above.
To use fsck to examine the volume:
To run fsck to examine a volume other than the boot volume, boot or
restart in single-user mode by booting or restarting, and then
immediately holding down Command S. Wait for the screen to stop
scrolling:
Type (for example):
/sbin/fsck_hfs -y /dev/rdisk1s5
Press the Return key.
The familiar Disk First Aid messages appear on the screen, followed (we
hope) by the good news that the disk appears to be OK.
If you get a message stating that the disk has been modified, repeat
using the routine until you get the message that the disk appears to be
OK. You will have to use your own judgement about whether you are making
any progress if you have to do this more than three times.
Note that we must invoke fsck_hfs directly. If we type (for example):
/sbin/fsck -y /dev/rdisk1s5
we get an error message:
BAD SUPERBLOCK: MAGIC NUMBER WRONG
LOOK FOR ALTERNATE SUPERBLOCKS? yes
These references to UFS-specific aspects of disks show us that when we
want to use fsck to examine a volume other than an HFS+ startup volume,
we must invoke fsck_hfs ourselves.
Apple's on screen instructions for fsck tell you to type /sbin/mount -uw
/ as your last command, to mount the various volumes. When I do that,
the boot process does not resume, unless I follow the command with an
"exit" command. The instructions in Knowledge Base article #106214
http://docs.info.apple.com/article.html?artnum=106214 Mac OS X:
Why, When, and How to Run fsck for File System Maintenance say to
use finish by using the "reboot" command at the #prompt. Type:
reboot
Press the Return key.
Credits: Christian Pickman contributed the UNIX pipe.
The screen captures were made by Snapz Pro X, from Ambrosia Software.
If you have any questions or comments about this article, feel free to E-mail them to charles_flynn@osxfaq.com
|
