How does one map physical sectors of a disk to the files that contain them on an HFS+ volume on Mac OS X

Question

I've been recovering a hard disk using dd_rescue, which provides me a list of all of the device sectors it could not copy due to hardware errors.

I'd like to take that list, and write a tool to give me all of the files that contain these bad sectors so I can delete them. I'm not sure what APIs I can use to do this--essentially i want to get a list of all files on disk and for each file, a list of the ranges of sectors it occupies on disk.

My first guess is that I will iterate over each directory entry on the disk and check to see if the file overlaps one of these bad sectors. Maybe there's a better way.

Answer 1

If you want to map a file's data location to a physical block (sector), you can use the fcntl(2) call with the F_LOG2PHYS command. Not all file systems support this command, but HFS+ does. Just use lseek to pick the file offset and you can get back the diskoffset from F_LOG2PHYS (it's returned in a struct log2phys in the l2p_devoffset field). See fcntl.h for more details.

Answer 2

There's no API exposed for grubbing through HFS+ filesystems, but the source for the filesystem is available from Apple as part of the XNU kernel. Also check out the hfsdebug tool which might help to understand the fs.

Answer 3

It's an old question, but since it still is among the top hits when searching the topic, here's to all who searched:

Since Mac OS X 10.6 fsck_hfs(8) can map physical sectors to files (see option -B). A note on usage: matching will only be successful if checking of the catalog was actually performed. So you might have to force checking with options -l or -f.

BTW, hfsdebug as a PPC binary relies on Rosetta and thus will not run on Lion or later.