Repair Time Machine sparsebundle that will no longer mount

I messed up my Time Machine backup in some way. I'm no longer able to mount the sparsebundle file as I get an error stating that there are no mountable filesystems.

I used the hdiutil command to attach the sparsebundle file:

hdiutil attach -nomount -readwrite flattop.sparsebundle

which resulted in the following /dev/ devices:

/dev/disk2              Apple_partition_scheme
/dev/disk2s1            Apple_partition_map
/dev/disk2s2            Apple_HFSX

Afterwards I ran the fsch_hfs command to check the main volume (/dev/disk2s2):

fsck_hfs -drf /dev/disk2s2

This resulted in a notice that the Time Machine Backups volume is corrupt and needed to be repaired:

Unable to open block device /dev/disk2s2: Permission deniedjournal_replay(/dev/disk2s2) returned 13
** /dev/rdisk2s2 (NO WRITE)
    Using cacheBlockSize=32K cacheTotalBlock=32768 cacheSize=1048576K.
   Executing fsck_hfs (version diskdev_cmds-540.1~34).
Non-empty journal:  start = 66310144, end = 94912512
   Journal need to be replayed but volume is read-only
** Checking Journaled HFS Plus volume.
** Detected a case-sensitive volume.
   The volume name is Time Machine Backups
** Checking extents overflow file.
   Unused node is not erased (node = 3568)
   Unused node is not erased (node = 3574)
   Unused node is not erased (node = 3575)
** Checking catalog file.
** The volume Time Machine Backups was found corrupt and needs to be repaired.
    volume type is pure HFS+ 
    primary MDB is at block 0 0x00 
    alternate MDB is at block 0 0x00 
    primary VHB is at block 2 0x02 
    alternate VHB is at block 2865568974 0xaacd1cce 
    sector size = 512 0x200 
    VolumeObject flags = 0x07 
    total sectors for volume = 2865568976 0xaacd1cd0 
    total sectors for embedded volume = 0 0x00 

As you can see there is also an error saying "Unable to open block device /dev/disk2s2: Permission deniedjournal_replay(/dev/disk2s2) returned 13".

I thought this might be due to not running the fsck_hfs command as a su, so I tried it with sudo but this had the same result.

My sparsebundle file is on a Synology DS408 NAS and has been running without a problem for about 2 years now :(

Anyone an idea how to take this further?

Kind regards, Niels R.

UPDATE: As I suspected while writing this question I probably have a problem with read/write permissions. I now see the volume appearing in the Disk Utility and when I click on "Verify" I get the following output:

Verifying volume “Time Machine Backups”
Checking file systemJournal need to be replayed but volume is read-only
Checking Journaled HFS Plus volume.
Detected a case-sensitive volume.
Checking extents overflow file.
Unused node is not erased (node = 3568)
Checking catalog file.
Keys out of order
The volume Time Machine Backups was found corrupt and needs to be repaired.
Error: This disk needs to be repaired. Click Repair Disk.

Can I simply chmod the sparsebundle file to set the right permissions?

I have a write up on how to try and repair NAS-based sparsebundle errors on my blog. In summary:

1. hdiutil attach -nomount -noverify -noautofsck /Volumes/{name of your disk}/{name of}.sparsebundle

   You will then see something like

   /dev/diskx Apple_partition_scheme
   /dev/diskxs1 Apple_partition_map
   /dev/diskxs2 Apple_HFSX
   

   Where x is the disk id for the external disk. x might be 2, 3, 4 or higher. You are interested in the one labeled Apple_HFSX or Apple_HFS.

2. fsck_hfs -drfy /dev/diskxs2 using whatever relevant device was located in Step 1.

   Hopefully, you will eventually see

   The Volume was repaired successfully

3. hdiutil detach /dev/diskxs2

However, since OS X 10.6.3, Time Machine will refuse to write to a destination volume that fails its verification. Even if the process above succeeds in recovering the backup, you may still need to remove the black marks that Time Machine wrote when it failed verification.

4. Unlock the sparsebundle

   chflags -R nouchg /Volumes/{name of your disk}/{name of}.sparsebundle
   

5. Move it back to its original location

   mv /Volumes/{name of your disk}/{name of}_YYYY-MM-DD.sparsebundle /Volumes/{name of your disk}/{name of}.sparsebundle
   

6. At the top level directory of the sparsebundle, edit the file com.apple.TimeMachine.MachineID.plist.

   • Remove

     <key>RecoveryBackupDeclinedDate</key>
     <date>{whatever-the-date}</date>
     

   • Change

     <key>VerificationState</key>
     <integer>2</integer>
     

     to

     <key>VerificationState</key>
     <integer>0</integer>
     

Extended attributes on the sparsebundle may be preventing writes on the file:

Run

chflags -R nouchg flattop.sparsebundle

But be careful, the sparsebundle may have been protected because it genuinely is broken.

It's not that simple as chmod. First, it appears that 10.5 / 10.6 / 10.7 all have minor differences in how a sparse bundle is handled. Second, the flags and dirty/bad status of a sparse bundle are stored elsewhere. Third, you may need to attack the sparse bundle itself - not the filesystem that is contained within.

Your best bet is to let Disk Utility take a crack at repairing the image before you look at the filesystem embedded within. It works on both the bundle and the filesystems - as well as knows how Apple has stored things.

The details of the bundle are either proprietary or hard to discern from the developer docs - and it's certainly not something other third party utilities are keen to fix at this point. As long as you are using an equal or newer version of Disk Utility than the mac that made the backups, you should be fine. Once you've given up on Disk Utility - you might try something like Drive Genius or Disk Warrior - but I'd stick with Apple's tool if you hope to reuse this bundle.

The nature of sparse bundles - specifically the hard links as well as the concept that it's not compacted when files are deleted, there is a lot of work to be done. I have had DiskUtility run for two weeks and still not complete a repair pass on a 800MB sized archive.

In practice, you might be better off just reverting to a prior version of your NAS if it has snapshots or is backed up itself. In the end - if there are errors that fsck/Disk Utility can't fix, your sparse bundle will be marked as bad and it will be locked. You can then read things, but never write to it again. Do see if you can connect a machine to the storage and fix things (DAS or high speed connections are better - as is a machine that can have the time to fix things and not get rebooted is ideal)

Best of luck - this may not be recoverable from the details you provided.