hdiutil attach -nomount -readwrite Bhaal_0011247e3338.sparsebundle

/dev/disk1              Apple_partition_scheme
/dev/disk1s1            Apple_partition_map
/dev/disk1s2            Apple_HFSX

fsck_hfs -rf /dev/disk1s2

** /dev/rdisk1s2
** Checking Journaled HFS Plus volume.
** Detected a case-sensitive catalog.
** Checking Extents Overflow file.
** Checking Catalog file.
** Rebuilding Catalog B-tree.
** Rechecking volume.
** Checking Journaled HFS Plus volume.
** Detected a case-sensitive catalog.
** Checking Extents Overflow file.
** Checking Catalog file.
   Incorrect number of thread records
(4, 13716)
** Checking multi-linked files.
** Checking Catalog hierarchy.
   Invalid directory item count
   (It should be 0 instead of 1)
   Invalid directory item count
   (It should be 3 instead of 4)
   Incorrect folder count in a directory (id = 3795486)
   (It should be 0 instead of 1)
** Checking Extended Attributes file.
** Checking multi-linked directories.
** Checking volume bitmap.
** Checking volume information.
   Invalid volume free block count
   (It should be 37267681 instead of 37310834)
   Volume Header needs minor repair
(2, 0)
** Repairing volume.
** Rechecking volume.
** Checking Journaled HFS Plus volume.
** Detected a case-sensitive catalog.
** Checking Extents Overflow file.
** Checking Catalog file.
** Checking multi-linked files.
** Checking Catalog hierarchy.
** Checking Extended Attributes file.
** Checking multi-linked directories.
** Checking volume bitmap.
** Checking volume information.
** The volume Backup of Bhaal was repaired successfully.

112 thoughts on “How to fix a Corrupted Time Machine Backup”

1. Pingback: Anders’ blog om dit og dat » At reparere en time-machine backup

2. You so saved my ass.. thanks

3. my ass too. Thanks!

4. With the “Invalid sibling link” error, it looks like the “-r” to rebuild the catalog is required. I think this is also why “Disk Utility” failed–“Disk Utility” just runs fsck_hfs itself, but without the “-r”. By way of support, here’s what I get on a damaged TM sparse disk image with fsck_hfs and no “-r”:

   sh-3.2# fsck_hfs -yf /dev/disk5s2
   ** /dev/rdisk5s2
   ** Checking Journaled HFS Plus volume.
   ** Detected a case-sensitive catalog.
   ** Checking Extents Overflow file.
   ** Checking Catalog file.
   Invalid sibling link
   (4, 11213)
   ** Volume check failed.

   With “-r”, fsck_hfs just finished rebuilding the catalog.

5. Help! I’m not unix literate but when I type in the command along with the name of my sparse bundle, I get this:

   hdiutil: attach failed – No such file or directory

   I suspect that hdiutil does not know how to locate my sparse bundle. What do I need to do?

6. Oh never mind. I think I figured it out. It seems the easiest way is to type in the command and then drag and drop the sparse bundle icon to the command line and it will automatically type in all the path to get to it. Whew! I’m in the process of repairing.

7. Hello again:

   The repair failed. I’m running it again. In the mean time, are there other tricks to try? This is the result from the termina:

   fsck_hfs -rf /dev/disk3s2
   ** /dev/rdisk3s2
   ** Checking Journaled HFS Plus volume.
   ** Detected a case-sensitive catalog.
   ** Checking Extents Overflow file.
   ** Checking Catalog file.
   ** Rebuilding Catalog B-tree.
   ** Rechecking volume.
   ** Checking Journaled HFS Plus volume.
   ** Detected a case-sensitive catalog.
   ** Checking Extents Overflow file.
   ** Checking Catalog file.
   Incorrect number of thread records
   (4, 29037)
   Incorrect number of thread records
   (4, 29037)
   ** Checking multi-linked files.
   Incorrect number of file hard links
   ** Checking Catalog hierarchy.
   Missing thread record (id = 2601736)
   Missing thread record (id = 2627256)
   Invalid directory item count
   (It should be 98412 instead of 98400)
   Invalid directory item count
   (It should be 22255 instead of 22257)
   Invalid directory item count
   (It should be 8129 instead of 8139)
   Invalid directory item count
   (It should be 3028 instead of 2808)
   Incorrect folder count in a directory (id = 18)
   (It should be 2 instead of 0)
   Incorrect folder count in a directory (id = 19)
   (It should be 22255 instead of 22257)
   Incorrect folder count in a directory (id = 2601655)
   (It should be 0 instead of 1)
   Incorrect folder count in a directory (id = 2675756)
   (It should be 4 instead of 7)
   Incorrect folder count in a directory (id = 2675519)
   (It should be 3 instead of 5)
   Incorrect folder count in a directory (id = 2675527)
   (It should be 1 instead of 9)
   Incorrect folder count in a directory (id = 2675803)
   (It should be 1 instead of 2)
   Incorrect folder count in a directory (id = 2676109)
   (It should be 1 instead of 2)
   ** Checking Extended Attributes file.
   ** Checking multi-linked directories.
   Invalid parent for directory inode (id = 2601736)
   (It should be 19 instead of 18)
   Invalid name for directory inode (id = 2601736)
   (It should be dir_2601736 instead of temp2601736)
   Incorrect number of directory hard links
   ** Volume check failed.

8. You could try the program “DiskWarrior” it supposedly can repair more filesystem errors than fsck_hfs. Only problem is that it’s about $100 US, has no free trial, and it might not work.

   It’s possible your backup got corrupted beyond repair :(.

9. Thank you! Process is running, so I am not sure yet but you have given me a glimpse of hope already.

10. trying this now and hoping it works. I have the same issue.

    An Apple “Genius” told me today that this is very common with the drive on another machine over wireless. I have an external Seagate drive connected to my airport and was backing up that way.

    He explained to me that with a TimeCapsule you get a ton of extra cache (like server level amount) so there is a nice big buffer in case of a wireless drop of any kind. With ordinary external drives you do not get a large amount of cache, so it becomes very easy for TimeMachine to go through a wireless hiccup during backup and thus corrupt your backup files. Supposedly this is why Apple still doesn’t officially support 3rd party external hard drives over wireless for TM. Of course it doesn;t hurt that the best solution is to pay more money and buy a TC.

11. My linux box already has a fairly large disk cache so I doubt that’s the entire problem. In fact if the TC has such a big cache if you lost power while backing up you’d almost guarantee some disk corruption. Though I think HFS+ is supposed to be journaled and would avoid corrupting the disk.

    I recently had my backup get totally destroyed when my server had a hardware check error during a backup. It took a run of reiserfsfsck to repair the filesystem, and I found some orphaned files from the sparsebundle. Too bad there’s no way to tell where they belong so my backups are permanently gone.

    Overall I’m not so impressed with Time Machine anymore. I would expect a backup system to be more robust and maybe actually tolerate something going wrong. I’m better off just checking all my files into svn, or syncing all my files via rsync. At least with these programs if the network dies or I lose power at least I won’t corrupt the entire backup. Worst case it should corrupt the files being written and not the entire filesystem.

12. This was the only real solution I found on the whole internet after looking for 3 day.
    Thank you very much!

13. Saved my butt! Thanks

14. In case you are having the problem that the backup volume on your NAS, or the sparsebundle can’t be unmounted/ejected I have found this work.

    Use lsof to generate a list of open files against the volumes they are on, this may help you kill processes that have the files open, or demonstrate that the backup volume is not in use, but that Mac OS X.5 thinks it still is:

    lsof | grep “name of your volume to eject”

    if you get something like:

    lsof: WARNING: can’t stat() smbfs file system /Volumes/backup
    Output information may be incomplete.
    assuming “dev=2d000009” from mount table
    then you don’t have any processes using that volume.

    Kill any processes (close applications, including terminal if necessary) output by lsof, then unmount the volume with:

    diskutil unmount force /Volumes/backup

    where “backup” is the name of my NAS volume, yours might be different.

    Now you can use hdiutil and fsck_hfs to mount and fix the volume.

    You may need to prefix these commands with sudo in order to make them work.

    -Jason

15. I use Time Capsules and frequently get backup corruption. Practically any time someone closes a MacBook while a backup is running. Also notoriously unreliable over wireless, so I use a wired connection when backing up. It helps to use TimeMachineEditor.app schedule backups.

    I am running your fix on one damaged backup now. Hope it works! Thanks for the tip.

16. Pingback: Fixing corrupt Time Machine Sparsebundles | iotashan's blog

17. For the last couple of days I have been running TM to my NAS. During a backup run yesterday I got an error that the backup couldn’t be mounted and the bundle was corrupt.

    I tried the steps here but that didn’t seem to work. See the output below. Any thoughts?

    RMB-2:Backup_RMB rcs$ hdiutil attach -nomount -readwrite rcs_002332c7170e.sparsebundle/
    /dev/disk1 GUID_partition_scheme
    /dev/disk1s1 EFI
    /dev/disk1s2 Apple_HFS

    RMB-2:Backup_RMB rcs$ fsck_hfs -rf /dev/d
    disk0 disk0s2 disk1 disk1s2 dtracehelper
    disk0s1 disk0s3 disk1s1 dtrace
    RMB-2:Backup_RMB rcs$ fsck_hfs -rf /dev/disk1s2
    ** /dev/rdisk1s2
    ** Checking Journaled HFS Plus volume.
    ** Checking Extents Overflow file.
    ** Checking Catalog file.
    ** Rebuilding Catalog B-tree.
    ** The volume rcs_002332c7170e.sparsebundle could not be repaired.

    I tried this a couple of times with the same result.

18. I had this happen to me in the end, and it turned out that the filesystem underlying the sparse bundle was corrupted. I ended up having to just scrap my entire backup and start over.

    I’ve also heard that “DiskWarrior” can sometimes repair corrupted filesystems fsck_hfs cannot, but I have not verified this.

19. Thanks, saved my ass too

20. I have a older Windows XP laptop that I’m using as a NAS and encountered this problem. The first time that I ran fsck_hfs, it gave an error, but I ran it again, and it worked. Many thanks as I had almost given up on Time Machine.

21. I was having the issue of the sparsebundle appearing to be corrupt, timemachine couldn’t successfully back up to it.

    I thought I would copy the file to my hard disk from the time capsule so I could run disk utilities on it more quickly. I ran the following at the terminal

    sudo mv /Volumes/TCDisk/Simon\ Voigt’s\ MacBook\ Pro_001f5bf149ad.sparsebundle /Users/voigtstr/Downloads/temp

    The command put the sparsebundle into the temp folder and deleted it off the timecapsule. However now when I try to attach the sparsebundle with hdiutil, I get the following error.

    hdiutil attach -nomount -readwrite Simon\ Voigt’s\ MacBook\ Pro_001f5bf149ad.sparsebundle/
    hdiutil: attach failed – not recognized

    and strangely enough I can just browse through to the contents of the file (which now seems to be a normal folder in unix)(its not a normal folder in finder).

    drwxr-xr-x@ 4 root staff 136 20 Mar 22:21 Simon Voigt’s MacBook Pro_001f5bf149ad.sparsebundle

    cd Simon\ Voigt’s\ MacBook\ Pro_001f5bf149ad.sparsebundle/

    ls -la
    total 0
    drwxr-xr-x@ 4 root staff 136 20 Mar 22:21 .
    drwxr-xr-x 20 voigtstr staff 680 21 Mar 00:07 ..
    drwxrwxrwx@ 7 voigtstr staff 238 20 Mar 22:07 Simon Voigt’s MacBook Pro_001f5bf149ad.sparsebundle
    drwxr-xr-x 165 root staff 5610 20 Mar 22:18 bands

    if I go further into that second sparsebundle (it now seems that its nested somehow?)I get…

    ls -la
    total 24
    drwxrwxrwx@ 7 voigtstr staff 238 20 Mar 22:07 .
    drwxr-xr-x@ 4 root staff 136 20 Mar 22:21 ..
    -rwxrwxrwx 1 voigtstr staff 499 3 Jan 02:22 Info.bckup
    -rwxrwxrwx 1 voigtstr staff 499 3 Jan 02:22 Info.plist
    drwxrwxrwx 8997 voigtstr staff 305898 20 Mar 11:18 bands
    -rwxrwxrwx 1 voigtstr staff 369 20 Mar 21:00 com.apple.TimeMachine.MachineID.plist
    -rwxrwxrwx 1 voigtstr staff 0 3 Jan 02:22 token

    my big question is how do I use the hdiutil command to turn this all into a sparsebundle again that I can cp to the timecapsule and have it be readable by timemachine? Why did the unix mv command turn the sparsebundle file into a browsable bunch of folders when it was stored in my temp directory?

22. The command is not working for me. I’m getting “command not found” message. I dont know much about command but at this point I am desperate to get my info back.
    Thanks.

23. voigtstr, I don’t know that much about how sparsebundles are designed but I believe they make use of some filesystem tricks to keep their size reasonable. It’s possible mv messed up the sparsebundle somehow but I’m not sure (in the future use cp).

    Can you mount the sparse bundle via finder? Or maybe mount it by dropping it on diskutil?

    Also does the “bands” folder have anything? I believe all your data is stored in bands, but with very odd filenames, OS X stores an index somewhere to map the data in bands into your files. Though I honestly don’t know too much about the low level details of Apple’s sparsebundle.

    Lola, are you typing sudo “command”? Though just typing hdiutil works for me even without sudo. Perhaps your path is messed up. You can try typing locate to get the full path to the command. For hdiutil on my mac you could then run hdiutil with:

    /usr/bin/hdiutil

24. dude, thanks for taking the time to write this up… that hdiutil mount trick is genius.

    fsck_hfs didn’t work the first time, but after reading the comments here I tried it again (on a whim) and it went through the second time.

    so if it doesn’t work on the first pass, keep trying! 🙂

25. I have a NAS that I use (unsupported) for Time Machine backups. It’s been working great, but now I can no longer mount the TM disk image. I tried running the following command in Terminal, as you said, to try fixing what seems to be a corrupted disk image, but Terminal just keeps “thinking” without outputting anything. I let it think for several hours before aborting it.

    hdiutil attach -nomount -readwrite /Volumes/MyBackup/iMac_001ff3546185.sparsebundle

    Any help would be appreciated!

26. Please add my ass to the list of those saved!

    I would have lost nearly a year of files without this tip.

27. fsck keeps telling me that it’s “non-journaled”, which I believe is wrong. The attach takes about 30 minutes, then fsck fails immediately, see below. Ideas?

    $ sudo fsck_hfs -rf /dev/disk1s2
    Password:
    ** /dev/rdisk1s2
    ** Checking Non-journaled HFS Plus volume.
    ** Checking Extents Overflow file.
    ** Checking Catalog file.
    ** Rebuilding Catalog B-tree.
    ** The volume TimeMachine cox-mc03 could not be repaired.

28. Update: I ran it without -r and it begins to run, but keeps looping at the same error (invalid node structure):

    ** /dev/rdisk1s2
    ** Checking Non-journaled HFS Plus volume.
    ** Checking Extents Overflow file.
    ** Checking Catalog file.
    ** Checking multi-linked files.
    ** Checking Catalog hierarchy.
    ** Checking Extended Attributes file.
    Invalid node structure
    (8, 52022)
    ** Repairing volume.
    ** Rechecking volume.

    ** Checking Non-journaled HFS Plus volume.
    ** Checking Extents Overflow file.
    ** Checking Catalog file.
    ** Checking multi-linked files.
    ** Checking Catalog hierarchy.
    ** Checking Extended Attributes file.
    Invalid node structure
    (8, 52022)
    ** Repairing volume.
    ** Rechecking volume.
    (repeat)

    I’m on 4 loops now; I don’t believe it’s going to work. Still puzzled why it says “non-journaled…”

29. Pingback: Time Machine disk filled up, then got corrupted « Eugene L. Chua

30. I just made the experience that the hdiutil attach does not work if the sparesbundle resides on a AFP share. You have to access it via Samba.

31. when I run:

    hdiutil attach -nomount -readwrite My-Mac-Mini_0016cbaf9b2f.sparsebundle

    I get an error

    hdiutil: attach failed – Operation not supported on socket

    Any ideas how to fix this …..

32. Holy bash shell Batman! Thank you very much you saved my backup.

33. Saved my butt too! Thanks for posting this. I had never heard of this problem until it hit my backup.

34. Thank you so much. All the other solutions I found were basically “Buy Disk Warrior”.

35. Worked for me! Thanks a ton!

36. Nice article. Worth noting that I had to add the “-noverify” flag to the hdiutil attach command. Without it, the command attempted to run fsck itself because my disk checksum was corrupt (or at least, I think that’s what was wrong). When hdiutil tried to run fsck, it hung because it wasn’t using the ‘-rf’ flags.

37. If you are wanting to try to repair the sparse image on Snow Leopard you will need to do this…

    (17:30:24) charles@yoshi:/Volumes/Air Backup
    $ hdiutil attach -nomount -readwrite -noautofsck -noverify yoshi.sparsebundle
    /dev/disk1 Apple_partition_scheme
    /dev/disk1s1 Apple_partition_map
    /dev/disk1s2 Apple_HFSX

    The important thing is the “-noautofsck” looks like snow leopard has separated verifying from fsck’ing…yay

38. Thank you for this great tutorial. It repaired my time machine backup too.

39. It should also be noted to turn *OFF* your time machine backups while you try to fix it, even though you don’t know it’s doing it the machine will continue to try to mount the sparsebundle, in my case I’d mounted it and was running the commands to bring it online when the OS ripped the sparse out from under me and was trying to do another (useless) fsck…

40. Thanks. fsck_hfs is now running. I’ve tried lots of things. I will see if this works. So far:

    ** Rebuilding catalog B-tree.
    Invalid node structure
    (4, 31814)

    It has been there for about 10 minutes.

    Thanks for the tip!

41. My sincerest thanks. My wife’s MacBook Air is now backing up again after not working for 4 days. In the past I have thrown away 6 months worth of backups due to this problem. I would add the following last command:

    $ hdiutil detach /dev/disk1

    Thanks again for the post.

    Microtard

42. Another happy camper. Note that the fsck ended with “The volume Xxxxx appears to be OK.” with no note of any actual changes made, but suddenly everything worked. This is after I tried to repair via Disk Utility, but failed after a few hours. Maybe the fix actually occurred during that time, or maybe fsck silently cured the problem… I don’t know.

    Also note that I used the “fsck_hfs -fy” option for my circumstance (no evidence of link corruption).

43. Pingback: macbook keeps asking to restart!!!!!! - EmiratesMac

44. Ok, I’m new to all this command line business, but after much searching on the internet, I’m fairly convinced this is what I need to do to fix my time machine. I’m running Snow Leopard on a MacBook. My Time Machine was backing up wirelessly until I installed Snow Leopard; now I haven’t had another backup since mid-November. I’ve tried using the Disk Utility to fix my sparsebundle but it came back as unable to be repaired. I’ve followed your instructions (using comments #s 6 & 37 above, as needed) up through the fsck_hfs command. When it tries to run, it says “Resource busy”… any thoughts, any one? Here’s the command codes I’ve put in, along with their results:

    brittany-bergquists-macbook:~ bcbergquist$ hdiutil attach -nomount -readwrite -noautofsck -noverify /Volumes/Brittany\ Bergquist\’s\ Time\ /Brittany\ Bergquist’s\ MacBook_002332be798e.sparsebundle
    /dev/disk2 Apple_partition_scheme
    /dev/disk2s1 Apple_partition_map
    /dev/disk2s2 Apple_HFSX
    brittany-bergquists-macbook:~ bcbergquist$ fsck_hfs -rf /dev/disk2s2
    ** /dev/rdisk2s2 (NO WRITE)
    Can’t open /dev/rdisk2s2: Resource busy

45. Pingback: Invalid node structure under Mac OS X 10.5 Leopard « Devlab

46. Thanks a lot !
    It didn’t work the first 3 times (too many errors I suppose).
    If it doesn’t work, don’t hesitate to try more than one time.
    I’ve realized on the second try that some errors detected on the first time has been repaired.
    Don’t give up !

47. I am trying to reclaim the spare archive from a Time Capsule.
    The power supply burned out. Prenthetically, I cannot
    recommend TC until Apple resolves the issues around heat
    dissipation. I opened the case and removed the hard drive.

    I connected it with a SATA to USB adapter. Now I see
    three mounted drives: APswap, APconfig, and the archive

    I tried the fsck_hfs -fr, and it ran successfully.
    “The volume Backup of Taliesin was repaired successfully.”

    But, when I try to use Time Machine to read earlier versions
    of the archive, noe of them appear.

    Any thoughts on what to do next?

    Thanks, phil

48. Of course I meant “sparsebundle”, not “spare archive”.

49. Brittany, try running top -o cpu. I’m new to the command line, so there might be a better command. But that one lists your processes by CPU usage. Find the fsck_hfs line and make note of the PID to the left. Then hit q and type “kill 123” where 123 is the PID.

    You might also be able to do “killall fsck_hfs” without using the top command, but once again, I’m not exactly savvy with the Unix shell.

    I did this, and lo and behold, the process was hanging up my drive, even after I unplugged it and plugged it back in. I’m running fsck_hfs command as I type this.

50. OMG THANK YOU!!

    The family’s MacMini’s hard drive died and i was unable to mount the time machine drive. This fixed the problem.

This site uses Akismet to reduce spam. Learn how your comment data is processed.