HFSleuth on an unmounted device?

Used for discussing the various tools in the book as well as encouraging members to share tools

HFSleuth on an unmounted device?

Postby codelogic » Sat Jun 01, 2013 8:03 pm


I was trying to use hfsleuth on an unmounted disk and it errors out with:
Code: Select all
Unable to find mount point or device /dev/disk8: Try 'listfs' first, or select a .dmg file

Specifically, my file system is corrupted, so I attached the raw disk image of my hard disk (i.e. made with dd not .dmg) using
Code: Select all
hdiutil attach -noverify -noautofsck -nomount <my_disk_image_file>

This gets attached correctly, OS X reads the partition table from the disk image and creates devices /dev/disk8s* for each partition, one of which is the corrupted HFS file system I'm interested in investigating. However when I try
Code: Select all
fs /dev/disk8s2
it doesn't work. Am I doing it wrong or is this unsupported?


PS - Any plans to release the source code for hfsleuth :)
Posts: 1
Joined: Sat Jun 01, 2013 7:55 pm

Re: HFSleuth on an unmounted device?

Postby morpheus » Tue Jun 04, 2013 4:37 pm

It WAS unsupported. It is now. The problem was that I had consulted the list of mounted filesystems - and otherwise rejected.
Your name is now immortalized in HFSleuth source, thanks to a quick fix. Works on /dev/disk##s## - i.e. on the slice, not the full disk (yet).

Attached a universal version.

Fix for hfsleuth, universal version.
(64.64 KiB) Downloaded 728 times
Site Admin
Posts: 715
Joined: Thu Apr 11, 2013 6:24 pm

Return to Tools

Who is online

Users browsing this forum: No registered users and 6 guests