apfs-fuse saved my stuff

[mikejsavage]

Hi, this isn't actually an issue so feel free to just close it. It could have been an email too but this specific error isn't on Google yet, so hopefully this helps someone else in the future too. :)

I have an old MacBook with an encrypted boot partition, and some combination of resizing the partition and upgrading macOS fried it to the point where disk utility in recovery mode doesn't recognise it as APFS and fsck returns a scary error:

# fsck_apfs /dev/disk0s2
** Checking the container superblock.
   Checking the checkpoint with transaction ID 191941.
** Checking the EFI jumpstart record.
** Checking the space manager.
** Checking the space manager free queue trees.
** Checking the object map.
** Checking the encryption key structures.
error: container keybag (14666476+1): failed to get keybag: Inappropriate file type or format
   Encryption key structures are invalid.
** The container /dev/disk0s2 could not be verified completely.

and after going nowhere with Apple support I decided to google "Linux APFS" and found this, which took less than two minutes to compile and as far as I can tell works flawlessly.

Looks like I will still have to waste some time reinstalling but your project at least saved my data, so thank you!

[RJVB]

Kudos! Did you actually use encryption on that disk? FWIW, I've lost a ZFS pool once because of a problem with encryption but IIRC it still mounted in RO mode (or I had a backup of the data on it). Since then I avoid filesystem-level encryption. I do use encrypted DMGs on Mac, but I assume those are exactly that, encrypted images of a disk.

[mikejsavage]

On Thu, 16 Feb 2023, at 8:52 PM, René Bertin wrote: Did you actually use encryption on that disk?

I did! So doubly impressive this worked out.

[sgan81]

Interesting ... I'm actually also surprised that this worked. I wonder what was broken in your keybag. But then, apfs-fuse might sometimes be more tolerant than Apple's APFS ...

[mikejsavage]

I messed around a bit after creating this issue, if you uncomment this it blows up with both my password and the recovery key: https://github.com/sgan81/apfs-fuse/blob/master/ApfsLib/KeyMgmt.cpp#L478

but that comes after you enter a decryption key so I dunno. I saved the superblock/keybag blocks if you're curious (not asking you to fix my stuff for free, that partition is gone already anyway)