Journal not stored in fs! don't know what to do

Question

..and me too.
This error happend all of a sudden on an external Firewire disk. A twin disk (purchased and installed at the same time) is good and healthy just a FW hop away.
A search on this forum gave no answers, so I'm trying to ask explicitly.
The story begins when I found out that the disk didn't show up a login.
It was visible, but greyed out, in Disk Utility. So I clicked "Repair disk".
"There are minor errors" and started to rebuild the bit map =:-| ! Call that minor!
Well, after some time (250 GBy) it succeded.
But it wasn't able to mount it.
In System.log these lines showed up :
Mar 11 18:33:36 G5pollicasa kernel[0]: hfs: The journal file moved (was: 0; is: 1871). Fixing up
Mar 11 18:33:36 G5pollicasa kernel[0]: hfs: The journal file changed size! (was 0; is 25165824). Fixing up.
Mar 11 18:33:36 G5pollicasa kernel[0]: hfs: journal not stored in fs! don't know what to do.
(don't mind the dates, I'm still trying to recover, myself)
Still, Disk Utility keeps saying everithing is OK. Lier!
I tried with the unix style commands:
o) sudo fsck_hfs -f /dev/disk5s10 => ** The volume Backup4 appears to be OK.
o) sudo diskutil mount /dev/disk5s10 /mnt => Volume /dev/disk5s10 mounted.
Lier again, the 3 errors show up.
o) sudo diskutil list => The disk is there and it seem as it is like any other disk in the system
o) sudo diskutil disableJournal /dev/disk5 => The selected journaling request does not appear to be valid
Maybe because the disk should be mounted, I think
o) sudo diskutil enableJournal /dev/disk5 => The selected journaling request does not appear to be valid
o) sudo /System/Library/Filesystems/hfs.fs/hfs.util -M disk5s10 /Volumes removable readonly nosuid nodev => mount_hfs: Invalid argument
But the 3 error lines showed up in system.log
I tryed other commands too, with no luck
Anyone has a clue about reparing this disk. If only I could mount it as a good-old-fashioned HFS..
Thank you,
Ermanno Polli
Dual 2 GHz PowerPC G5   Mac OS X (10.4.8)  

Answer 1

Your problem is caused by the fact, that the volume
header tells the system that this volume is
journaled, but if the system reads the
journalInfoBlock pointed to by the volume header,
this journalInfoBlock appears to be empty and has
neither the position of the journal set nor its
size.
Yep.
In my googl-ing around I found the source code of the check Darwin does on the journal structure.
The system then trys to locate the journal and is
successful, but -because the journalInfoBlock is
cleared- an additional bit kJIJournalInFSMask is not
set within the journalInfoBlock.
In this case, the system aborts the
mounting-process.
Yep.
To regain access (without fixing the problem
entirely), you need to turn of journaling.
Because this can only be done with a mountable
volume, it gets tricky...
I noticed that..
We have to modify the disk directly, which is
something really risky...
Do the following:
sudo dd skip=2 count=2 if=/dev/disk5s10
of=/Users/Shared/VH
At that time, I used Disk Utility to create a .dmg. Luckily the program doesn't care about journaling. If it were, it would have repaired it.
Anyway, the disk died short after, so the .dmg was all that I had.
Open this file using HexEdit (->versiontracker,
macupdate).
I found an HexEditor in the Apple's developer section, but the file is 180GBy!
It takes forever to do anything.
If you see a "H+" within the first to bytes, you
completed this step successfully...
Make sure that HexEdit uses its "overwrite-mode".
Now look at byte 6: You should see a "21" which tells
the system that this volume has a journal and was
unmounted sucessfully (20 means journal, 01 means
successful unmount).
Change this 21 to a 01 (or a possible 20 to a 00) and
make sure that you did not change anything else.
On a .dmg, things are different.
And I found nothing that expalins the "disk" structure of a .dmg.
Save the new file as VH_New
Now comes the dangerous part...
sudo dd oseek=2 count=2 if=/Users/Shared/VH_New
of=/dev/disk5s10
OUCH!!
This writes back the modified volume header.
If you did everything fine, your volume is now
mountable again. If not.....
Anyway I already solved the problem. It took a lot of struggle, but I did it.
The very first thing I tried was indeed to clear the journal bit with an hex editor (the one I wrote above). Just to found out that the file structure was not the same as the disk structure. Hours lost.
Then, I tried and old G3 mac with OS9. It didn't know the .dmg file.
A conversion .dmg to .smi didn't work. ("hdiutil convert" with RDxx option)
The second step was to install 10.2 on my previous Mac (G4). The .dmg appeared on the desktop for less than a second and then disappered. I soon found out the the file was too big (the 2GBy limit?).
It seemed a comma 22 catch, but I was lucky. I "open"ed it in the terminal and there it was, on the desktop.
All was intact.
Thanks the same. You're the only one that tried to find a solution.
I clicked the question answered radio button.
Ciao,
Ermanno