sparsebundlefs

FUSE filesystem for reading macOS sparse-bundle disk images.

Mac OS X 10.5 (Leopard) introduced the concept of sparse-bundle disk images, where the data is stored as a collection of small, fixed-size band-files instead of as a single monolithic file. This allows for more efficient backups of the disk image, as only the changed bands need to be stored.

One common source of sparse-bundles is macOS' backup utility, Time Machine, which stores the backup data within a sparse-bundle image on the chosen backup volume.

This software package implements a FUSE virtual filesystem for read-only access to the sparse-bundle, as if it was a single monolithic image.

Installation

Clone the project from GitHub:

git clone git://github.com/torarnv/sparsebundlefs.git

Or download the latest tar-ball:

curl -L https://github.com/torarnv/sparsebundlefs/tarball/master | tar xvz

Install dependencies:

macFUSE on macOS, e.g. via brew install macfuse
sudo apt-get install libfuse-dev fuse on Debian-based GNU/Linux distros
Or install the latest FUSE manually from source

Compile:

make

Note: If your FUSE installation is in a non-default location you may have to export PKG_CONFIG_PATH before compiling.

Install:

sudo make install

The default install prefix is /usr/local. To choose another prefix pass prefix=/foo/bar when installing. The DESTDIR variable for packaging is also supported.

Usage

To mount a .sparsebundle disk image, execute the following command:

sparsebundlefs [-o options] sparsebundle mountpoint

For example:

sparsebundlefs ~/MyDiskImage.sparsebundle /tmp/my-disk-image

This will give you a directory at the mount point with a single sparsebundle.dmg file.

You may then proceed to mount the .dmg file using regular means, e.g. for HFS:

mount -o loop -t hfsplus /tmp/my-disk-image/sparsebundle.dmg /mnt/my-disk

Or, for Apple File System (APFS) partitions, using apfs-fuse:

apfs-fuse /tmp/my-disk-image/sparsebundle.dmg /mnt/my-disk

This will give you read-only access to the content of the sparse-bundle disk image.

Access, ownership, and permissions

By default, FUSE will restrict access to the mount point to the user that mounted the file system. Nobody, not even root, can access another user's FUSE mount. To override this behavior, enable the allow_other option by passing -o allow_other on the command line. This will give all users on the system access to the resulting .dmg file. The allow_root option has the same effect, but only extends access to the root user.

The ownership of the mount point and the .dmg file will always reflect the user who mounted the sparsebundle, with the group set to nogroup to indicate that the group has no effect on whether a mount is accessible or not:

-r--------  1 torarne  nogroup  1099511627776 Sep  7 20:19 /tmp/my-disk-image/sparsebundle.dmg

The file permissions reflect the state of who can access the mount, with the allow_other and allow_root options adding the o+r permission to indicate that the mount is accessible for users beyond the owning user:

-r-----r--  1 torarne  nogroup  1099511627776 Sep  7 20:19 /tmp/my-disk-image/sparsebundle.dmg

Note: Unless the default_permissions option is also enabled, the owner and mount point permissions are only informative, and the access control happens in FUSE based on the presence of allow_other and allow_root, as described in the first paragraph of this section.

Mounting partitions at an offset

Some sparse-bundles may contain partition maps that mount.hfsplus will fail to process, for example the GUID Partition Table typically created for Time Machine backup volumes. This will manifest as errors such as "wrong fs type, bad option, bad superblock on /dev/loop1" when trying to mount the image.

The reason for this error is that the HFS+ partition lives at an offset inside the sparse-bundle, so to successfully mount the partition we need to pass this offset to the mount command. This is normally done through the -o offset option to mount, but in the case of HFS+ we need to also pass the partition size, otherwise the full size of the dmg image is used, giving errors such as "hfs: invalid secondary volume header" on mount.

To successfully mount the partition, first figure out the offset and size using a tool such as parted:

parted /mnt/bundle/sparsebundle.dmg unit B print

This will print the partition map with all units in bytes:

Model:  (file)
Disk /mnt/bundle/sparsebundle.dmg: 1073741824000B
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number  Start       End             Size            File system  Name                  Flags
 1      20480B      209735679B      209715200B      fat32        EFI System Partition  boot
 2      209735680B  1073607585791B  1073397850112B  hfsx         disk image

Next, use the start and size columns from the above output to create a new loopback device:

losetup -f /mnt/bundle/sparsebundle.dmg --offset 209735680 --sizelimit 1073397850112 --show

This will print the name of the loopback device you just created.

Note: Passing -o sizelimit directly to the mount command instead of creating the loopback device manually does not seem to work, possibly because the sizelimit option is not propagated to losetup.

Finally, mount the loopback device (which now starts at the right offset and has the right size), using regular mount:

mount -t hfsplus /dev/loop1 /mnt/my-disk

Reading Time Machine backups

Time Machine builds on a feature of the HFS+ filesystem called directory hard-links. This allows multiple snapshots of the backup set to reference the same data, without having to maintain hard-links for every file in the backup set.

Unfortunately this feature is not yet part of mount.hfsplus, so when navigating the mounted Time Machine image these directory hard-links will show up as empty files instead of directories. The real data still lives inside a directory named .HFS+ Private Directory Data\r at the root of the volume, but making the connection from a a zero-sized file to its corresponding directory inside the secret data location is a bit cumbersome.

Luckily there's another FUSE filesystem available, tmfs, which will allow you to re-mount an existing HFS+ volume and then navigate it as if the directory hard-links were regular directories. The syntax is similar to sparsebundlefs:

tmfs /mnt/tm-hfs-image /mnt/tm-root

Troubleshooting

If any of the above operations fail, you may try running sparsebundlefs in debug mode, where it will dump lots of debug output to the console:

sparsebundlefs ~/MyDiskImage.sparsebundle /tmp/my-disk-image -s -f -D

The -s and -f options ensure that sparsebundlefs runs single-threaded and in the foreground, and the -D option turns on the debug logging. You should not see any errors in the log output, and if you suspect that the disk image is corrupted you may compare the read operations against a known good disk image.

License

This software is licensed under the BSD two-clause "simplified" license.

antimatter15 / sparsebundlefs