Bad backup using 2.5!!!!!!

[mcamou]

Hi,

I used to use SuperDuper! to defragment my hard drive, it's much faster to do an incremental backup, then boot from the backup drive and restore than to do a defragment using most tools out there.

Not any more.

I did that yesterday and left the restore running overnight. Today I find an "Operation not permitted encountered while setting HFS meta data for <filename> of type: 8\n" error. The first time it was a SyncServices file so I reset my Sync settings (it's on an account for which I don't use iSync). The second time it was a file on a different account, so I went to the terminal, sudo'ed and tried to do an rm. I got an "exec format error: rm" message.

Doing an ls -l of /bin I get a few very very weird files (I'm transcribing since I'm on my spare box):

-r-xr-xr-x@ 55690 root wheel 0 Jan 3 17:28 link
-r-xr-xr-x@ 55690 root wheel 0 Jan 3 17:28 ln
-r-xr-xr-x@ 16243 root wheel 0 Jan 3 17:28 pax
-r-xr-xr-x@ 55695 root wheel 0 Jan 3 17:28 rm
-r-xr-xr-x@ 55695 root wheel 0 Jan 3 17:28 unlink

In the directory that contains the second offending file, all the files have length 0, huge numbers for the nlinks and the owner is a number around 1799000 (different for all of them).

In the end, my backup is completely useless. I am left without a usable machine, without a usable backup and with the only option of reinstalling from scratch and restoring from Time Machine (Thank God for TM!!!). I will definitely never use SuperDuper! again and regret having paid for the product.

However, I *WOULD* like to know what happened. Any ideas?

[dnanian]

That's certainly extremely strange. I'm certain you can restore the non-OS portion of the backup by clean installing Leopard to your internal drive and then migrating from the backup copy.

Can you give me a bit of background regarding the destination drive? Was it a Smart Update over a Tiger volume, have you had any failures on it -- have you 'defragmented' Leopard before successfully?

There were some rather significant changes made in the Leopard file system. There could be a problem in Leopard itself... but it's quite hard to diagnose this kind of thing without a case I can reproduce at this end.

We've seen an occasional manifestation of this particular error (the "type 8" message), but in the vast majority of cases (I've only seen one other with a single file on the destination) the bizarre files with unusual attributes, ownership and link counts have been on the source drive, with similar to what you've described...

[mcamou]

I *have* previously done this. This was an incremental backup, Leopard to Leopard (Tiger was not involved), the earlier backup was done about a month ago. My OS X installation was up to date in both cases (i.e., when doing the latest incremental I was running 10.5.3). Perhaps Apple changed something recently?

The way I did it is: close down all of my user programs to ensure nothing modified the disk, do the SD incremental backup, reboot from the backup, do a full backup from the backup disk to the original. In all cases I told SD to do a Repair Permissions first. I am running SD 2.5 v84 on OS X 10.5.3 on a Core Duo 17" MacBook Pro (the first gen of MBP's) using an external 250GB LaCie Porsche firewire drive.

I am currently restoring from my latest Time Machine backup, since I can't trust the SD backup now. Some of the corrupted files were in my home directory, others within third-party applications I'd installed and I really am in no mood to start looking for which files were corrupted and which weren't.

I will keep my SD backup for a few days to see if it's useful in finding out what happened.

[dnanian]

You didn't mention any corrupted files in your Home folder, so that's a bit surprising. It really sounds to me like your directory structure was quite badly damaged on either the source, the destination or both -- but it's really hard to say what.

Honestly, I don't think this was an error in the SuperDuper! copy itself. We're not going to create bizarre hardlinks unless we're literally getting files that are indicating that they're pointing to the same inode as the original -- and in your case, there are *so many* of those that it'd be exceptionally bizarre that things would happen through some sort of logic error. But -- as I said -- there were significant changes made to Leopard itself to support Time Machine and other aspects of the OS -- it's possible that something went wrong there, or some values were returned to *us* that caused hard links to be created -- but even then, given the 0 length of the file, it seems that the hard links are to *nothing*, which isn't really even possible to do... unless the simulated hard link system (which is implemented rather unusually in HFS+) somehow got corrupted on source or destination...

What types of changes/incorrect files did you see in your Home folder?

[mcamou]

The files I mentioned with the weird owner (around 1799000-1800000) were all the files in a directory under my home. They are files I'd previously copied from a Linux system, 4-5 directory levels down from my home. The thing is, whether it was Leopard or SD or whatever, I'm left with a bad backup. Even if those were the only 2 errors (/bin and the other directory), I cannot be sure without an extensive (and time-consuming) trip through the filesystem.

[dnanian]

I understand. I wonder if they were stored with that weird owner originally when copied from Linux -- or whether some attribute copied with them caused subsequent OS copy calls to return incorrect values...

[mcamou]

The files were copied from Linux a couple of years ago and have been OK ever since. I've looked at my Time Machine backup and they are OK there. What I'd like is a way of finding the corrupted files to see how widespread it is.

[dnanian]

Well, you can certainly try to use find to locate files with unusual ownership in your Home folder.

It really does sound like your file directory structure on the backup drive took a hit. Anything unusual happen at a hardware level with this drive? What make/model/connection of drive is it, and what else was connected at the time?

[mcamou]

No hardware problems that I know of, no power outages or something like it. It's a LaCie Porsche on Firewire, there was nothing else on the Firewire bus at the time. On the USB side I had my Time Machine drive and a trackball. As soon as I'm finished doing my restore I'll check if there's anything else weird in the drive. BTW, thanks for your quick response and your help!

[dnanian]

No forced shutdowns? Anything unusual when you (recently, I assume) updated to 10.5.3?

[mcamou]

Nothing at all! That's what makes it so bizarre. I just did a

# find . -type f -size 0 -links +3 -ls | tee ~/Desktop/weird_files.txt

on my backup volume. There are 22935 files in there. Aside from the /bin files I already mentioned, there are lots of files in /opt/local (from MacPorts), lots of stuff inside my home dir in Library/Application Support/SyncServices/Local/DataReferences, the aforementioned files I'd copied over from Linux, some binaries in /usr/bin and some files in /usr/man. No pattern at all that I can detect. Is there a way of attaching a file or should I just cut-and-paste it in a Reply? Or will it do no good?

[dnanian]

Send me the file to the support email address.

[mcamou]

Just did, hope you can get something out of it!