A lucky hdd recovery adventure

In all my years of home computing, I never had a catastrophic hard drive failure. Saturday's excitement felt like one, with I/O errors on the journal.

The usual graphical display on my computer was replaced by large white typewriter-style characters on a dark background, dire warnings about I/O errors, nonexistent device on remount, and other words I don't recall. I found a USB drive that still had knoppix 8.6, and booted. Diagnostics (CPU, memory) found no problems so I tried "e2fsck -y" on the failed partitions (both / and /home, which made me think "electronics" rather than "bad spot on the disk"). That ended with "Filesystem still contains errors!"

I tried to remove the journal with tune2fs, which insisted on first trying to replay the journal, that's right, the very journal I wanted to ignore/remove. After a few hours of futility, I had an idea. Since there were I/O errors on the disk drive, but all were happening at rather high block numbers (with at least 9 digits if I recall correctly), I thought, what if I just did a block-for-block copy onto a new drive?

Off to the store for a 1TB internal SSD with SATA connectors: about $100—a dime per gigabyte! This is an amazing time we live in. "fdisk -l" gave me the bad drive's layout; I partitioned the new drive with the same-size partitions... I think the new drive is slightly larger, but who cares? I copied the filesystem partitions over, and was pleasantly surprised to note that the filesystem uuids matched. (D'oh!) The root partition (just 60GB) was done in less than 10 minutes:

Linuxknoppix@Microknoppix:~$ dd if=/dev/sda1 of=/dev/sdb1 bs=1M
61440+0 records in
61440+0 records out
64424509440 bytes (64 GB, 60 GiB) copied, 408.774 s, 158 MB/s
knoppix@Microknoppix:~$ 

Muttering "Let fortune favor the foolish," I typed:

root@Microknoppix:/home/knoppix# e2fsck -y /dev/sdb1
e2fsck 1.44.5 (15-Dec-2018)
/dev/sdb1: clean, 309900/3909120 files, 5462752/15728640 blocks
root@Microknoppix:/home/knoppix# mount /dev/sdb1 /mnt
root@Microknoppix:/home/knoppix# ls /mnt
bin   etc    home            lib         media  proc  sbin  tmp  vmlinuz
boot  extra  initrd.img      lib64       mnt    root  srv   usr  vmlinuz.old
dev   foo    initrd.img.old  lost+found  opt    run   sys   var
root@Microknoppix:/home/knoppix# 

That may have been a little foolhardy, but I went to bed hoping for similar grace to befall on /home (over 800GB). The next morning, the copy was done. The news was happy:

root@Microknoppix:/home/knoppix# fdisk -l /dev/sdb
Disk /dev/sdb: 931.5 GiB, 1000207286272 bytes, 1953529856 sectors
Disk model: SanDisk SSD PLUS
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x5fa89795

Device     Boot     Start        End    Sectors   Size Id Type
/dev/sdb1  *         2048  125831167  125829120    60G 83 Linux                 ← root partition
/dev/sdb2       125831168 1953529855 1827698688 871.5G  5 Extended
/dev/sdb5       125833216  159387647   33554432    16G 82 Linux swap / Solaris
/dev/sdb6       159389696 1953529855 1794140160 855.5G 83 Linux                 ← /home
root@Microknoppix:/home/knoppix# e2fsck -fy /dev/sdb6
e2fsck 1.44.5 (15-Dec-2018)
Pass 1: Checking inodes, blocks, and sizes
Inode 33692836 extent tree (at level 1) could be shorter.  Optimize? yes

Pass 1E: Optimizing extent trees
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information

/dev/sdb6: ***** FILE SYSTEM WAS MODIFIED *****
/dev/sdb6: 299071/56074240 files (1.4% non-contiguous), 54502379/224266934 blocks
root@Microknoppix:/home/knoppix# e2fsck -fy /dev/sdb1
e2fsck 1.44.5 (15-Dec-2018)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/dev/sdb1: 309900/3909120 files (0.4% non-contiguous), 5462752/15728640 blocks
root@Microknoppix:/home/knoppix# 

Initial checks suggest that nothing important was lost. If something important had been lost, it would have been mightily inconvenient, but not really catastrophic. That said, I decided to add this device to my crashplan subscription.

Collin reads the 2020 California ballot propositions

The following are of course just my opinions, informed by various biased information sources (all sources are biased, including yours)

Prop 14: authorize $5.5 billion in bonds for medical research

I think NO. Why bonds? If we want to spend money on research, just spend it; don't borrow it. This is like taking out a loan to fill the tank for the next year. I'm unconvinced by the proponents' arguments.

Prop 15: property tax on commercial and industrial real estate to be based on market value

YES. In the 1970s, proposition 13 was a bad idea (i voted NO), but only now do we understand the effect of REDUCING the property tax burden on businesses. When you or I buy a home, we buy it. When a company buys real estate, the company doesn't actually buy it; instead, there is some hocus-pocus by which the real estate doesn't legally change hands. Thus, those commercial and industrial properties that have different businesses on them than they did in the early 1980s—those properties are still owned by the same legal entities that are/were the landlords in the 1980s. Thus, the property tax burden on those parcels of real estate are based on the last "real" purchase, which was in the 1980s or earlier!

That's why homeowners now pay a higher share of the state's property tax burden then they did in the late 1970s.

It's time for businesses to pay their fair share of the property tax burden in California. Opponents say it'll increase the cost of doing business. Well, yeah. Failing to pass that will make it harder for your children and grandchildren to buy a home in California. What's more important? I've made my decision.

Prop 16: Make Affirmative Action Great Again

YES. Having read White Fragility and White Awake and the alarming statistics on racism's toxic effect on our country, I repent of my past opposition to race-based affirmative action.

The current ban on considering race, sex, color, ethnicity, etc. in public education, employment, contracting—the current ban is the way that the establishment is effectively saying "Keep Racism, Sexism etc. Alive!" It's time to reject that thinking.

Prop 17: Let parolees vote

YES. Parolees already have the deck stacked against them. Restoring their right to vote once they're "out" reduces recidivism. Let's give them a fair chance.

Prop 18: Let 17-year-olds vote in primary/special elections if they'll be 18 for the general

NO. Suppose this were the law in 2019. If you were born November 2, 1992, you could have voted in this year's primary election, but not if it were November 4th. So on March 3, you would have been 17 years and four months old.

Yeah, NO.

Prop 19: Close property tax loopholes

YES (as if you couldn't tell from the title I gave it). Why should inherited real estate be immune to reassessment— other than what's used for a home, I mean? Suppose a guy has bought two houses: one where he lives, purchased in the 1980s for about $125K, and another as a rental, purchased in 2000 for about $400K. When he and his wife die, the houses will likely be worth substantially more than what he paid for them. Suppose his heirs move into the family home, and keep the rental as a rental.

Both houses have changed hands; why should either of them be immune from reassessment (for purposes of calculating property taxes)? Even if the family home isn't re-appraised or reassessed, why should the rental be immune? Prop 19 doesn't require the famiily home to be reassessed in this case, but it would allow the rental to be reassessed—as it should be!

Prop 20: Disallows parole for certain offenses; requires more DNA samples to be collected

NO. This is rather a tough one. Prisons are already overcrowded. For-profit prisons love this proposition. This increases costs of various kinds; where is the evidence that it will reduce crime or improve the chances of catching perpetrators of future crimes?

What makes this a tough one is the scary stories of crimes that are currently considered nonviolent. But on balance I still think NO.

Prop 21: Allows localities to have stricter rent control than state law

NO. This depresses new construction and new improvements. I understand that rents are too high, but the state already has rent control, and further depressing new construction is absolutely not the answer.

Prop 22: Let uber, lyft, doordash &c to continue exploiting drivers

NO. Just no. Drivers really are employees.

Here's an example. Suppose you're an uber driver in Monterey, and you get a fare around 10am. You don't know where the fare's destination is; all you know is that they want a ride somewhere. If they want to go to the beach or to Pacific Grove or Carmel, that's fine, but you don't want to drive them to SFO because you would miss your 1pm medical appointment. Suppose you say "yes" and you find out they really do want to go to SFO? If you reject them, uber *will* penalize you. You really are not a contractor.

Uber and Lyft and Doordash and their ilk are mis-characterizing their employees as contractors. This injustice was remedied by state law, but now they want to overturn the law so they can continue exploiting drivers.

Prop 23: Stricter requirements on kidney dialysis clinics

YES. Operators of these (mostly lucrative) clinics do not want higher safety standards because they want to keep milking this cash cow. But people die because of preventable screwups at these clinics. I remember reading about a case where some plastic tubing came loose during dialysis and sprayed blood all over the place. A tech grabbed it and reconnected it. The patient died a few days later from an infection.

If a certified MD had been present, could that have been prevented? Would stricter safety procedures have been in place? Maybe, maybe not, but given that no MD was required, and given the industry's opposition to prop 23, I have eto guess that lots of these clinics don't have MDs present during treatment.

Let's put patients ahead of profits—that's what I think

Prop 24: Amends consumer privacy laws

NO. The legislative analyst points out (p. 67 of your voter information guide) that privacy requirements will be loosened on some businesses that are currently subject to state standards. Today if a business buys/sells personal data of 50,000 consumers, households, or devices annually are subject to those standards. The propsition doesn't include devices in the count, and raises the annual threshold to 100,000. To me that's a red flag.

Prop 25: Support state law replacing money bail system

YES. Money bail is unjust discrimination, as state law recognizes. But the bail system keeps the bail bonds industry alive. That industry exploits the poor and has political power (because of the profits generated) to keep this exploitation going. End this unjust pilfering of the disadvantaged, I say!

pdftk to the rescue (or: how to sign a PDF using a pen)

From the manpage: “If PDF is electronic paper, then pdftk is an electronic staple-remover, hole-punch, binder, secret-decoder-ring, and X-Ray-glasses. Pdftk is a simple tool for doing everyday things with PDF documents.”

True, but the usage isn't always intuitive. Well, maybe it would be if I did these things every day. Which I don't. This one thing, that I have to do every few months (trying to make it less frequent), goes something like this:

• Receive a PDF; call it orig.pdf
• print page 3, sign, and scan; call that sigs.png
• Create a new PDF which is the old one for pages 1–2, the scanned image from the previous step, and the old one for page 4; save as signed.pdf

Here is my cheat sheet for next time:

$ convert sigs.png sigs.pdf
$ pdftk A=orig.pdf B=sigs.pdf cat A1-2 B1 A4 output signed.pdf

There. Now the next time I have to do it, I won't have to stare at the manpage and try to reconstruct this incantation.

Some Words on Anxiety

I have been thinking lately about anxiety. You know what the Apostle Paul said about anxiety, right?

And, apart from other things, there is the daily pressure upon me of my anxiety for all the churches. Who is weak, and I am not weak? Who is made to fall, and I am not indignant?

2 Corinthians 11:28–29 (RSV)

That’s right; he felt the pressure, just like you do. You want people to choose love and faith and generosity, rather than indifference and fear and envy. You long to see Christ formed in them. And in these pandemic times, you can’t see them in person to encourage them, or hold their hands while you pray for them. Paul knew about that, too.

Night and day we pray most earnestly that we may see you again and supply what is lacking in your faith. Now may our God and Father himself and our Lord Jesus clear the way for us to come to you. May the Lord make your love increase and overflow for each other and for everyone else, just as ours does for you.

1 Thessalonians 3:10–12 (NIV 1984)

Is anxiety good then?

Well, it’s not really recommended. Another famous writing of Paul tells us not to worry about anything, but to pray about everything (Philippians 4:6–7). And the Lord Jesus himself told us,

So do not worry, saying, “What shall we eat?” or “What shall we drink?” or “What shall we wear?” For the pagans run after all these things, and your heavenly Father knows that you need them. But seek first his kingdom and his righteousness, and all these things will be given to you as well. Therefore do not worry about tomorrow, for tomorrow will worry about itself. Each day has enough trouble of its own.

Matthew 6:31–33 (NIV 1984)

I’ll add a pastoral word here: Paul the Apostle himself was at times beset by anxiety, so he is not scolding us, wagging a finger as he lectures us about worry. Neither is the Lord Jesus assuming a punitive posture in this extract from the Sermon on the Mount. Rather, his attitude is more like this father, coaxing his child to take a first step:

This is the same Jesus who said, “Come to me, all you who are weary and burdened, and I will give you rest. Take my yoke upon you and learn from me, for I am gentle and humble in heart, and you will find rest for your souls. For my yoke is easy, and my burden is light.” (Matthew 11:28–30)

That invitation from our Lord is intended for everyone who is weary and burdened, for those “in ministry” and for those who don’t think of themselves that way. In other words, it’s for you and me.

So let us come to him, let us take another step to him. That, more than any of our accomplishments or possessions, is what pleases him, and what brings us life and peace.

Ash Wednesday thoughts

[found on the Notes app on my phone, from February]

It was a good day to die, as Garrison Keillor said of that spring day in Minnesota, with the tomatoes just planted. His aunt was looking over her garden when her heart just decided to stop.

His monologue came to mind today, Ash Wednesday. “Remember that you are dust, and that to dust you shall return,” say the priests. It’s a good thing for me to remember, because like most Americans, I tend to ignore my mortality. But it struck me the other day that I probably have fewer than 10,000 of them left.

Indeed, as I’ve heard a few times recently, “Life is short. We don't have much time to gladden the hearts of those who walk this way with us. So, be swift to love and make haste to be kind.” (attributed to Henri-Frédéric Amiel)

I hope in this Lenten season that I’ll be diligent to do that.

---

At the end of his monologue, Keillor remarked that it was indeed a good day to die. And if a good day to die, how much more was it a good day to live?

I’m blind! Well, I was, anyway

In case you missed it, Matthew Dutton-Gillet, formerly rector at Trinity Menlo Park (California) was caught misappropriating church funds for personal use, at least $125,000 taken over the past five years. I was very disappointed to learn of this news, but beyond that, I was surprised to note that the idea of jail time for Matthew had not occurred to me until some weeks afterward.

That was a blind spot for me. Matthew committed a crime, maybe more than one, and he admitted this. How did it escape me that this is a criminal case? I’m far from the only one; there are Trinity members who to this day say that the police should not have been informed. I suppose that because we like and respect Matthew, we don’t want to think he’s also a criminal.

Speaking of “cognitive dissonance”…

Last November, we learned that MPPC’s senior pastor, John Ortberg Jr., was put on personal leave because of an error in judgment regarding a certain volunteer. (In case you missed it, here’s a timeline.) Some things about the whole story were puzzling (why did that volunteer confide in Daniel Lavery, formerly Mallory Ortberg?), but because I like and respect John, I don’t like to think of him as recklessly endangering children. I didn’t want to think about it; I wanted all to be well. MPPC’s communications folks were ready to help me with that.

As you can see, I have blind spots galore. When it was revealed earlier this month that the volunteer was John’s younger son, John III, some scales fell off even my eyes. One puzzling question was shockingly answered, and yes, it now seems to me astoundingly reckless to allow John III to be alone with children to whom he felt sexually attracted.

In the week or so since I started writing this, I have seen a wide variety of responses from people I know personally at MPPC. Apparently I am not alone in my disorientation. As Jeremiah famously wrote, “the heart is deceitful above all things and beyond cure; who can know it?” It is difficult—for me anyway—to discern the severity and gravity of mistakes made by people we respect or admire. I now have a new understanding of how deeply and severely I at least can deceive myself.

Thus I am so very glad that the Lord Jesus Christ promised that the Spirit of Truth would guide us into all truth. How much I need to pay attention to that Spirit in these days!

Debian9 upgrade

I mentioned in an earlier post that upgrading from debian8 (jessie) to 9 (stretch) solved a display mystery. (I wonder if a 3440x1440 monitor will work on this distro.) This post will record mysteries created, rather than solved.

• xsane: no devices found
  So I had to download brscan4, I forget where from... brscan4-0.4.9-1.amd64.deb
  Then I had to use brsaneconfig. Like this:
  

  sudo brsaneconfig4 -a name=mfc9340 model=MFC-9340CDW ip=192.168.1.40

• …that's it for now!

I understand that upgrading to buster (debian10) will remove python2. Since I'm a Python Dinosaur (not really analogous to my granddaughter's "Dragon Pig" concept), python3 is the new-fangled (or -fanged) thing that I don't quite feel comfortable with.

And then there was an broadband internet service change 2020-08-14
"ping" tried to use ipv6 addresses. So I did this:

collin@p64:~$ cat /etc/sysctl.d/local.conf 
net.ipv6.conf.all.disable_ipv6 = 1
collin@p64:~$ 

And after filling in DNS servers in /etc/resolv.conf, I made it not a symlink and told network manager not to update it
BUT! That was a bad idea.

[main]
plugins=ifupdown,keyfile
dns=none                       ←add
...
/etc/NetworkManager/NetworkManager.conf

Why was it a bad idea? Because I thought I could use my ISP's nameservers. But since my IP address was assigned by AT&T, my ISP's nameservers rejected all my queries. I hate rejection. So I'll stop asking.

Solved!! LG 34UM58-P Revisited: a Puzzle

In 2017, I bought an LG 34um58p monitor and, after some xrandr(1) hackery, got the display to work, more or less. But the display was always a little ugly, as described in a 2019 whine.

Today, for unrelated reasons, I upgraded my Linux distro from Debian GNU/Linux 8 (jessie) to Debian GNU/Linux 9 (stretch). I rebooted and Surprise! First, I didn't need to run my xrandr script. Second, the pixels actually look good; no smearing/dithering as shown in the aforementioned whine from 2019.

I was so excited to see the new sharper image (no ™) that I whipped out my iPhone™ camera and snapped the pic at right. Although I didn't set up the camera as carefully as I did for last year's shot, I hope you can see how much nicer it looks now.

I miss Matthew, too

Today was the first Sunday at Trinity with neither Aaron Klinefelter nor Matthew Dutton-Gillet on staff. In case you missed it, Matthew is on administrative leave for misappropriating church funds for personal use. Aaron, his assistant, had been officiating since then, but he left us to become rector (not assistant) at St. Jude's Episcopal in Cupertino.

It has been some weeks (I guess it's been two months at this point) since we've seen or heard from Matthew. That wasn't his choice; contact with the congregation is forbidden by the diocese during the "Title IV process." This morning's service was officiated by Tom Traylor. We respect, like, and appreciate Tom, but he's not Aaron, and he's not Matthew.

I've been missing Matthew for some time now. Part of it of course is that I'm also missing the whole experience of meeting together in person on campus. But I miss Matthew's smile, his wise, compassionate words, his warm greeting and pastoral care.

Why did he have to siphon off $2000 a month of church funds for the past five years? Why did he have to go and disqualify himself for the ministry he obviously felt called to and took such joy in? I wish he hadn't done that to us, to himself and his family, to Aaron and his family... There's a temptation to think, "What kind of hypocrite could preach those sermons while taking $500/week from the church treasury for the past five years?" or "We thought he was this wise and compassionate and godly man, but it turns out he's a criminal."

But of course that's an overly simplistic view of humanity. David, the "man after God's own heart," committed adultery and murder. How many of the rest of us, given access to a vast supply of funds and a lack of financial controls, might have taken similar actions? We humans are so complicated. And we'll probably never know what really happened.

I believe Matthew is a wise, compassionate man, but he's also a criminal. How different am I? I'm probably not as wise or compassionate, and I'm no less a sinner; my faults are no less than his, as far as I know. Do I have envy, anger, selfishness, self-pity, pride, impatience? (Does a bear shit in the woods? I guess you can add crudity to the list.) So far my flaws have not gotten me in legal trouble.

So yeah, I'm grieving. I'm glad that the Bible is full of flawed-but-still-inspiring people, saints who weren't perfect but sought to follow God—so that when we see each other's faults, we might grieve with understanding and compassion, rather than condemning with outrage.

Why am I impatient?

So this guy at work faced a software problem: the code was hanging at a certain place, he said. I won't say that he's hard to work with, but I wanted him to provide me with all the data so I could look at it "offline"; that is, I wanted to examine the evidence after the fact, rather than doing everything interactively.

So I gave him some instructions. Type script, then at the next prompt, type /usr/software/gdb/bin/gdb.sksim xxx. Then when it gets to the hang you mentioned, generate a coredump by typing generate-core-file. Then type exit until you see /this message/. Give me the path to that file.

For reasons known only to him, he kept not doing it. He typed script (good), but then he didn't type the exact thing I told him to type. I even told him the reason to type /usr/software/gdb/bin/gdb.sksim, not simply gdb, but still he typed gdb. He said "I don't know why the coredump keeps getting corrupted." This was after I told him that the stock debugger produces unreadable coredumps.

I did tell him at one point, "After I see that you have executed the correct steps, then I will look at your problem." I'm happy that I didn't go all, Look, you want help with this problem? Why do you keep doing what I told you not to??

But why was I so miffed? Why was I screaming inside? Why couldn't I just think, "He's not doing what he needs to do to be effective; when he starts acting reasonably, I hope I can help him"? and just go on and do other work (of which there is no lack)?

I think I know the answer, but I don't much like it. It has to do with what some people call the "false self." Well, "false" may be a bit of an exaggeration—or maybe not! Wendy Wright explains it well in this snippet from Exploring Spiritual Guidance (Upper Room Books, 2006; ISBN 0-8358-9834-2), about a woman who volunteered for a month in a rural setting:

This woman went with the idea of helping others, fulfilling her Christian duty by using her gifts on behalf of less fortunate persons. Her experience was exactly the reverse. A city girl, she found herself quite helpless on a farm. She had to be constantly tutored in the most gentle and compassionate way by those she had imagined she would serve. As this woman gradually came to accept her dependence on others, she became aware of all the subtle ways she had learned over the years to mask her neediness. Always having to look good was one way. Always having the right answer was another. always being competent was a third. (56)

I like being competent and having the right answer. I like being that guy who can help people solve their technical problems. But is that really who I am?

The psychologically correct answer, the mentally and spiritually healthy answer is (you guessed it), "No." The true self, as I profess to believe (and as the Church has taught for millennia), is that I am a beloved child of God, beloved not because of my accomplishments or virtue, but for no good reason whatsoever. And because God loves me, I want to be loving and kind to others; part of how I do that is by helping people learn how to approach their technical problems.

When I can keep this principle front and center in my consciousness, I experience joy and peace, and I can share that with those around me. But when I lose track of it, I become agitated, and what I share instead is my agitation and impatience.

Therefore, as the Apostle Paul said, "Brothers and sisters, pray for us." Especially if you have to work with me.

Misappropriation

These are unauthorized and unofficial ramblings. I didn't take notes when I heard this, so you’re getting my recollections at a later date; all errors are mine.

About misappropriation of funds in general

… not necessarily this case in particular:

We often won’t know how long misappropriation went on.

Sometimes an initial report will mention “at least five years,” because it's fairly easy to get bank records going back five years. Farther back, they’re harder to get.

We often won’t know how much money was taken without an arduous investigation.

Perpetrators do not usually keep separate ledger columns, so they don’t know. They don’t want to know, really. It takes time to analyze financial records, and if the misappropriation went on for over five years, records may also be incomplete.

Whether stolen assets can be returned depends on how much the perpetrator has in the way of recoverable assets.

Many organizations have insurance policies to protect them from losses of this kind. Insurers often require a police report to be filed in order to process a claim.

Police report? Aren’t these civil matters?

IANAL but I understand that there can be both criminal and civil actions. Any criminal charge would be filed by the District Attorney. It is the DA’s decision whether to file charges and prosecute. When guilt is admitted, I understand that the DA would usually proceed to file charges. This decision is influenced by many factors, including political factors.

What about a civil case?

Any civil case would typically be initiated by the insurer. This decision may be based on a judgment of whether recoverable assets would likely exceed the costs of litigation. If a defendant owns a house in the San Francisco Bay Area, then equity in the house would typically be the largest single asset and might be recoverable in a civil action.

If recoverable assets do not exceed the estimated litigation expense, a civil action would likely not be initiated.

Why the perpetrator did it is something that is usually not knowable.

Perpetrators, like all of us, tell themselves stories to justify themselves. These stories evolve over time. They tell the stories to themselves for so long that they actually believe them, even though their version of events may contain elements that simply did not happen that way. So after some time, even they don’t know why they started; consequently, they cannot tell us.

In the Trinity case, whose funds were taken?

Some denominations have legal ownership of all a church’s assets; this is true at Trinity. All assets “owned” by Trinity Menlo Park are, as a legal matter, held in trust for the Diocese of California. The Diocese is the legal owner of bank accounts, real estate, and everything else that Trinity “owns.”

When funds were taken from Trinity, then, they were as a legal matter actually taken from the Diocese. The injured party in this case is thus the Diocese; it is not “us.” That is why the Diocese must be involved.

What has Matthew said?

The Diocese’s “Title IV” process prohibits Matthew from communicating to us; we are requested not to reach out to him by any means (including social media). I recently thought to consult local news media. An April 19th article in the Mercury News includes these excerpts:

“This is a very painful time for me, and particularly for my family,” Dutton-Gillett said in a statement to this news organization. “I have a deep love for the Trinity community, and they for me, and I know that this is painful for them, as well. I regret that deeply.”

“The essence of the Christian faith is repentance and reconciliation with reparation,” Dutton-Gillett said in the statement. “It is my profound hope that we will find a way to continue our journey together in a way that embodies Christ’s forgiveness and healing, finding our way back to a place of mutual trust.”

Jail Ministry

I’ll confess here to one of my many blind spots. Until a recent meeting of Trinity’s jail ministry team, the question of jail time had not occurred to me. Or if it did, I guess I suppressed the thought because I like Matthew and worry about his future and his family.

In that jail team meeting, a team member commented that as we try to serve jail inmates, some of whom may be there unjustly, it made no sense that a white male with connections is still at large even though he has admitted guilt; there is no doubt that he stole some $125,000. This was of course a criminal act (or a sequence of criminal acts).

This team member is withdrawing from the jail team for a time, and possibly also from Trinity.

The above comments shocked me, not because I disagreed, but because, as I mentioned above, the question of criminal prosecution had somehow not occurred to me at all. It put me in mind of the Roman Catholic Church’s scandal exposed by the Boston Globe’s Spotlight team—at least as depicted in the eponymous film. What stood out for me from it was the comment from so many parishioners that they didn’t want to get the Father in trouble.

I remember feeling shocked to hear parents say that, and this instance is hardly as egregious, but I can now completely sympathize with the feelings of fondness and respect for a teacher/counselor figure.

Data Recovery... part deux

Trying again, this time using a Tripp-Lite SATA↔usb adapter cable. I had no joy the first few times I plugged this into my Linux box, but then I ran

collin@p64:~$ udevadm monitor --udev
monitor will print the received events for:
UDEV - the event which udev sends out after rule processing

UDEV  [531312.705378] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4 (usb)
UDEV  [531312.708846] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0 (usb)
UDEV  [531312.709620] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host7 (scsi)
UDEV  [531312.710318] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host7/scsi_host/host7 (scsi_host)
UDEV  [531313.701247] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host7/target7:0:0 (scsi)
UDEV  [531313.701815] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host7/target7:0:0/7:0:0:0 (scsi)
UDEV  [531313.702273] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host7/target7:0:0/7:0:0:0/scsi_disk/7:0:0:0 (scsi_disk)
UDEV  [531313.703261] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host7/target7:0:0/7:0:0:0/scsi_device/7:0:0:0 (scsi_device)
UDEV  [531313.703584] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host7/target7:0:0/7:0:0:0/bsg/7:0:0:0 (bsg)
UDEV  [531313.703599] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host7/target7:0:0/7:0:0:0/scsi_generic/sg6 (scsi_generic)
UDEV  [531313.705480] add      /devices/virtual/bdi/8:96 (bdi)
UDEV  [531314.784064] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host7/target7:0:0/7:0:0:0/block/sdg (block)
UDEV  [531314.855365] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host7/target7:0:0/7:0:0:0/block/sdg/sdg1 (block)

Nice to see that. Next was:

collin@p64:~$ sudo fdisk -l /dev/sdg

Disk /dev/sdg: 2.7 TiB, 3000592982016 bytes, 5860533168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xcea3ed1a

Device     Boot Start       End   Sectors   Size Id Type
/dev/sdg1  *     2048 732565503 732563456 349.3G af HFS / HFS+

Right, so the partition table matches what I saw last time.

After realizing that MacOS thinks the disk only holds about 349GB, I realized that the partition table really is horked; it's not a mere incompatibility with the bsd label business, which I'm not even sure is still a thing. It's been like 20 years since I partitioned (or labeled) a *bsd disk so I'm likely behind the times.

I wrote a couple of articles for Linux Journal, apparently in 2005. This one received a comment around that time of, "why didn't you just use gpart?" or maybe gparted. Uh, because of total ignorance? As Sheri says, "Dad knows the hard way to do everything."

Let's see if I can do this the easy way. I said sudo gpart /dev/sdg and went to lunch. An hour later, all that was on my screen was Begin scan... so I guess not. So we can't do this the easy way; we're gonna do it the hard way. Sheri might be right, that is if I'm successful.

Referring to the part of Apple's Technical Note TN1150 showing the volume header format and examining the bytes... from my earlier attempt... OK, one step at a time. I figured out at that time that the partition started 2048 blocks in, where each block is 4096 bytes. The volume header is 1024 bytes in from there. So if the block size is 1024 bytes, we can look 8193 1KB blocks in, we should find the header there:

collin@p64:~$ sudo dd if=/dev/sdg bs=1024 skip=8193 count=1 status=none | hexdump -C
00000000  48 2b 00 04 80 00 21 00  48 46 53 4a 00 00 15 d7  |H+....!.HFSJ....|
00000010  d9 35 08 4d da 54 1b 92  00 00 00 00 d9 35 6a bd  |.5.M.T.......5j.|
00000020  00 30 c1 f8 00 0b 41 4c  00 00 20 00 15 d5 04 00  |.0....AL.. .....|
00000030  0a f1 a3 84 0a ef 00 00  00 01 00 00 00 01 00 00  |................|
00000040  00 3c 44 75 00 1e 9a f1  00 00 00 00 00 00 00 01  |.<Du............|
00000050  00 00 00 02 00 10 2d b8  00 00 00 00 00 00 00 00  |......-.........|
00000060  00 00 00 00 00 00 00 00  7d c5 0b 14 d5 a8 92 17  |........}.......|
00000070  00 00 00 00 02 ba c0 00  02 ba c0 00 00 00 15 d6  |................|
00000080  00 00 00 01 00 00 15 d6  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0  00 00 00 00 01 00 00 00  01 00 00 00 00 00 08 00  |................|
000000d0  00 00 85 d8 00 00 08 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000110  00 00 00 00 69 a0 00 00  15 20 00 00 00 03 4d 00  |....i.... ....M.|
00000120  00 07 d0 d8 00 03 4d 00  00 00 00 00 00 00 00 00  |......M.........|
00000130  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000160  00 00 00 00 a9 00 00 00  15 20 00 00 00 05 48 00  |......... ....H.|
00000170  00 00 8d d8 00 05 48 00  00 00 00 00 00 00 00 00  |......H.........|
00000180  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000400

Let's interpret this.

• signature is "H+"
• version is 4
• attributes: 0x80002100; no idea what that means
• lastMountedVersion: "HFSJ"
• journalInfoBlock: 0x15d7; no idea about that either
  (offset 0x10)
• createDate: This and the following dates are in the format described here; I translate them into localtime using this one-liner:

  h2d() { python -c "import time; hs='0x$1$2$3$4'; print time.ctime(int(hs, base=0) - 2082844800)"; }

  whence

  collin@p64:~$ h2d d9 35 08 4d
          Sun Jun 23 03:43:25 2019

• modifyDate

  collin@p64:~$ h2d  da 54 1b 92
          Sun Jan 26 20:46:10 2020

• backupDate: all zeroes.
• checkedDate

  collin@p64:~$ h2d d9 35 6a bd
          Sun Jun 23 10:43:25 2019

  
  (offset 0x20)
• fileCount: 0x30c1f8 or 3195384. Three million files.
• folderCount: 0xb414c or 737612. Average of what, 4 files per directory?
• blockSize 0x2000, that is 8K
• totalBlocks 0x15d50400, or 366281728.

Okay, I think that's all I care about. That last was very interesting; it says the partition ought to be 366281728 blocks (block = 8K; by 'K' I mean 1024). If we started at 1024 (8KB-sized) blocks from the start of the disk, and the end of the partition is 366281728 blocks later, that's, umm, 366282752 8K blocks. I mean that ...2752 number is the first 8K-block after the end of the partition.

So let me see, how many 1K blocks would that be? 2930262016 1K-blocks. If we want to look at the last-but-one, then this command ought to give me the trailing volume header:

collin@p64:~$ sudo dd if=/dev/sdg bs=1024 skip=2930262015 count=1 status=none | hexdump -C
00000000  48 2b 00 04 80 00 20 00  48 46 53 4a 00 00 15 d7  |H+.... .HFSJ....|
00000010  d9 35 08 4d da 54 0b 51  00 00 00 00 d9 35 6a bd  |.5.M.T.Q.....5j.|
00000020  00 2c 98 1f 00 0a 81 3b  00 00 20 00 15 d5 04 00  |.,.....;.. .....|
00000030  0b 00 70 9f 0a dd b9 b7  00 01 00 00 00 01 00 00  |..p.............|
00000040  00 37 5a 59 00 1d 85 1d  00 00 00 00 00 00 00 01  |.7ZY............|
… you get the idea …

Glad that worked. This also agrees with the 5860524030 number (of 512-byte blocks) used in the second dd command on my earlier post (i.e., it's half that). Whew!

OK, so let me save off the first 4K of the drive, just in case I totally hork this. Also let me make sure I understand what I think it says.

collin@p64:~$ sudo dd if=/dev/sdg of=sheri-backup-hdd-4K.data bs=4k count=1
1+0 records in
1+0 records out
4096 bytes (4.1 kB) copied, 0.236593 s, 17.3 kB/s
collin@p64:~$ hexdump -C sheri-backup-hdd-4K.data
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001b0  00 00 00 00 00 00 00 00  1a ed a3 ce 00 00 80 fe  |................|
000001c0  ff ff af fe ff ff 00 08  00 00 00 08 aa 2b 00 00  |.............+..|
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|
00000200  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001000

A web search led me to https://wiki.osdev.org/Partition_Table, where I found that this disk has just one partition defined, starting at byte 0x1be. The numbers are all little-endian.

• bootable yes
• starting head 0xfe (what)
• starting sector 0x3f (high bits are for starting cylinder)
• starting cylinder 0x3ff
• system ID 0xaf, which this page says is "MacOS X HFS." Cool.
• ending head 0xfe
• ending sector 0x3f
• ending cylinder 0x3ff
• relative sector to start of ptn: 0x800
• total sectors in partition 0x2baa0800 = 732563456

Now that last number, 0x2baa0800 or 732563456, matches the number of "sectors" that fdisk thought this drive had. So fdisk(1) was almost right.

Meanwhile, that wiki.osdev.org page notes that since CHS fields are useless on almost all current drives; the CHS fields are set as above (an invalid setting). That was interesting but not, as they say, actionable. What am I supposed to do to fix this? Maybe testdisk? It currently says this:

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER 
http://www.cgsecurity.org

Disk /dev/sdg - 3000 GB / 2794 GiB - CHS 364801 255 63
     Partition               Start        End    Size in sectors
* HFS                      1   5  5 364800 190 62 5860507648











Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type,
     Enter: to continue
HFS+ blocksize=8192, 3000 GB / 2794 GiB

So I hit <Enter>, and it gave me the option to "Write", so I said yes and exited. It says I have to reboot for the change to take effect. Well, how about if I just unplug the disk?

Well, it looks like I can't just unplug it and plug it back in again. I have to wait some time... maybe about 3 minutes? Then the system will recognize the disk and re-read the partition table, etc. Like this

collin@p64:~$ udevadm monitor --udev
monitor will print the received events for:
UDEV - the event which udev sends out after rule processing

UDEV  [540827.342967] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4 (usb)
UDEV  [540827.377682] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0 (usb)
UDEV  [540827.378275] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host8 (scsi)
UDEV  [540827.378709] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host8/scsi_host/host8 (scsi_host)
UDEV  [540828.293126] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host8/target8:0:0 (scsi)
UDEV  [540828.293685] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host8/target8:0:0/8:0:0:0 (scsi)
UDEV  [540828.294498] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host8/target8:0:0/8:0:0:0/scsi_disk/8:0:0:0 (scsi_disk)
UDEV  [540828.295261] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host8/target8:0:0/8:0:0:0/scsi_device/8:0:0:0 (scsi_device)
UDEV  [540828.295499] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host8/target8:0:0/8:0:0:0/scsi_generic/sg6 (scsi_generic)
UDEV  [540828.295630] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host8/target8:0:0/8:0:0:0/bsg/8:0:0:0 (bsg)
UDEV  [540828.296220] add      /devices/virtual/bdi/8:96 (bdi)
UDEV  [540828.674004] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host8/target8:0:0/8:0:0:0/block/sdg (block)
UDEV  [540828.792427] add      /devices/pci0000:00/0000:00:1a.7/usb7/7-4/7-4:1.0/host8/target8:0:0/8:0:0:0/block/sdg/sdg1 (block)
UDEV  [540829.220135] add      /module/hfsplus (module)
UDEV  [540829.230641] add      /module/nls_utf8 (module)

Cool. Next:

collin@p64:~$ sudo fdisk -l /dev/sdg

Disk /dev/sdg: 2.7 TiB, 3000592982016 bytes, 5860533168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xcea3ed1a

Device     Boot Start        End    Sectors Size Id Type
/dev/sdg1  *    16384 4294983678 4294967295   2T af HFS / HFS+

collin@p64:~$ 

So let fortune favor the foolish

collin@p64:~$ sudo mount -o ro /dev/sdg1 /foo/sdb1
mount: wrong fs type, bad option, bad superblock on /dev/sdg1,
       missing codepage or helper program, or other error

       In some cases useful info is found in syslog - try
       dmesg | tail or so.
collin@p64:~$

Well. dmesg told me this near the end:

[540827.160035] usb 7-4: new high-speed USB device number 6 using ehci-pci
[540827.293356] usb 7-4: New USB device found, idVendor=1f75, idProduct=0611
[540827.293359] usb 7-4: New USB device strings: Mfr=4, Product=5, SerialNumber=6
[540827.293361] usb 7-4: SerialNumber: 20181129
[540827.293640] usb-storage 7-4:1.0: USB Mass Storage device detected
[540827.293953] scsi8 : usb-storage 7-4:1.0
[540828.292492] scsi scan: INQUIRY result too short (5), using 36
[540828.292499] scsi 8:0:0:0: Direct-Access     ST3000DM 001-9YN166            PQ: 0 ANSI: 0
[540828.292806] sd 8:0:0:0: Attached scsi generic sg6 type 0
[540828.293492] sd 8:0:0:0: [sdg] Very big device. Trying to use READ CAPACITY(16).
[540828.293868] sd 8:0:0:0: [sdg] 5860533168 512-byte logical blocks: (3.00 TB/2.72 TiB)
[540828.294986] sd 8:0:0:0: [sdg] Write Protect is off
[540828.294989] sd 8:0:0:0: [sdg] Mode Sense: 3b 00 00 00
[540828.295985] sd 8:0:0:0: [sdg] No Caching mode page found
[540828.295989] sd 8:0:0:0: [sdg] Assuming drive cache: write through
[540828.297608] sd 8:0:0:0: [sdg] Very big device. Trying to use READ CAPACITY(16).
[540828.538767]  sdg: sdg1
[540828.539863] sd 8:0:0:0: [sdg] Very big device. Trying to use READ CAPACITY(16).
[540828.542869] sd 8:0:0:0: [sdg] Attached SCSI disk
[540829.251371] hfsplus: invalid secondary volume header
[540829.251377] hfsplus: unable to find HFS+ superblock
[541163.757363] hfsplus: invalid secondary volume header
[541163.757366] hfsplus: unable to find HFS+ superblock

Well, that is of course disappointing. Let's see whether MacOS can read it.

---

YES!

So I plugged the drive into macbook, and it was mounted immediately. MacOS apparently is a bit more tolerant of the placement of the backup volume header table—or rather, the advertised partition size. Probably it read the "first" Volume Header and believed the size it found there. And the placement of the backup volume header was consistent with that. So MacOS is happily copying files over to a new drive.

What if macOS hadn't been able to read the drive? Well, just before trying, I noticed that the size of the partition reported by testdisk—i.e., 5860507648 sectors—didn't match the partition size I calculated, viz. 5860524032 512-byte blocks. So if MacOS had still balked, I would have taken the drive back to my Linux box and attempted to tweak the size in the partition table. Fortunately it didn't come to that. Whew!

Data recovery: Seagate SRD0SD1

This external backup drive is at least seven years old. Some days ago, it just wouldn't power itself on. Could I fix it?

My first hope, soon dashed, was that it might the power supply. It would have been perhaps the easiest fix. But I determined that 12 volts were being supplied, and that the voltage didn't drop when the supply was plugged securely into the drive.

Next came some web searches. "Research" would not really be a fair way to characterize this, but maybe it would pass for research these days :-). I found "Danny"’s totally excellent teardown video, which enabled me to get the drive out of the enclosure.

I have a desktopside computer with SATA drives. I connected the Seagate 3TB drive in place of one of the existing drives, and tried, as superuser, "mount /dev/sdb /foo/sdb"

No joy. More web searching and after "apt-get install hfsprogs" I got this at the end of dmesg:

[67539.205183] hfsplus: unable to find HFS+ superblock
[67547.971602] hfs: can't find a HFS filesystem on dev sdb1

Well, let's have a look at the drive

collin@p64:~$ sudo fdisk -l /dev/sdb

Disk /dev/sdb: 2.7 TiB, 3000592982016 bytes, 5860533168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0xcea3ed1a

Device     Boot Start       End   Sectors   Size Id Type
/dev/sdb1  *     2048 732565503 732563456 349.3G af HFS / HFS+

collin@p64:~$ 

So that's totally bogus; this is a 3TB drive! Then I remembered some work I did with netbsd around 2001; *BSD systems apparently use “labels” rather than the partition table. So the ptn table is just so much random bits 8^(

I decided to troll around a little, and found this. Don't ask me how I came up with 2048 blocks (with a totally unwarranted 4K blocksize) but here's what struck me:

collin@p64:~$ sudo dd status=none if=/dev/sdb bs=4k skip=2048 count=1 | hexdump -C
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000400  48 2b 00 04 80 00 21 00  48 46 53 4a 00 00 15 d7  |H+....!.HFSJ....|
00000410  d9 35 08 4d da 54 1b 92  00 00 00 00 d9 35 6a bd  |.5.M.T.......5j.|
00000420  00 30 c1 f8 00 0b 41 4c  00 00 20 00 15 d5 04 00  |.0....AL.. .....|
00000430  0a f1 a3 84 0a ef 00 00  00 01 00 00 00 01 00 00  |................|
00000440  00 3c 44 75 00 1e 9a f1  00 00 00 00 00 00 00 01  |.<Du............|
00000450  00 00 00 02 00 10 2d b8  00 00 00 00 00 00 00 00  |......-.........|
00000460  00 00 00 00 00 00 00 00  7d c5 0b 14 d5 a8 92 17  |........}.......|
00000470  00 00 00 00 02 ba c0 00  02 ba c0 00 00 00 15 d6  |................|
00000480  00 00 00 01 00 00 15 d6  00 00 00 00 00 00 00 00  |................|
00000490  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000004c0  00 00 00 00 01 00 00 00  01 00 00 00 00 00 08 00  |................|
000004d0  00 00 85 d8 00 00 08 00  00 00 00 00 00 00 00 00  |................|
000004e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000510  00 00 00 00 69 a0 00 00  15 20 00 00 00 03 4d 00  |....i.... ....M.|
00000520  00 07 d0 d8 00 03 4d 00  00 00 00 00 00 00 00 00  |......M.........|
00000530  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000560  00 00 00 00 a9 00 00 00  15 20 00 00 00 05 48 00  |......... ....H.|
00000570  00 00 8d d8 00 05 48 00  00 00 00 00 00 00 00 00  |......H.........|
00000580  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001000
collin@p64:~$ 

Okay, now that’s more like it. "H+" and "HFSJ" appear there. Searching around the web, I came upon the "Volume Header" section in Apple Technical Note TN1150, which begins:

Each HFS Plus volume contains a volume header 1024 bytes from the start of the volume. The volume header -- analogous to the master directory block (MDB) for HFS -- contains information about the volume as a whole, including the location of other key structures in the volume. The implementation is responsible for ensuring that this structure is updated before the volume is unmounted.

A copy of the volume header, the alternate volume header, is stored starting 1024 bytes before the end of the volume. The implementation should only update this copy when the length or location of one of the special files changes. The alternate volume header is intended for use solely by disk repair utilities.

Okay, so note how that "H+" begins at 0x400 (i.e., 1024) bytes from the start of this block? the vol begins 2048 blocks in, with a 4K block size, and this block is 1024 bytes in from there. What else?

Somewhere on the web I read the instructions to get testdisk, as in sudo apt-get install testdisk. I said sudo testdisk /dev/sdb and after some flailing I got this:

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
     Partition               Start        End    Size in sectors
>P HFS                        16384 5860524031 5860507648

Okay, so if a sector is 512 bytes, then testdisk agrees with me that the vol starts 8MB in (MB=1024*1024 bytes). Let's see if we can find the backup/alternate vol header by subtracting 1 from that 5860524031 number:

collin@p64:~$ sudo dd status=none if=/dev/sdb bs=512 skip=5860524030 count=1 | hexdump -C
00000000  48 2b 00 04 80 00 20 00  48 46 53 4a 00 00 15 d7  |H+.... .HFSJ....|
00000010  d9 35 08 4d da 54 0b 51  00 00 00 00 d9 35 6a bd  |.5.M.T.Q.....5j.|
00000020  00 2c 98 1f 00 0a 81 3b  00 00 20 00 15 d5 04 00  |.,.....;.. .....|
00000030  0b 00 70 9f 0a dd b9 b7  00 01 00 00 00 01 00 00  |..p.............|
00000040  00 37 5a 59 00 1d 85 1d  00 00 00 00 00 00 00 01  |.7ZY............|
00000050  00 00 00 02 00 10 2d b8  00 00 00 00 00 00 00 00  |......-.........|
00000060  00 00 00 00 00 00 00 00  7d c5 0b 14 d5 a8 92 17  |........}.......|
00000070  00 00 00 00 02 ba c0 00  02 ba c0 00 00 00 15 d6  |................|
00000080  00 00 00 01 00 00 15 d6  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0  00 00 00 00 01 00 00 00  01 00 00 00 00 00 08 00  |................|
000000d0  00 00 85 d8 00 00 08 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000110  00 00 00 00 69 a0 00 00  15 20 00 00 00 03 4d 00  |....i.... ....M.|
00000120  00 07 d0 d8 00 03 4d 00  00 00 00 00 00 00 00 00  |......M.........|
00000130  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000160  00 00 00 00 a9 00 00 00  15 20 00 00 00 05 48 00  |......... ....H.|
00000170  00 00 8d d8 00 05 48 00  00 00 00 00 00 00 00 00  |......H.........|
00000180  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200
collin@p64:~$ 

Okay, now that's good to know. One other piece of info here. I saw on https://superuser.com/questions/657655/problems-with-mounting-hfs-drives that there is a program gdisk, somewhat like fdisk, can give somewhat more detail on the partition types. And that there are (at least) two partition types of interest:

While the answer provided by mcy should work if the partition is actually an HFS+ partition, starting with OSX Yosemite the default partition type for a Mac is "Core Storage", which is used to handle logical volumes. This means that what you actually want to mount is a logical volume (using HFS+ filesytem) inside the "Core Storage" partition.

To see if your partition is of type "Apple Core Storage" you can use gdisk: AF05 is the code for "Apple Core Storage", while af00 is the code for "Apple HFS/HFS+".

What is this gdisk of which you speak? type gdisk said "not found" so I said:

collin@p64:~$ sudo apt-get install gdisk
Reading package lists... Done
Building dependency tree       
Reading state information... Done
gdisk is already the newest version.
gdisk set to manually installed.
The following packages were automatically installed and are no longer required:
  python-cffi python-colorama python-cryptography python-distlib
  python-ndg-httpsclient python-openssl python-ply python-pyasn1
  python-pycparser python-requests python-urllib3 python-wheel
Use 'apt-get autoremove' to remove them.
0 upgraded, 0 newly installed, 0 to remove and 455 not upgraded.
collin@p64:~$ type gdisk
bash: type: gdisk: not found
collin@p64:~$ 

Hurmpf. Was it...? Yes it was. Here:

collin@p64:~$ sudo /sbin/gdisk -l /dev/sdb
GPT fdisk (gdisk) version 0.8.10
...
***************************************************************
Found invalid GPT and valid MBR; converting MBR to GPT format
in memory. 
***************************************************************

Disk /dev/sdb: 5860533168 sectors, 2.7 TiB
Logical sector size: 512 bytes
Disk identifier (GUID): C599270C-2980-42BA-996C-7BF534EE6702
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 5860533134
Partitions will be aligned on 2048-sector boundaries
Total free space is 5127969645 sectors (2.4 TiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1            2048       732565503   349.3 GiB   AF00  Apple HFS/HFS+
collin@p64:~$ 

Well, it still seems silly about the 349.3GBytes, but it says the partition code is the HFSplus one, not the core storage one. That's good news at least.

But not good enough I think. Note that even gdisk thinks we ought to be starting at sector 2048 and that the partition is only about 350gb in size. I noted "offset" and "sizelimit" options in https://superuser.com/questions/961401/mounting-hfs-partition-on-arch-linux/1088110, but mount(8) tells me that those are losetup options only:

       The mount command automatically creates a loop device  from  a  regular
       file  if  a filesystem type is not specified or the filesystem is known
       for libblkid, for example:

              mount /tmp/disk.img /mnt

              mount -t ext3 /tmp/disk.img /mnt

       This type of mount knows about three options, namely loop,  offset  and
       sizelimit,  that  are really options to losetup(8).  (These options can
       be used in addition to those specific to the filesystem type.)

I don't want to hack the partition table, as I might totally b0rk it; another idea involves getting an adapter, sata↔USB, and just try mounting it on a mac. It would have to be one with a power supply. Maybe something from newegg.com