Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was investigating a problem on a Mac OS X 10.6.8 Server, where users were complaining of access slowdowns. Network throughput slowed to a crawl. It felt like the server was overburdened. System metrics showed the data rate at the NIC to be under 10MBps, while the web management interface for the Promise VTrak 610fD RAID chassis showed 40MBps. The chassis showed 8500 IOPS for one array.

Using fs_usage, I observed AppleFileService doing a RdMeta on a particular HFS+J volume at an excessive rate.

13:48:05.783    RdMeta   D=0x00009fc9  B=0x1000     /dev/disk6s2   0.000095 W AppleFileServer     
13:48:05.783    RdMeta   D=0x00009fca  B=0x1000     /dev/disk6s2   0.000097 W AppleFileServer     
13:48:05.783    RdMeta   D=0x00009fcb  B=0x1000     /dev/disk6s2   0.000096 W AppleFileServer 

The problem was resolved when I temporarily ceased sharing the volume on disk6. I would like to know what data are associated with these disk block numbers (40905, 40906, 40907, etc) on the device listed.

What tools can I use to identify the file(s) associated with these blocks?

share|improve this question
I've provided a correct answer... I'd appreciate if you marked it so :-) Unfortunately there are no free/included tools that will achieve what you want. – Joe Carroll Feb 29 '12 at 16:18

Off the top of my head, I can't think of a simple way to figure that out with the tools included in Mac OS X, but you can do it with fileXray, the powerful commercial HFS+ forensics command-line tool from iohead (I've tested and confirmed this myself, and it works like a charm):

sudo fileXray -W <block#>

Even if you decide not to buy their powerful software, the freely available manual gives some interesting insights into the low-level details of HFS+ etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.