3

I got a macbook from a friend (graphics chip not working anymore - harddisk should be fine but can't see much on the macs display) and I promised to rescue the data. But I can't read the partition with linux (ubuntu).

I managed to open the laptop, attached the disk to a linux machine and copied the disk partitions using dd if=... of=.... However when I have a look at the partitions, dd does not list any file system for partition #2 (which is the biggest and should contain the data) and I can't manage to get it mounted. enter image description here

things I tried:

  • I already tried hints I found like specifying offset and maxsize when using mount -t hfsplus ... (always complains about "bad superblock")
  • I was able to mount e.g. partition #3 (using mount -t hfsplus) but as assumed, it does not contain the users data
  • I assumed the file system might be apfs (instead of hfs+) and tried apfs-fuse but it told me "doesn't seem to be an apfs volume"
  • I tried mounting via this gui based tool: HFSExplorer but it can also mount partition #3 only

Any ideas on how to read the data on partition #2? Is this normal behaviour of mac file systems, to not have a type when shown in parted/linux? Can I get more information about the file system somehow? Or might it just be encrypted/damaged? Right now I'm only doing random guesses on what's preventing me from reading/mounting the data.

The macBook was purchased around 2012/13 (Model nr.: A1466).

user3215297
  • 101
  • 6
    Possible duplicate of How to read and write HFS+ journaled external HDD in Ubuntu without access to OS X? -- HFS is a proprietary file system by Apple -- if these instructions don't work and you still have access to the Mac and MacOSX you may be better off using the Mac to copy from their proprietary file system to another – Nmath Jun 03 '19 at 22:56
  • @Nmath unfortonately these instructions did not help. But I also don't have real access to the mac. If i got really really bright light and concentrate very hard I can vaguely guess the shape of the login screen appearing on the screen. But there is no chance of copying data or something similar. My current assumption is that the disk is encrypted (FileVault) which led me to https://github.com/libyal/libfvde (found the .wipekey that is mentioned there on the Recovery partition - but still not able to mount) – user3215297 Jun 04 '19 at 00:11

1 Answers1

3

I solved mounting the mentioned partition by installing/following the instructions here: https://github.com/libyal/libfvde/wiki/Mounting.

It seems that the issue was that it was a FileVault encrypted partition (password was the user account login password of the macbook - but I'm not 100% confident if this is always the case or the user of this macbook just picked the same password for both).

hint: also make sure to get the .wipekey file that is mentioned in the github repository in the exact same way that it is explained there. At first I did it in another way, which gave me "unsupported core storage signature" and some other errors.

user3215297
  • 101
  • What version of the tool did you use? I'm running into this error with every attempt: Unable to open source volume

    I created a copy of the wipekey file from the Recovery partition (identical to the instructions provided) and I'm also using the Recovery Key for the HDD as well.

     – dpalmajr Oct 19 '19 at 07:01