How to Recover Data from a Dead MacBook

Jun 9, 2009 / By Lukas Vysusil

Tags: ,

This post might seem outside of our focus, but life brings all kinds of challenges. A friend of mine bought a MacBook when she was on vacation in the USA. For obvious reasons, Macs are more common on the other side of the Atlantic. In Europe it’s still rare to see a person using Mac as a personal computer (no flame intended, just stating a fact).

Her Mac completely broke down. The service guys told her she’d need to replace the motherboard, which would cost almost the same as a new computer. The problem was her Mac wouldn’t even start, and all the data she had on a hard-drive was stuck in the neat white box without any signs of life.

Sure, I said, I’m a computer guy I can recover it, can’t I?

I had never worked with Mac before, so I started with initial research to find out what options I have with hardware available in my home computer den.

I came to know that Mac uses filesystem called HFS+, and it can’t be read from Windows 32bit. Great, I thought, I’ve two options—find someone else with a Mac or get it mounted on Linux.

Fortunately, I have a Linux box at home, so it should be easy. I unscrewed the MacBook, and behind the battery there was 2.5 SATA drive. To be able to connect it, I need the interface between 2.5″ SATA drive and USB. For this purpose I’m using a QCP converter cable, which allows you to connect internal 2.5″/3.5″ ATA/SATA drives directly to USB port. (http://www.youtube.com/watch?v=NMtAPgcMtLQ) I really like this piece of hardware—it’s exactly the kind of gadget you want to have around for saving notebook drives.

After connecting the disk, I found that my OEL5.1 wouldn’t be friends with it. I simply couldn’t find the right hfsplus module for this distribution. Fortunately, there were many references about mounting hfsplus disks on Ubuntu Linux, which is my second system.

I downloaded the required package and dependency libraries for Ubuntu from here:

http://packages.ubuntu.com/dapper/hfsplus

The packages installation is straight forward:

root@silverbox:~# dpkg -i libhfsp0_1.0.4-10ubuntu1_i386.deb libc6_2.3.6-0ubuntu20_i386.deb hfsplus_1.0.4-10ubuntu1_i386.deb

After that, I needed to load the hfsplus module:

root@silverbox:~# modprobe hfsplus
root@silverbox:~# cat /proc/filesystems | grep hfs
        hfsplus

Next, I had to check which partition is the one I need to mount. For this purpose, I used parted:

root@silverbox:~# parted /dev/sdd
GNU Parted 1.7.1
Using /dev/sdd
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print

Disk /dev/sdd: 160GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number  Start   End    Size   File system  Name                  Flags
 1      20.5kB  210MB  210MB  fat32        EFI System Partition  boot
 2      210MB   160GB  160GB  hfs+         Untitled

Knowing the partition containing the data was /dev/sdd2, and I could mount it.

root@silverbox:~# mount -t hfsplus /dev/sdd2 /mnt/macosx
root@silverbox:~#

The next problem I faced was privileges. The directories I needed to save were owned by a non-existent user, and so I wasn’t able to access that path.

To work around this, I created a new user and assigned the directory owner UID.

root@silverbox:~# useradd macuser
root@silverbox:~# usermod -u 501 macuser

This allowed me to access the directory I needed to recover, and copy files to another ntfs disk which will be readable by regular Windows machine.

One Response to “How to Recover Data from a Dead MacBook”

  • Brad Hudson says:

    Great post Lukas!

    I would add a note that parted is not installed by default on a lot of linux distributions. The lowest common denominator for seeing the partition tables is fdisk. You can see all partitions on all disks using this command.

    /sbin/fdisk -l

    You could avoid the step of creating the new linux user by doing this all as root using sudo.

    Keep up the good work.

    Your freindly neighbourhood SA.

Leave a Reply

  • (will not be published)

XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>