need help, Mac data recovery via linux live usb

[thecompu-doctor]

I have a customers newer macbook w/ssd. I'd like to avoid pulling the drive or buying a thunderbolt to firewire adapter (for target disk mounting). The OSX is hosed and beyond repair without wiping it. I need to try and recover the customers files and I can boot up in Ubuntu, mint and knoppix via USB. I can see the hard drive and access its folder structure. However, when I get into the User directory I can't access the desktop, documents etc.. folders due to permissions issues.

I've done some digging online and found where people were able to change the permissions of the files/folders via "chmod -R 777 FOLDERNAME" (as outlined here: http://forums.macrumors.com/threads/overriding-mac-file-permissions-in-linux.611280/). When I do this, I get permission denied, read only errors. I'm slightly familiar with getting around in Linux, but not much beyond the GUI.

There should be a way to reclaim/modify permissions right?

 

[lcoughey]

I've encountered some of the SSD drives that have significant amounts of bad sectors due to a failing memory chip. You should definitely not be trying to mess around with file permissions or trying to "fix" anything on the original drive until you have a full sector-by-sector clone of the drive, especially with you already admitting that you are fumbling around with linux.

There are some guides on how to use ddrescue to get a full clone of the drive. I suggest you start there.

 

[Markverhyden]

I've encountered some of the SSD drives that have significant amounts of bad sectors due to a failing memory chip. You should definitely not be trying to mess around with file permissions or trying to "fix" anything on the original drive until you have a full sector-by-sector clone of the drive, especially with you already admitting that you are fumbling around with linux.

There are some guides on how to use ddrescue to get a full clone of the drive. I suggest you start there.

^^^ Get a full image first and then work from image. To be honest I've rarely seen a OS X installation that was totally hosed that did not have a problem with the drive. One exception has been if they are running some of these stupid "fix everything" utilities.

 

[cyabro]

Make yourself a bootable USB stick with OS x on it.
Then boot from that and install something like superduper and clone the ssd to an external USB.

 

[tf76]

Parted Magic. Use ddrescue.

 

[thecompu-doctor]

Thanks for the tips guys. I have already created a bit by bit clone. The disk itself has passed the hard drive assessment from the OSX disk utility. I suppose that doesn't mean it can't still be failing. Is there another good diagnostics that I can run on it to verify the health of the drive?

Now, onto the original task at hand. Does anyone have good suggestions on how I can access the users files?

 

[lcoughey]

Now that you have a full clone, how does it respond when you connect it to a system with a working copy of MacOS? You may need to get the full OS installed on the system, connect the clone, scan it with DataRescue4 or DiskWarrior and use them to extract the files, assuming that aren't readily accessible, as per your original issue.

 

[Markverhyden]

To begin with OS X is an HFS+ journaled file system. Not ext4, etc that linux normally has. So you have to be careful how you mount and read it in a *nix. As Luke implies you are best off using another OS X installation. As cyabro said you can make a bootable usb stick, preferably with the same flavor as the EU's machine. After you boot from the stick you should be able to mount the .img and browse files. Of course if you do not have another Mac to work with then things are not so easy. If you have R-Studio, even the recent Windoze versions, it will mount an .img file and can read the HFS+ file system. If you do not you can download the trial version, scan the image. If things look good you can buy and apply the license to recovery the files without re-scanning.

 

[sapphirescales]

I've found it a huge pain in the rear to work on a Mac without actually owning one. It's time you made the investment. If you just want something simple, an older (2011+) Mac Mini is a great option. It's cheap too. You should already own all of the tools you need to connect the drive/SSD directly to another computer. If you don't, now is the time to get them. It should be remarkably simple to pull the data off the drive/SSD as well as run a proper diagnostic on it if you get it connected to another Mac.

 

[Ashley Hathaway]

TZ works is a good forensic tool that works on mac that is worth looking at.

 

[Digital Sage]

I can't recommend disk drill data recovery program, installed on an external drive with OSX, enough. Works everytime. Boot into the OS on the external drive, run the software, recover to the external drive.

 

[thecompu-doctor]

Hi Guys, I just wanted to check in with yall and let you know what is going on here. I do have a mac (a few of them actually), and would have mounted it in target disk mode but this mac doesn't have firewire. So I finally just broke down and bought a thunderbolt to firewire adapter, then mounted it in target disk mode. Worked like a charm. (I did have to right click on the drive and select more info > and check the box that said something like "ignore permissions on this drive")

I should have done this earlier, just being cheap and didn't want to spend the $30


I want to run a more thorough diagnostics like HDTune and/or crystal disk info to make sure the drive is healthy. Ashley, you mentioned TZ, but I'm not finding much when googling. Can you point me in a bit more specific of a direction?




I've got another MB that just came in, the customer did an iCloud wipe of the system because he thought it was stolen. Now that he found the computer a few weeks later, he forgot about the iCloud wipe. Opened it up and connected to the internet and boom.... there goes his files. He wants the data recovered. I'm going to do some experimentation (after a full bit by bit clone). But if you all have any experience or suggestions for this, I'm all ears when it comes to this kind of situation on a mac.

 

[Markverhyden]

Good to hear.

https://www.tzworks.net/index.html

 

[CLC]

I've found it a huge pain in the rear to work on a Mac without actually owning one. It's time you made the investment. If you just want something simple, an older (2011+) Mac Mini is a great option. It's cheap too. You should already own all of the tools you need to connect the drive/SSD directly to another computer. If you don't, now is the time to get them. It should be remarkably simple to pull the data off the drive/SSD as well as run a proper diagnostic on it if you get it connected to another Mac.

Paragon Disk Copy Pro 15 will do a raw drive copy from usb on a mac. You just have to export the iso and set it as GPT in rufus to a usb. I've used it a few times now and it's a pretty nifty program. Same thing with parted magic, use rufus on the iso set to GPT. It's great for gsmartcontrol and checking hard drives, expecially when you don't want to pull that iMac apart until you are sure.