How to Recover Data from a Dead MacBook

Posted in: Technical Track

This post might seem outside of our focus, but life brings all kinds of challenges. A friend of mine bought a MacBook when she was on vacation in the USA. For obvious reasons, Macs are more common on the other side of the Atlantic. In Europe it’s still rare to see a person using Mac as a personal computer (no flame intended, just stating a fact).

Her Mac completely broke down. The service guys told her she’d need to replace the motherboard, which would cost almost the same as a new computer. The problem was her Mac wouldn’t even start, and all the data she had on a hard-drive was stuck in the neat white box without any signs of life.

Sure, I said, I’m a computer guy I can recover it, can’t I?

I had never worked with Mac before, so I started with initial research to find out what options I have with hardware available in my home computer den.

I came to know that Mac uses filesystem called HFS+, and it can’t be read from Windows 32bit. Great, I thought, I’ve two options—find someone else with a Mac or get it mounted on Linux.

Fortunately, I have a Linux box at home, so it should be easy. I unscrewed the MacBook, and behind the battery there was 2.5 SATA drive. To be able to connect it, I need the interface between 2.5″ SATA drive and USB. For this purpose I’m using a QCP converter cable, which allows you to connect internal 2.5″/3.5″ ATA/SATA drives directly to USB port. ( I really like this piece of hardware—it’s exactly the kind of gadget you want to have around for saving notebook drives.

After connecting the disk, I found that my OEL5.1 wouldn’t be friends with it. I simply couldn’t find the right hfsplus module for this distribution. Fortunately, there were many references about mounting hfsplus disks on Ubuntu Linux, which is my second system.

I downloaded the required package and dependency libraries for Ubuntu from here:

The packages installation is straight forward:

[email protected]:~# dpkg -i libhfsp0_1.0.4-10ubuntu1_i386.deb libc6_2.3.6-0ubuntu20_i386.deb hfsplus_1.0.4-10ubuntu1_i386.deb

After that, I needed to load the hfsplus module:

[email protected]:~# modprobe hfsplus
[email protected]:~# cat /proc/filesystems | grep hfs

Next, I had to check which partition is the one I need to mount. For this purpose, I used parted:

[email protected]:~# parted /dev/sdd
GNU Parted 1.7.1
Using /dev/sdd
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print

Disk /dev/sdd: 160GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number  Start   End    Size   File system  Name                  Flags
 1      20.5kB  210MB  210MB  fat32        EFI System Partition  boot
 2      210MB   160GB  160GB  hfs+         Untitled

Knowing the partition containing the data was /dev/sdd2, and I could mount it.

[email protected]:~# mount -t hfsplus /dev/sdd2 /mnt/macosx
[email protected]:~#

The next problem I faced was privileges. The directories I needed to save were owned by a non-existent user, and so I wasn’t able to access that path.

To work around this, I created a new user and assigned the directory owner UID.

[email protected]:~# useradd macuser
[email protected]:~# usermod -u 501 macuser

This allowed me to access the directory I needed to recover, and copy files to another ntfs disk which will be readable by regular Windows machine.



Want to talk with an expert? Schedule a call with our team to get the conversation started.

1 Comment. Leave new

Great post Lukas!

I would add a note that parted is not installed by default on a lot of linux distributions. The lowest common denominator for seeing the partition tables is fdisk. You can see all partitions on all disks using this command.

/sbin/fdisk -l

You could avoid the step of creating the new linux user by doing this all as root using sudo.

Keep up the good work.

Your freindly neighbourhood SA.


Leave a Reply

Your email address will not be published. Required fields are marked *