3

I got a macbook from a friend (graphics chip not working anymore - harddisk should be fine but can't see much on the macs display) and I promised to rescue the data. But I can't read the partition with linux (ubuntu).

I managed to open the laptop, attached the disk to a linux machine and copied the disk partitions using dd if=... of=.... However when I have a look at the partitions, dd does not list any file system for partition #2 (which is the biggest and should contain the data) and I can't manage to get it mounted. enter image description here

things I tried:

  • I already tried hints I found like specifying offset and maxsize when using mount -t hfsplus ... (always complains about "bad superblock")
  • I was able to mount e.g. partition #3 (using mount -t hfsplus) but as assumed, it does not contain the users data
  • I assumed the file system might be apfs (instead of hfs+) and tried apfs-fuse but it told me "doesn't seem to be an apfs volume"
  • I tried mounting via this gui based tool: HFSExplorer but it can also mount partition #3 only

Any ideas on how to read the data on partition #2? Is this normal behaviour of mac file systems, to not have a type when shown in parted/linux? Can I get more information about the file system somehow? Or might it just be encrypted/damaged? Right now I'm only doing random guesses on what's preventing me from reading/mounting the data.

The macBook was purchased around 2012/13 (Model nr.: A1466).

user3215297
  • 101

1 Answers1

3

I solved mounting the mentioned partition by installing/following the instructions here: https://github.com/libyal/libfvde/wiki/Mounting.

It seems that the issue was that it was a FileVault encrypted partition (password was the user account login password of the macbook - but I'm not 100% confident if this is always the case or the user of this macbook just picked the same password for both).

hint: also make sure to get the .wipekey file that is mentioned in the github repository in the exact same way that it is explained there. At first I did it in another way, which gave me "unsupported core storage signature" and some other errors.

user3215297
  • 101