Tech Blog

How to recover data from a Mac

TLDR; found at the bottom.

My sister came to me with her laptop and said, "I've given up on this thing but if you can get the documents off of it that would be amazing."

It was no surprise she had given up, due to false information given by Apple and confusing, conflicting diagnosis. At one [point she had told me that she had a cracked hard drive, something that isn't all that possible to do. I mean she is permanently cursed with technology, but that is a bit extreme. The latest and last one she got from Apple when she sent it off was

"Some of the software should work" - Apple

By some of the software they meant the recovery mode, THE RECOVERY MODE NOT THE OPERATING SYSTEM. Honestly, I don't even know how they could legally say that to her. So she hands it to me, and I start down the deepest dive I have ever done into a Mac.

Standard Recovery Software Should Work... Right?

NOPE that means that there wouldn't be a blog post. What I first did was run my recovery software that has worked beautifully for my PCs for years on her mac and what I got back was nothing useable. I think it was all encrypted and what is more confusing is that it pulled more data off it that there was, I believe it found 400+gb where there was a mere 125gb of stuff on the hard drive.

Mac Encrypts Their Hard drives

I dove into it and what I soon realized, using their only partially working recovery mode was that her hard drive was locked and encrypted. Honestly, this was probably the reason why my recovery software didn't work. I can tell you this for a fact. No average user needs their hard drive encrypted, I actually prove in this post that it doesn't even matter I can get the data off of it anyways, and If I wanted to spend hours un-encrypting it and potentially corrupting some data I could have done that but for the average user it doesn't make sense. This gave me a headache before for work when I was trying to wipe a hard drive of an employee that was no longer working at the company. That computer science degree can get confused with IT sometimes. All I can tell you about this is that, encrypting the hard drive only prevents data recovery software from working, they are making it harder to recover your data, let me say that again,

Apple is making it harder to recover your data by encrypting the hard drive.

It may sound cool to have an encrypted hard drive, and you may even like the thought of it, mostly it's useless. The data recovery software that I had run, from my knowledge, would have worked if the drive wasn't encrypted.

What the recovery mode did provide me, however, maybe the one thing that was good about it, after force mounting the drive, was that her files were indeed there, all the folders, etc... So that was good news, the next challenge was how to get it because the external hard drive that I had plugged in to drag and drop the files into, well that didn't work either.

So through convoluted form posts and pretty much 2008-2010 server information, I was able to figure out how to do it.

How to recover data on your Mac if it is genuinely fked

The OS didn't work, re-installing the OS wasn't even an option, dragging and dropping the files from recovery mode didn't work, this is what I had to do.

  1. Get an external hard drive and format it to FAT, not FAT32 but FAT.
  2. Boot into single user mode by pressing and hold Command-S on startup
  3. A lot of posts will say to do /sbin/fsck -fy but if you're reading this skip that
  4. Enter the command /sbin/mount -uw this will mount your hard drive with write privileges
  5. Enter the command ls /dev/disk* and take note of the numbers there
  6. Plug in your FAT formatted external hard drive and wait up to 30 seconds
  7. Type ls /dev/disk* again and see which drives weren't there before, for me, it was /dev/disk2s1, you will see a /dev/disk2s0, but that isn't your actual reference you need
  8. Type mkdir /Volumes/usb this is a place for you to access your external hard drive
  9. Type fstyp /dev/disk2s1 remember it was disk2s1 for me but might be different for you, it should return ms_dos
  10. Type mount -t ms_dos /dev/disk2s1 /Volumes/usb we are going to access the external hard drive through the /Volumes/usb folder
  11. Type ls /Users/your user name/ if you want to see what folders are there you can hit Tab to autocomplete folder names

Now it is time for you to copy your files over, YAY! What I would do now is to type mkdir /Volumes/usb/Documents and a few others like mkdir /Volumes/usb/Desktop, photos, etc.. so you can create a somewhat similar file structure.

  1. Type cp -p -r /Users/your user name/Documents /Volumes/usb/Documents and now watch everything flow from the hard drive to the external hard drive! You may see some chmod errors, and those would be inaccessible files, there won't be that many of them.
  2. When you're done copying the folders over, /sbin/umount /Volumes/usb then type shutdown -h now.

TLDR Version

  1. Get an external hard drive and format it to FAT, not FAT32 but FAT.
  2. Boot into single user mode by pressing and hold Command-S on startup
  3. /sbin/mount -uw
  4. ls /dev/disk* and take note of the numbers there
  5. Plug in your FAT formatted external hard drive and wait up to 30 seconds
  6. ls /dev/disk* take note of the drives that weren't there before
  7. mkdir /Volumes/usb
  8. fstyp /dev/disk2s1 should print out ms_dos
  9. mount -t ms_dos /dev/disk2s1 /Volumes/usb
  10. mkdir /Volumes/usb/Documents
  11. cp -p -r /Users/your user name/Documents /Volumes/usb/Documents
  12. Do the above command in steps 10 and 11 for the various folders in your computer, type ls /Users/your user name/ if you want to see what folders are there
  13. /sbin/umount /Volumes/usb then type shutdown -h now.
dan flan