Recovering data from Mac SSD

H

Haole Boy

Active Member
Reaction score
190
Working on a MacBook Pro that does not boot. You get the screen to enter the password, and after you do that, you get a black screen with the "prohibited" symbol (circle with a diagonal line through it). I booted the system from a USB external hard drive that has masOS 10.13 on it, and tried to run Disk Warrior. But, DW would not mount the Macbook's internal drive. Communicated with DW support, and they told me

"Likely, when the disk is attempting to unlock, a portion cannot be read, and prevents the disk from unlocking. I would try removing the disk from the computer and trying it in an external case."

I'm trying to understand how moving the drive to an external case will allow me access to the drive (so I can recover whatever data I can). Can anyone explain this?

Also, once I have the drive in the external case, can I access it from Linux Mint? I've done a little searching, and it seems like it can only be accessed as read-only since it is a Journaled file system (at least I'm assuming it's journaled). I'm making the assumption that if I can access the drive from Linux that running fsck will improve my chances at recovering the data.

Mahalo,

Harry Z
 
nononononononononononono

Read the advice from data recovery pros on here in other threads. The very very very first thing you will do with a suspect drive is create an image of it and work from that image. For that, you probably will use a Linux boot disk (Mint, Partition Magic, etc.) and ddrescue with a log file (important in cases of failing hardware).

If the hardware is failing, fsck may fsck your chances of recovery.
 
fencepost said:
The very very very first thing you will do with a suspect drive is create an image of it and work from that image.

If the hardware is failing, fsck may fsck your chances of recovery.
Click to expand...

Yes, I know this and I do this when working on data recovery. Just did not mention it.

My thoughts on using fsck is that if I can't get the drive to mount when it is in the external case, then hopefully, maybe fsck would help with that. But, if it won't mount, then I'm not sure how I could run fsck (or ddrescue). Oh, the joys of data recovery with limited tools. :-)

Customer does know that chances of recovering any data is very slight.

Harry Z
 
Haole Boy said:
Working on a MacBook Pro that does not boot. You get the screen to enter the password, and after you do that, you get a black screen with the "prohibited" symbol (circle with a diagonal line through it). I booted the system from a USB external hard drive that has masOS 10.13 on it, and tried to run Disk Warrior. But, DW would not mount the Macbook's internal drive. Communicated with DW support, and they told me

"Likely, when the disk is attempting to unlock, a portion cannot be read, and prevents the disk from unlocking. I would try removing the disk from the computer and trying it in an external case."

I'm trying to understand how moving the drive to an external case will allow me access to the drive (so I can recover whatever data I can). Can anyone explain this?

Also, once I have the drive in the external case, can I access it from Linux Mint? I've done a little searching, and it seems like it can only be accessed as read-only since it is a Journaled file system (at least I'm assuming it's journaled). I'm making the assumption that if I can access the drive from Linux that running fsck will improve my chances at recovering the data.

Mahalo,

Harry Z
Click to expand...

Sounds like they have a firmware boot password set. If you boot to the OS, even with FDE, you get a regular login. Wrong password and your just presented with the same screen.

firmware_password_mac_hero.jpg
 
Haole Boy said:
Yes, I know this and I do this when working on data recovery. Just did not mention it.

My thoughts on using fsck is that if I can't get the drive to mount when it is in the external case, then hopefully, maybe fsck would help with that. But, if it won't mount, then I'm not sure how I could run fsck (or ddrescue). Oh, the joys of data recovery with limited tools. :)

Customer does know that chances of recovering any data is very slight.

Harry Z
Click to expand...
You are still implying running fsck on the original. If you cannot clone/image, stop doing anything and refer to a professional.
 
I'm trying to understand how moving the drive to an external case will allow me access to the drive (so I can recover whatever data I can). Can anyone explain this?
Removing the drive from the computer and using an external case provides the opportunity to clone it and then work off the clone/image, given that the drive may be degraded.

What happens if trying to target disk on another Mac? Does the failed drive mount?
In a condition like yours, I suspect it will mount and then disappear randomly.

And what MacBook Pro version is it? SSD may be built in, therefore non-removable.
 
Haole Boy said:
But, if it won't mount, then I'm not sure how I could run fsck (or ddrescue).
Click to expand...
You run ddrescue on the raw device, not on the filesystem – indeed, ddrescue shouldn't be run on a device with partitions mounted (or only mounted read-only, if no other choice).
 
Markverhyden said:
Sounds like they have a firmware boot password set. If you boot to the OS, even with FDE, you get a regular login. Wrong password and your just presented with the same screen.
Click to expand...

Aloha Mark. I booted the Mac in Verbose mode (Command-v) and sent the resulting error messages to Disk Warrior support for analysis. They responded that there is something wrong with the drive and the suggestion to put it in an external case. Also, here is the screen I get when trying to logon: https://support.apple.com/library/c...en_US/osx/mac-prohibit-symbol-screen-icon.png

lcoughey said:
You are still implying running fsck on the original. If you cannot clone/image, stop doing anything and refer to a professional.
Click to expand...

Aloha. Unfortunately, the customer has already said no to professional data recovery due to cost.

labtech said:
I'm trying to understand how moving the drive to an external case will allow me access to the drive (so I can recover whatever data I can). Can anyone explain this?
Removing the drive from the computer and using an external case provides the opportunity to clone it and then work off the clone/image, given that the drive may be degraded.

What happens if trying to target disk on another Mac? Does the failed drive mount?
In a condition like yours, I suspect it will mount and then disappear randomly.

And what MacBook Pro version is it? SSD may be built in, therefore non-removable.
Click to expand...

Aloha. OK, I can understand placing it in an external case so that I can clone the drive, but how will putting the drive in an external case help me get the drive mounted? My (limited) understanding of Linux is that you have to mount the drive before you can access it. Am I wrong on this???

Unfortunately, the only Mac I own is a 2010 MacBook Air. No thunderbolt ports, only USB 2. And, I'm not sure if it would support the target disk operation. Macs are a very very small part of my business and I'm having a really had time justifying spending money on a new(er) Mac.

It's a 2015 Macbook Pro. I already have the SSD out and waiting on a response from Other World Computing about an install question with the new SSD.

NJW said:
You run ddrescue on the raw device, not on the filesystem – indeed, ddrescue shouldn't be run on a device with partitions mounted (or only mounted read-only, if no other choice).
Click to expand...

Aloha. I'm confused by your post. My understanding of Linux is that you have to mount the drive so that the operating system knows about it before you can do anything (read or write) to the drive.

Mahalo for respnding

Harry Z
 
lcoughey said:
If their data isn't worth $190 USD (my lab's minor rate for SSD, before your 20% discount), is it even worth your time to look at it any further?
Click to expand...

Yeah, I struggle with issues like this. One the one hand, I want to do as much as I can for my customer, but on the other hand there is the "is this worth spending time on?" issue.

I was also under the impression that professional data recovery started around $300 (plus drive to put the recovered data onto plus shipping). This works out to about $400 total and that is what I quote. Looks like I have to research SSD data recovery prices and change my quote!

Mahalo for responding,

Harry Z
 
As a side note, there's a difference between the drive being visible as a block device (/dev/sd1, etc) and being mounted which means it has a recognized file system. Drives with damage to the partition table or other key areas may not be recognizable as having mountable file systems, but they may still be available as block devices.

dd (and ddrescue) and other imaging tools work with the block device - they want the raw information from the drive, not whatever file structure there might be. Once you have that image of the original copied somewhere else, you can make another copy (so you have physical original, initial image backup, working image backup) and attempt to recover from the working image backup using various tools that will try to find file system structures in the disk image.
 
So you've got a clone on a good drive? Forget about the original drive and run DiskWarrior on the clone. The original disk may be worsening by the moment and so will not be able to mount reliably.

You can boot the mac from your external macos 10.13 drive and have the clone plugged in as well on a usb adapter.

It sounds like they likely have FileVault enabled, so you'll need the password to mount the clone.
 
fencepost said:
As a side note, there's a difference between the drive being visible as a block device (/dev/sd1, etc) and being mounted which means it has a recognized file system. Drives with damage to the partition table or other key areas may not be recognizable as having mountable file systems, but they may still be available as block devices.

dd (and ddrescue) and other imaging tools work with the block device - they want the raw information from the drive, not whatever file structure there might be. Once you have that image of the original copied somewhere else, you can make another copy (so you have physical original, initial image backup, working image backup) and attempt to recover from the working image backup using various tools that will try to find file system structures in the disk image.
Click to expand...

Mahalo for the info! That really helps with understanding how this could work.

geranium said:
So you've got a clone on a good drive? Forget about the original drive and run DiskWarrior on the clone. The original disk may be worsening by the moment and so will not be able to mount reliably.

You can boot the mac from your external macos 10.13 drive and have the clone plugged in as well on a usb adapter.

It sounds like they likely have FileVault enabled, so you'll need the password to mount the clone.
Click to expand...

Don't have a good clone yet. And I may not get one... I've been talking with the support folks at Other World Computing (where I purchased the replacement hard drive from) and also talked about putting the existing (bad) drive into an enclosure. He sent me a link to their enclosure and it's $99! Yikes! A little steep for a one-time-use piece of equipment. Still debating on whether or not it's worth it to *maybe* recover some data. Will talk with the customer again on this.

Why do you think they have file vault enabled?

Mahalo for the replies!

Harry Z
 
Haole Boy said:
Mahalo for the info! That really helps with understanding how this could work.



Don't have a good clone yet. And I may not get one... I've been talking with the support folks at Other World Computing (where I purchased the replacement hard drive from) and also talked about putting the existing (bad) drive into an enclosure. He sent me a link to their enclosure and it's $99! Yikes! A little steep for a one-time-use piece of equipment. Still debating on whether or not it's worth it to *maybe* recover some data. Will talk with the customer again on this.

Why do you think they have file vault enabled?

Mahalo for the replies!

Harry Z
Click to expand...
FYI, unless things have changed, OWC SSDs are cheaper because they use crappy SandForce controllers. Make sure your client is very clear that backups are essential.
 
It sounds like you are entering the password at an early stage and then the OS is not loading - that's what makes me think that FileVault is likely enabled.

You should be able to boot the macbook from a Parted Magic CD or flash drive and get an image onto an external USB drive with ddrescue (great guide by Silverleaf here: https://www.technibble.com/forums/resources/advanced-guide-to-ddrescue.10/ ). I always create an image and restore an image to a third drive to save myself from the stress of wondering if I set the clone in the right direction.

Are you dealing with a regular SATA drive here? If so, you can just use something basic like this: https://www.startech.com/ca/HDD/Adapters/USB-3-SATA-adapter-cable-with-UASP~USB3S2SAT3CB
or this: https://www.startech.com/HDD/Dockin...rive-Docking-Station-for-25-35-HDD~SATDOCKU3S
 
You must log in or register to reply here.

Similar threads

johnrobert
Cant read SSD
Replies
6
Views
282
lcoughey
lcoughey
P
Weird display issue with pattern of horizontal lines on MacBook Pro 15" A1398
Replies
4
Views
179
NviGate Systems
NviGate Systems
NETWizz
Giving away a Personal Laptop
Replies
3
Views
164
ThatPlace928
ThatPlace928
Metanis
[REQUEST] Recommending a backup solution.
Replies
8
Views
465
Sky-Knight
Sky-Knight
Big Jim
Secure data destruction with an SSD
2
Replies
24
Views
2K
Markverhyden
Markverhyden
Back
Top