Recovering old USB drive previously used with MacBook

7 replies [Last post]
strypey
Offline
Joined: 05/14/2015

I've got an old USB hard drive that was originally formatted as a backup drive for a MacBook. At some point, somebody carved off some space and made a second partition, accessible by default with GNU/Linux. The last time the owner used it, they tried to update the Time Machine backup located on it, but their MacBook file system was badly corrupted, the update didn't work, and in the end they replaced their MacBook drive with a larger SSD.

I'm now trying to check the contents of both partitions from within Trisquel, but the system is having a lot of trouble mounting even the partition that's normally accessible. GParted is struggling to scan devices with the drive inserted. When I tried to shut down Trisquel with the drive still plugged in, it spat out a bunch of unhappy looking error messages, so I unplugged the drive, and it shut down fine.

I did a web search looking for advice and found a bunch of articles about accessing Mac formatted drives from GNU/Linux:
https://www.macworld.com/article/3003385/how-to-access-a-mac-drive-from-a-windows-or-linux-system.html

https://askubuntu.com/questions/332315/how-to-read-and-write-hfs-journaled-external-hdd-in-ubuntu-without-access-to-os

https://askubuntu.com/questions/100167/how-to-mount-hfs-drive-and-ignore-permissions

But I suspect the drive itself is bricked. Is there any way to probe it and see what state it's in using command line tools?

Narcis Garcia
Offline
Joined: 04/15/2019

$ sudo fdisk -lu

El 27/10/19 a les 13:46, name at domain ha escrit:
> I've got an old USB hard drive that was originally formatted as a backup
> drive for a MacBook. At some point, somebody carved off some space and
> made a second partition, accessible by default with GNU/Linux. The last
> time the owner used it, they tried to update the Time Machine backup
> located on it, but their MacBook file system was badly corrupted, the
> update didn't work, and in the end they replaced their MacBook drive
> with a larger SSD.
>
> I'm now trying to check the contents of both partitions from within
> Trisquel, but the system is having a lot of trouble mounting even the
> partition that's normally accessible. GParted is struggling to scan
> devices with the drive inserted. When I tried to shut down Trisquel with
> the drive still plugged in, it spat out a bunch of unhappy looking error
> messages, so I unplugged the drive, and it shut down fine.
>
> I did a web search looking for advice and found a bunch of articles
> about accessing Mac formatted drives from GNU/Linux:
> https://www.macworld.com/article/3003385/how-to-access-a-mac-drive-from-a-windows-or-linux-system.html
>
>
> https://askubuntu.com/questions/332315/how-to-read-and-write-hfs-journaled-external-hdd-in-ubuntu-without-access-to-os
>
>
> https://askubuntu.com/questions/100167/how-to-mount-hfs-drive-and-ignore-permissions
>
>
> But I suspect the drive itself is bricked. Is there any way to probe it
> and see what state it's in using command line tools?

strypey
Offline
Joined: 05/14/2015

Narcis Garcia:
> $ sudo fdisk -lu

Thanks. I did that. The output for the USB drive looks like this:

Disk /dev/sdb: 465.1 GiB, 499405291520 bytes, 975400960 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 82C2A588-FC49-423C-8EFE-A9B868CC4156

Device Start End Sectors Size Type
/dev/sdb1 40 409639 409600 200M EFI System
/dev/sdb2 409640 766095399 765685760 365.1G Apple HFS/HFS+
/dev/sdb3 766359552 975398911 209039360 99.7G Microsoft basic data

Caja still won't mount either of the data partitions. Is there a way I can check the integrity of the file systems from the command line?

I have installed hfsprogs. Will Caja use hfsprogs be default once I reboot, or is there a way I can instruct it to? hfsprogs is in the Trisquel repos and it keeps getting mentioned in a lot of the stuff I've found in web searches related to this problem, such as:
https://sdatic.com/mount-hfs-on-linux-with-command-line/

strypey
Offline
Joined: 05/14/2015

I notice that as well as the two data partitions on the drive there is a third item coming up in Caja called "WD SmartWare". I assume this is some kind of proprietary software launching off that first EFI boot partition. Could this be causing the problem? From memory, it didn't a few years ago when I was using the non-HFS partition to store GNU/Linux .ISOs and such.

nadebula.1984
Offline
Joined: 05/01/2018

This reminds me some weird partition table errors that I have encountered before.

I have some storage media that were once used as Live or installation disk, and they were created using dd command. Then later, I tried to install operating system to (not from) one of those media. I chose to re-create blank partition table and then created necessary partitions for system installation. But finally I got a message from Grub, saying duplicate partition tables were detected.

I tried to mount said media on different system environments. Under some circumstances the file manager and the partition editor showed the partitions before I tried to install operating system (i.e., the former partitions created using dd command, though the files were overwritten during the installation); but under some other, I saw the partitions after the system installation. I tried to repair the partition table but Gparted reported that everything was okay.

Finally, I decided to zero-fill the first several MiBs of the media to wipe out any possibly existing partition table information. Then the media was recognized as a blank disk and Grub could finally be correctly installed.

For you, if you don't need any data in the disk anymore, just zero-fill the first few MiBs and everything would be okay. Otherwise you may need to use tools like Gparted and Testdisk first to resolve any partition table problem.

nadebula.1984
Offline
Joined: 05/01/2018

Maybe you need a newer version of Gparted and try to fix the problems (if any) with both partitions. I never use legacy versions of disk utilities (like those in Trisquel) for such critical jobs. I recently used latest Gparted to fix an NTFS volume which has been "sentenced to death" under Losedows and retrieved all data. (Though I had to go to Losedows to run "chkdsk -f" as the finishing touch to make the disk usable again.)

I sometimes use the official Gparted Live, based on Debian sid. Though it enables contrib and non-free repositories by default, it doesn't come with any non-free software (included in the ISO). So as soon as you boot into the Live environment, disable the contrib and non-free repositories and you should have a free/libre Live environment. apt and dpkg are pre-configured, so if you need additional disk utilities, just download and install them from Debian's main repository.

strypey
Offline
Joined: 05/14/2015

Thanks again for the suggestion. Does GParted have a deb repo I could add to my sources list to download a newer version onto Trisquel?

nadebula.1984
Offline
Joined: 05/01/2018

I have searched packages.debian.org and packages.ubuntu.com. Ubuntu 16.04 LTS (on which Trisquel 8 is based) has Gparted 0.25; Ubuntu 18.04 LTS has version 0.30; Ubuntu 18.10 to 19.10, as well as Debian stable/testing/sid have version 0.32; and latest version 1.0 is in Debian experimental.

I routinely use Debian sid but I also enabled experimental repository so I could test the latest version as early as possible. You can try to directly download packages named "gparted" and "gparted-common" form Debian stable repository, and see whether you have other dependencies up to date.