Adventures in rescuing a corrupt HFS+ mac volume with Ubuntu linux

Over the years of working with Macs, I've often seen cases where a machine will fail to boot past the initial gray loading screen. Occasionally, this issue is easily fixed by booting from a 10.x installer disc and fixing permissions on the boot drive.

..but more often than not, it's not a permissions issue that's stopping the system from booting, and trying to verify or repair the filesystem on the drive will fail before it even attempts to fix it.

This isn't even a huge deal if your data is backed up, or unimportant.. just reformat the disk and do a fresh install of OSX. This wasn't the case this week when it happened again. One of the users I support had important data on the drive, and I knew I wouldn't feel right unless I explored every option for retrieving it.

My first thought was that the drive did not have physical damage, and that since it was likely logical damage to the filesysem, that something other than OSX might be able to read it. Since it has the most active community of all Linux distros, I decided that Ubuntu would be my choice. It turned out to be a good idea. (Note that I had access to a second, working Mac and some of these steps might be easier with a spare machine)

First, the Ubuntu LiveCD (version 9.05) booted with no issues on the eMac, and the HFS+ formatted hard drive mounted with no issues at all. I could see that all the files on the disk were readable except for the ones I didn't have permission for(the user's home folder for instance-which is exactly what I wanted to save). Linux can't write to an HFS+ volume without Journaling being turned off, and I couldn't turn journaling off without being able to mount the disk in OSX(which I couldn't - even in target disk mode), so I couldn't take ownership of the folder.

My second thought was to copy the data to an external drive.

The first step was to prepare the root user for use in ubuntu(by default the root user does not have a password and you cannot switch to it). So, we have to set a password..

sudo passwd root (you'll be prompted to enter a new password, and then to verify it)

Now that you can use the root account, su root.

You can now copy those files that you don't have permission to with sudo cp -R 'media/.....' 'media/....' (to make this quicker, Ubuntu allows you to drag folders to the terminal window in order to paste their paths).

This was a good solution in theory but my external disk was based on the FAT filesystem and many of the user's files contained bad characters. Being that I didn't have write access to the original disk, I couldn't run a regex to rename them. If the files you're rescuing don't have those characters, you should be good to go. Mount the external drive on a mac and you should have full access to all of those files.

If you are in my position, you'll want to download and install macFuse and fuse-ext2 on a working mac. You can then format the external drive as "fuse-ext2" via Disk Utility. (alternatively, just use gParted on the Ubuntu machine to create an ext2 partition-I prefer to do it from another mac so I can verify that it will mount before wiping out the original/bad drive.. if you only have the one machine, you have to take a leap of faith).

Back on the Ubuntu machine, your external drive will mount without issues as an ext2 filesystem. Run the cp command again and all your files should copy over without any "Cannot create directory" or "Cannot create regular file" errors.

You can then mount this drive on the mac that you installed fuse on.. or boot the original mac from an OSX system disc, do a format/clean install, install fuse and then mount it.

From here it's just a matter of dragging the files where you need them to go. Good luck!