Saving data from a 2009 iMac
My mother got an iMac back when we moved into our current house in 2009. After perhaps five years of usage by the whole family for all kinds of things--browsing, movie watching, gaming, etc.--we stopped using it. Mother started using her laptop instead and I built my first proper computer. Instead of properly taking care of the data on the computer (which should never have been stored only on that computer) we let it sit in a corner for a few years. It got moved further into darkness a few times, eventually ending up in my mother's closet until yesterday. You see, the time has come to move away from here and she is in the middle of throwing things out. All of a sudden it was of great priority to recover any data on the computer before finally throwing it out.
The problem was that it had been years since we had succeeded in booting the device, and even then it was incredibly slow and unusable. If I recall correctly we did not manage to transfer any data out from the computer at that time (though if we did then this endeavor sure was a waste). I did try to boot it again this time but it got stuck showing the Apple logo and a spinner for eternity. I had to get the data out some other way.
Digging out the HDD
Since I gave up on the machine ever booting by itself, the first task was to disassemble the chassis and retrieve the HDD to plug into another computer. Thankfully ours was one of the last iMac models with a magnetically fastened glass panel rather than the now glued ones. Thus the removal of the panel was just a matter of lifting it off. After unscrewing four screws the screen was loose. After lifting it up and disconnecting the four cables running to other components and the motherboard, PSU, WiFi module, cooling system and HDD were exposed! The drive was fastened with two more screws and three cables (SATA power, SATA data and what I assume is something related to temperature observation).
Retrieving the data
Next, I connected the SATA cables to my PC and ran sudo fdisk -l
as always to find out if the disk was alive. Amazingly it was (15-year-old drive, mind you). It showed three partitions, EFI, Mac boot and Mac storage (paraphrasing). The storage partition was of type HFS+
, and so after installing the hfsprogs
utility, I tried mounting it. But to no avail. Turns out that Apple (like always) does something odd with the beginning and end of partitions and the advertised size of the drive was not exactly correct.
Incredibly there is a tool called testdisk
which can be used to (by searching the start and end blocks) find the actual size of the filesystem on the partitions on the drive. Running sudo testdisk /dev/sda
gave me the actual block count, which could be multiplied by my disk's block size (512 bytes in my case) to get the filesystem size in bytes. The output also included the actual start block of the filesystem, which I too multiplied by the block size to get the filesystem offset in bytes.
Having found the actual offset and size the drive could finally be mounted in read-only mode by running sudo mount -t hfsplus -o ro,offset=209735680,sizelimit=999345127424,uid=$(id -u),gid=$(id -g) /dev/sda /mnt/mac
. Then it was just to start picking out files and transferring them to safety. Insanely enough the disk still managed read speeds of several hundred megabytes and the bottleneck turned out to be my network (for large, clustered files).
Many thanks to the author of the top answer on this superuser question for leading me right: https://superuser.com/questions/961401/mounting-hfs-partition-on-arch-linux/1088110#1088110.