0

I'm a Windows guy. I've worked with Macs at times over the years as an IT guy, but they were always small parts of my environments and this is a new challenge for me.

A friend's Macbook is dead. Old, out of warranty for years, "loved", etc. Now dead.

I'm trying to pull the data off of the still-good HDD (150GB SATA drive) and am having trouble finding the actual user data on the drive.

The free trial of MacDrive mounted the drive quickly and easily and I've copied all the data from the drive to my working drives (so I'll still be able to access it once the trial expires). However, I cannot find any files that correspond to the data the user said was on her system.

Where do I need to look to find the user's files?

I though they might be in the \Users directory where there is a Shared folder with a few hundred KB of data, a Username folder that is empty, and a .Username folder which has 50GB of data mostly contained in \Users.Username\Username.sparsebundle\bands in progressive hexadecimal named files (files named 0 to fff) each 8192KB in size. So I'm pretty sure that's not what I'm looking for.

Improve this question

1 Answer 1

Reset to default
1

If you're seeing 50GB worth of sparse bundle bands, this suggests that the user has implemented FileVault encryption on the volume. To the very best of my knowledge, it is not possible to mount sparse bundles from Windows systems. You'll need a Mac system of equivalent OS version or newer to mount the drive and the user will need to supply the password used to encrypt the data.

This should help with mounting sparse bundles externally:

http://support.apple.com/kb/TS1974

Improve this answer
5
  • So, would a good course of action then be to simply purchase a case for this drive to turn it into an external drive, and once the user gets a new Mac laptop, work through recovering the files using the instructions in the linked KB?
    – music2myear
    Sep 22, 2014 at 14:24
  • That would be a good approach. Mounting the drive externally on a Mac will expose the sparsebundle. Double-clicking the sparsebundle will then present the user with a password prompt. Unlocking the bundle enables access to the data therein.
    – Trane Francks
    Sep 23, 2014 at 6:53
  • Excellent. That is the way I will go. If successful, I'll come back and mark this as the correct answer. Thank you for your assistance.
    – music2myear
    Sep 23, 2014 at 13:47
  • The user brought over another Macbook today and we connected the drive, now safely mounted in a USB enclosure. I had some issues navigating to the hidden /.user/ directory, but once I figured that out, the sparse disk image was easily mounted and I was able to copy all the files out successfully. So, thank you.
    – music2myear
    Oct 1, 2014 at 3:13
  • You're quite welcome.
    – music2myear
    Oct 2, 2014 at 13:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .