This question already has an answer here:
I have an old macbook that I wish to keep all the data from the drive as it currently exists - in the state that it is presently, exactly. Why does this matter? Because the laptop, when suspended and the battery drains, will retain that state upon restoration of power ... and the account is super old - and I don't know the password. I'd like to upgrade the laptop to newer RAM and maybe an SSD, but I have to keep the old hard drive with state and everything intact (to save session, login, etc.).
I'm concerned that if I pull the hard drive, something will result in the drive getting corrupted, or the login state getting corrupted, and I'll lose everything. Ideally, I could clone the drive to an external hard drive, including power-state, and boot using target-disk mode. Copying the data will be an option eventually, but I have software on that computer that only runs on that computer. (If I were to upgrade, I'd have to re-buy licensing, etc.)
Again, this is important because I don't know the password - the laptop is from 2008 (I think), and I've lost data from old macs before (mini and iMac) when I did the 'change the password for this user' trick, which resulted in losing the keychain access (login keychain saved with different password), and loss of data access.
I'm not opposed to using John (the Ripper) to recover the password. (It's my laptop, after all, and I can let the recover run for days or even weeks without being concerned about it ... it would actually be quite nice, since then I could just change my password to something recent I'll actually remember!) But I've only ever heard of that program in passing, and I don't know how to prepare a mac for its use.
After extracting the hard drive and attempting to boot with it as an externally-attached drive, I received a hardware-level error that I "must reboot the computer". This does not bode well. I'm hoping that by hard-powering-down the computer I haven't corrupted the hard drive image of the logged-in session. I'm now attempting to copy the disk info to another external disk using the
Restore function in Disk Utility, as suggested by in a referred answer...