mount Macbook partition on ubuntu (unknown filesystem - hfs+/apfs ?)
I got a macbook from a friend (graphics chip not working anymore - harddisk should be fine but can't see much on the macs display) and I promised to rescue the data. But I can't read the partition with linux (ubuntu).
I managed to open the laptop, attached the disk to a linux machine and copied the disk partitions using dd if=... of=....
However when I have a look at the partitions, dd does not list any file system for partition #2 (which is the biggest and should contain the data) and I can't manage to get it mounted.
things I tried:
- I already tried hints I found like specifying offset and maxsize when using
mount -t hfsplus ...(always complains about "bad superblock") - I was able to mount e.g. partition #3 (using
mount -t hfsplus) but as assumed, it does not contain the users data - I assumed the file system might be apfs (instead of hfs+) and tried apfs-fuse but it told me "doesn't seem to be an apfs volume"
- I tried mounting via this gui based tool: HFSExplorer but it can also mount partition #3 only
Any ideas on how to read the data on partition #2? Is this normal behaviour of mac file systems, to not have a type when shown in parted/linux? Can I get more information about the file system somehow? Or might it just be encrypted/damaged? Right now I'm only doing random guesses on what's preventing me from reading/mounting the data.
The macBook was purchased around 2012/13 (Model nr.: A1466).
21 Answer
I solved mounting the mentioned partition by installing/following the instructions here: .
It seems that the issue was that it was a FileVault encrypted partition (password was the user account login password of the macbook - but I'm not 100% confident if this is always the case or the user of this macbook just picked the same password for both).
hint: also make sure to get the .wipekey file that is mentioned in the github repository in the exact same way that it is explained there. At first I did it in another way, which gave me "unsupported core storage signature" and some other errors.
1
