Recovering data from USB with Macbook backup files on it

[ytesfay80]

I have this Lexar 128Gb flash drive that the customer said he backed his files on to before apple replaced his logic board.
When I plug the drive into any Macbook it doesn't show up on the Finder nor in Disk Utility but it does show a light on the USB when I plug it in.
When I plug it into my other computer which uses Ubuntu I see the drive show up in and I can see the contents of the backup on the folders such as "Desktop","Documents" etc,. but I cannot see the files due to permissions lock.
I attached photos of the usb data I get on my Ubuntu computer.

When I plug in the drive and boot with the 'option' key on the Macbook I see the "EFI Boot" partiition show up and when I boot it it has the loading bar going about 3/4 of the way then a cancel logo appears(circle with slash through it)
Also, When I go to Time Machine and look for a disk to backup from the drive doesn't appear.

Can someone please help me with software or something that would help me get the files off of this?

 

[dukefawks]

The first thing you do in this case is make a clone of the drive before messing with it. After that you only mess with the clone.

 

[smiba]

You need to import the disk in the installation window. Boot into Internet Recovery and press Reinstall OS X as you're used to, in the next window you can select "Restore from Time machine backup" and then External Backup Disk

But first follow duke's advice before doing anything else you don't know for sure, its important data for the customer so first make a 1:1 copy of it (use dd or something).

 

[ytesfay80]

When I go to the "Disks" page in Ubunutu and try to Create a Disk Image of the Partition I get this error.
"Error opening file '/media/mnm/LexarNew/Disk Image of sdc2 (2017-11-05 2155).img': Read-only file system (g-io-error-quark, 21)"

Do you know a better way I can make a clone of this even though it keeps saying I don't have permission?

Also, smiba what did you mean when you said "import the disk in the installation window."

 

[smiba]

Like I explained it, it needs to use the disk in the installation window.
​​​​​​
As for the copy, just Google on how to use dd (command line) it's a very powerful tool to make disk copies to (for example) files.

 

[ytesfay80]

Okay thanks I will make a clone of this now.

I still don't quite know what 'installation window' you are referring to though. The flash drive doesn't show up anywhere in the Mac except when I hold the option key on startup.

 

[smiba]

I still don't quite know what 'installation window' you are referring to though. The flash drive doesn't show up anywhere in the Mac except when I hold the option key on startup.

Ever been in Internet Recovery (Hold Command +R)? It will show you this window:



Press Reinstall in the Installation window (See the above picture) and you should be able to choose "Restore from Time machine backup" somewhere through the process before the installation actually starts

 

[ytesfay80]

Okay I followed your instructions for reinstalling OSX but when I get to the Installation Window page the usb drive doesn't show up on that page as you can see from the image attached. I was able to see the drive on the 'Disk Utility' page but only after a few minutes of the drive being plugged in.
The drive will not mount and I tried doing "First Aid" on the drive but that failed. I attached images of the screen I get.

When I hold the option key on startup the flash drive shows up but I'm guessing that was the EFI partition of the drive which I saw from my linux computer and was attached in my original post.

 

[smiba]

No Title

Hey sorry I was a bit of a dummy when I posted the screenshot, not sure where my mind was

Select the option above, named "Restore from Time Machine Backup"
​​​​​

 

[ytesfay80]

Yes I tried that as well but it just stays on that screen that says 'Searching for Time Machine Backups' and the drive never appears on there.

I tried manually mounting the drive using the terminal but it never mounts. The only thing that mounts on the drive is the EFI partition.
Could this have something to do with El Capitan being the OS on my Mac while the customer said they had Sierra installed when they did the backup.

 

[smiba]

I don't think it would require manual mounting, I don't think you're supposed to be able to mount it like a regular drive anyways.
Maybe you damaged some partition flags or something by trying to mount it on Linux? No idea really

Any reason why the customer can't just go back to apple so they can restore it?

 

[ytesfay80]

I'm not sure why they didn't take it to apple. Does apple do things like this if you bring it to them?

So do you know of any way to change the permissions on linux so that the folders with the information can be accessed. I can access the Applications + Utilites on the backup drive from Linux but the folders under the user account don't have the permissions.

smiba dukefawks

 

[smiba]

If you smile and be nice to the person helping you over at the apple store (Not authorised retailers, but an actual apple store) they will.

Did you make a copy 1:1 copy of it yet before we do anything like changing permissions?

 

[ytesfay80]

Yes I have a copy of this drive.
Also, the partition with the backup files on it mounts in linux so I'm not sure why it doesn't in Mac.

 

[ytesfay80]

dukefawks Any ideas on this?

 

[dukefawks]

I have no knowledge about stuff like this.

 

[ytesfay80]

smiba Is there anything I can do to change the permissions of the drive?

 

[smiba]

Are you logged in as root on your Linux system? Not sure if the kernel is trying to follow the JHFS+ filesystem's permissions, because that would explain why you can't touch the files as they're not owned by your user. You can't just copy the system over with support of your Linux machine though, too many file attributes that might get lost.

Just a wild guess, but I think you might have luck just copying the files back from the terminal in the Internet Recovery OS. I don't know the precise instructions but it would go something like this:

0. Before we start there needs to be a working installed version of OSX on the internal SSD as we need a working boot loader partition.
1. Boot into Internet Recovery (Not a local recovery partition!) and Format the Internal SSD's Mac OS partition so there is a clean empty JHFS+ filesystem in Disk Utility. If it doesn't want to, you can use the terminal with the command line tool "diskutil" with a command like this: "diskutil eraseDisk JHFS+ OSXSSD /dev/disk2s1". Before running this, make sure the internal drive is indeed disk2, with the second partition (s1) being the MacOS one with the command "diskutil list", double check this as it will otherwise wipe something else
2. Open the terminal in Internet Recovery OS, it should be running as root. Run this command:"cp -av /Volumes/NAME_OF_USB/PATH_TO_BACKUP/* /Volumes/NAME_OF_INTERNAL_SSD/". Again make sure everything is correct, forgetting 1 character can have totally different results. If you can't find the internal SSD or USB, mount the partition in Disk Utility. (Note: PATH_TO_BACKUP should be the backup location containing the root level folders such as etc, var, usr)
3. Running the copy command will probably take a while depending on the speed of the flash drive. If its finished in less then a minute either you or I did something wrong, it should output each file its copying.
4. Reboot the device and see if the system is even remotely interested in booting from it.

Keep in mind I have never tried this, but other then this I'd have no ideas left on why its not working. Let me know if you need help with one of the commands or if you were successful. Good luck

 

[Gurmon]

Diskwarrior will probably fix this. Why not try one of the free data recover software programs.

 

[smiba]

The issue is not data loss. No data recovery tool will recovery overwritten file attributes.
It will not work