I have a mac hard drive that is crashing that I am trying to pull all of the files off of. I want to be able to remove files from the drive so that I can narrow down where the issues are to try to save as much of the content as possible. To do this I need to be able to edit the drive on linux so I followed the information found here: How to mount a HFS partition in Ubuntu as Read/Write?. I was never able to mount the drive as RW using the standard mount methods though it would show up as read only still. I tried:

sudo fsck.hfsplus /dev/sdx

which was listed further down and got the following information

** /dev/sdc2
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
   Missing thread record (id = 26)
   Missing thread record (id = 105)
   Missing thread record (id = 6856404)
   Missing thread record (id = 6936575)
   Incorrect number of thread records
(4, 6)
   Incorrect number of thread records
(4, 6)
** Checking Catalog hierarchy.
** Volume check failed.

Since then the device hasn't mounted and I get the error:

Error mounting /dev/sdc2 at /media/paul/02eeaa8b-9ebd-3290-a8a5-0dd8d3e1bf7a: Command-line `mount -t "hfsplus" -o "uhelper=udisks2,nodev,nosuid" "/dev/sdc2" "/media/paul/02eeaa8b-9ebd-3290-a8a5-0dd8d3e1bf7a"' exited with non-zero exit status 32: mount: No such file or directory

The device still shows up using the disks tool as both a 315 MB partition at point /dev/sdc1 called EFI System and a 4 TB partition at point /dev/sdc2 called 4.0 TB Hard Disk. Any help on solving this catastrophe would be appreciated.

explanation in detail: I discovered that the hard drive that contains all the images of my kids was crashing while in the process of figuring out that external drive wasn't being backup up with the rest of the mac. I see far more of the files on the hard drive under linux then I did under mac and am therefore using linux to do the transfer. I have made a couple of attempts to pull all of the 600 GB of content off the drive: 1) A plane cp of the drive fails (and crashed the linux box) when bad sector are hit. 2) A bash based script that copied images and movies off the drive but doesn't do a good job of showing me what if anything has been missed

In an attempt to improve upon the results from 2 I have attempted to shift to 3 which uses mv instead of cp to transfer the files so that I can view what has been missed. mv requires RW access which led to the question above.

Update: I'm in the process of trying dd (after a different failed attempt), the transfer speed is down under 300kB/s (I believe it's in a bad spot) and since there are 400 gB of data it will take a while before I can see if it worked. Last pass through the disk took ~5 days.

Final Update: I have up on dd as it was transferring at Kb/s with no change over a 3 day period and was never going to finish the 400 GB of data. Ended up going back to mac utilities that seem to have resurrected the drive long enough to pull the files off.


I'm not sure these will help, but anyway:

An alternative to cp and mv is "rsync", which might be better than mv at least.
gives some examples

If you have the space for the data, you might try

sudo dd conv=noerror,sync if=/dev/sdx of=FILENAME
or even
sudo dd  conv=noerror,sync if=/dev/sdx | gzip --fast --stdout >FILENAME.gz

Both of which should allow to get the data off the drive - with a single read, for later recovery attempts - not sure how easy that is though. Note that "noerror" will have it continue past read errors, "sync" makes it fill in pieces that were unredable with zeroed data (necessary to not break all that comes after).

  • It looks like the syntax for dd on linux is more like this: sudo dd if=/dev/sdx of=FILENAME conv=noerror,sync the sync apparently files in errors with zeros. Found it here hints.macworld.com/article.php?story=20050302225659382 (the link talks about it on OSX but the same syntax runs under ubuntu. – Paul Dickson Jul 21 '14 at 14:12
  • Ahh, too quick on that one, remedied above. – Hannu Jul 21 '14 at 16:53

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.