Restoring Old Data

[R H]

I am looking to remove old data off a disk image I created from a dead MacBook's hard drive. When said MacBook was working, all the data were under a user protected with FireVault. So how do I access said data now? When the HDD is connected and on the disk image, it looks like that user has nothing. But I know that's where ALL my stuff was, so I assume it's an added layer of security.

Help?

More info:

Current MBP running Mavericks
Dead MBP ran Snow Leopard


Background if you care:

A few weeks ago, I killed my old MacBook Pro with water. Totally just spilled an entire glass into the slot in the back like a champ. Waited, the suggested 72 hours before starting it again (didn't have the right tools to remove the battery, tragically because it turned on again by itself later) and it was a no go.

Bought an enclosure for my hard drive but tragically it kept clicking and dying. Freezing it actually worked and I was able to create a disk image of of the thing so I have the data, the problem is, I can't access them.

Thanks.

 

[Altemose]

I am looking to remove old data off a disk image I created from a dead MacBook's hard drive. When said MacBook was working, all the data were under a user protected with FireVault. So how do I access said data now? When the HDD is connected and on the disk image, it looks like that user has nothing. But I know that's where ALL my stuff was, so I assume it's an added layer of security.

Help?

More info:

Current MBP running Mavericks
Dead MBP ran Snow Leopard


Background if you care:

A few weeks ago, I killed my old MacBook Pro with water. Totally just spilled an entire glass into the slot in the back like a champ. Waited, the suggested 72 hours before starting it again (didn't have the right tools to remove the battery, tragically because it turned on again by itself later) and it was a no go.

Bought an enclosure for my hard drive but tragically it kept clicking and dying. Freezing it actually worked and I was able to create a disk image of of the thing so I have the data, the problem is, I can't access them.

Thanks.

I never used FileVault but try dragging the disk image into Disk Utility and choosing "Unlock" by right clicking on it. I am a little curious how an entire glass of water went into the exhaust vent.

 

[R H]

In Disk Utility I don't have that option. On the first one I have "Help", "Eject", "Reveal in Finder", and "Convert" with "Burn" and "Verify" grayed out. And on the subdisk thing I have "Open" "Unmount" "Eject" and "Reveal in Finder".

It was only the one user's data that was locked with FileVault.

Also, I was putting my laptop on a table, and knocked into something that knocked a full water glass right over spilling almost all of its contents directly into the back of the MacBook Pro. It was a proud moment for me, let me tell you.

ETA: I feel like the best way to get my things back is if I could somehow boot from this disk image? I tried booting directly from the dying hard drive, I didn't think it would work and it didn't (presumably because it's running an older version of OS X?) but if there's a way to do that, or something close, that would be ideal since I think FileVault security is directly linked to the user account.

 

[Altemose]

In Disk Utility I don't have that option. On the first one I have "Help", "Eject", "Reveal in Finder", and "Convert" with "Burn" and "Verify" grayed out. And on the subdisk thing I have "Open" "Unmount" "Eject" and "Reveal in Finder".

It was only the one user's data that was locked with FileVault.

Also, I was putting my laptop on a table, and knocked into something that knocked a full water glass right over spilling almost all of its contents directly into the back of the MacBook Pro. It was a proud moment for me, let me tell you.

ETA: I feel like the best way to get my things back is if I could somehow boot from this disk image? I tried booting directly from the dying hard drive, I didn't think it would work and it didn't (presumably because it's running an older version of OS X?) but if there's a way to do that, or something close, that would be ideal since I think FileVault security is directly linked to the user account.

If this is a new machine, then that is a no-go on booting. Anything newer than Sandy Bridge is not supported even to boot on Snow Leopard. If you have an older Intel Mac, then you could restore the contents of the image (provided it is a good working image) to the hard drive and boot.

 

[R H]

If this is a new machine, then that is a no-go on booting. Anything newer than Sandy Bridge is not supported even to boot on Snow Leopard. If you have an older Intel Mac, then you could restore the contents of the image (provided it is a good working image) to the hard drive and boot.

I'm sorry, I'm a little lost, would you mind explaining that to me again?

If it helps, the hard drive I'm trying to pull data off of is from a mid 2010 MacBook Pro that was running Snow Leopard and my current MBP is running 10.9.2 and was bought last month.

My roommate has a MBP that is from 2011, I think, and will probably let me use it to pull my data if I ask nicely.

Thanks.

 

[Altemose]

I'm sorry, I'm a little lost, would you mind explaining that to me again?

If it helps, the hard drive I'm trying to pull data off of is from a mid 2010 MacBook Pro that was running Snow Leopard and my current MBP is running 10.9.2 and was bought last month.

My roommate has a MBP that is from 2011, I think, and will probably let me use it to pull my data if I ask nicely.

Thanks.

You better do that to a USB external hard drive. Do not touch his internal, but it should work fine provided you kept up on your software updates. 2011 machines need 10.6.7 to boot, but the 10.6.8 worked fine on all.

 

[R H]

You better do that to a USB external hard drive. Do not touch his internal, but it should work fine provided you kept up on your software updates. 2011 machines need 10.6.7 to boot, but the 10.6.8 worked fine on all.

Excellent! I know I was running 10.6.8 and I will report back tomorrow with updates. I figure it's probably better if I ask when my roommate isn't asleep. Thank you so much for your help!

 

[Altemose]

Excellent! I know I was running 10.6.8 and I will report back tomorrow with updates. I figure it's probably better if I ask when my roommate isn't asleep. Thank you so much for your help!

Drag the Disk Image into Disk Utility and restore it to the External Drive. Then plug it in and hold OPT on the 2011 model. You should get it to slowly boot!

 

[Weaselboy]

Excellent! I know I was running 10.6.8 and I will report back tomorrow with updates. I figure it's probably better if I ask when my roommate isn't asleep. Thank you so much for your help!

Snow Leopard used Filevault differently than Lion and up. Lion and up encrypted the entire disk and you could use that Unlock menu option in DU to open the "vault".

Leopard and Snow Leopard simply take only the user folder and put it inside an encrypted sparse bundle file. You should be able to open your DMG then navigate to /Users/username/username.sparsebundle and double click the sparse bundle file and enter the password to open it, then see whatever is in the user Folders.

I'm not sure, but I think that file might be hidden and you will need to tell Finder to show hidden files.

 

[R H]

Drag the Disk Image into Disk Utility and restore it to the External Drive. Then plug it in and hold OPT on the 2011 model. You should get it to slowly boot!

This worked perfectly with my roommate's laptop. I used it to decrypt the files so now I am transferring those to my new laptop and keeping the external the way it is as an extra backup (plus, I'm going to use it later to see if my dead MBP is as dead as I thought it was).

Thank you so much for your help!

Snow Leopard used Filevault differently than Lion and up. Lion and up encrypted the entire disk and you could use that Unlock menu option in DU to open the "vault".

Leopard and Snow Leopard simply take only the user folder and put it inside an encrypted sparse bundle file. You should be able to open your DMG then navigate to /Users/username/username.sparsebundle and double click the sparse bundle file and enter the password to open it, then see whatever is in the user Folders.

I'm not sure, but I think that file might be hidden and you will need to tell Finder to show hidden files.

This advice was not wrong, but once I found the file and was able to enter my password, I was unable to actually access it getting a "No mountable file systems" error. Presumably for the same reason I couldn't boot directly from the disk, but obviously what do I know? I was afraid that meant the disk image was corrupt, but it looks like that wasn't the case.

Thank you for your help though.

 

[Altemose]

This worked perfectly with my roommate's laptop. I used it to decrypt the files so now I am transferring those to my new laptop and keeping the external the way it is as an extra backup (plus, I'm going to use it later to see if my dead MBP is as dead as I thought it was).



Thank you so much for your help!











This advice was not wrong, but once I found the file and was able to enter my password, I was unable to actually access it getting a "No mountable file systems" error. Presumably for the same reason I couldn't boot directly from the disk, but obviously what do I know? I was afraid that meant the disk image was corrupt, but it looks like that wasn't the case.



Thank you for your help though.

No problem! Glad it worked out well.