Need to recover the data from the drive

Question

MacBook Pro 13" Function Keys 2017

A1708/EMC 3164 — Released June 2017, this entry-level MacBook Pro retains its traditional function keys (as opposed to the OLED Touch Bar).

crwdns2934591:0563crwdne2934591:0 crwdns2934593:0crwdne2934593:0

Matthew Alexander @mattalxndr

crwdns2934065:0crwdne2934065:0: 11

1

crwdns2931729:0crwdne2931729:0: Ndz 7, 2021

crwdns2933897:0crwdne2933897:0

Need to recover the data from the drive

The computer had water damage and was booting and shutting off intermittently. It now doesn’t boot at all (although I’m using a Dell XPS 13 charger to charge it at the moment, so finding an Apple charger could be one last thing I could try).

I had someone look at it and they suggested I just sell it for parts. I plan to do that, but first I want to get the data off of the drive and also wipe the drive if possible.

Because it doesn’t boot, “Target Disk Mode” is out.

I saw some posts in this forum from around 2019 that explains that the SSD in this model, while removable, was proprietary and no adapter existed. I did manage to find what I believe is the correct adapter (https://e-forensic.ca/products/tda7-7-ap...) but apparently it’s designed to only hook into another piece of equipment that company makes. So it’s not like I can buy one and plug it into my USB port.

Another idea was to send it off to a person or company that can image it for me (it will take some time to remember the password, so I hope imaging is an option). Something I can mount into a Linux box hopefully. I’m a little wary of what that price might be. It doesn’t need to be high for it to not be worth it, considering I’ve already had to send it around to be looked at.

My only other option, as far as I can see, is to find a working MBP of the same year and plug this SSD into that to recover the files.

Before I resort to that, do you have any other options or insights?

crwdns2934081:0crwdne2934081:0 crwdns2934083:0crwdne2934083:0 crwdns2934093:0crwdne2934093:0

crwdns2934109:0crwdne2934109:0

crwdns2853045:0crwdne2853045:0 crwdns2853046:0crwdne2853046:0

crwdns2889612:0crwdne2889612:0 0

crwdns2934285:0crwdne2934285:0

crwdns2933315:02crwdne2933315:0

crwdns2934051:0crwdne2934051:0

Dan @danj

crwdns2934065:0crwdne2934065:0: 479.1crwdns2936485:0crwdne2936485:0

Self employed contract worker

35

329

971

crwdns2931729:0crwdne2931729:0: Ndz 7, 2021

crwdns2933897:0crwdne2933897:0

@mattalxndr - Your right, the only way to recover the data is using another 2016/17 13” Fn MacBook Pro.

The only issue is if you’ve encrypted the drive. Then you’ll need to find your recovery key so access the data.

Reference: Use FileVault to encrypt the startup disk on your Mac

crwdns2934105:0crwdne2934105:0

crwdns2853045:0crwdne2853045:0 crwdns2853046:0crwdne2853046:0

crwdns2889612:0crwdne2889612:0 1

crwdns2944067:010crwdne2944067:0:

I just did a preliminary search of my pw manager and a few of my older drives and didn't find anything in the way of recovery codes. But I'll keep looking.

One thing I'm confused about though. If I have the drive hooked up to another computer, won't I just be able to enter my login password as usual, as if I just turned on my own computer and want to reach the desktop? Why would I need to use a recovery code?

If I'm forced to use a recovery code, maybe I could brute force it. I'm not really in a hurry. I could keep a script running for weeks, months. I guess I should keep an eye on the electric bill though. I'm sick of putting money into it.

crwdns2934271:0Ndz 7, 2021crwdnd2934271:0 Matthew Alexander crwdne2934271:0

@mattalxndr - You may not need to worry! Do you remember if you enabled FileVault?

crwdns2934271:0Ndz 7, 2021crwdnd2934271:0 Dan crwdne2934271:0

I just realized that when you mentioned recovery codes that you may have been addressing my assertion:

> (it will take some time to remember the password, so I hope imaging is an option). Something I can mount into a Linux box hopefully.

In that case, I'll need to dig up the codes I guess.

crwdns2934271:0Ndz 7, 2021crwdnd2934271:0 Matthew Alexander crwdne2934271:0

> Do you remember if you enabled FileVault?

I do not.

crwdns2934271:0Ndz 7, 2021crwdnd2934271:0 Matthew Alexander crwdne2934271:0

@mattalxndr - Linux won't help you, Apple's new file system APFS is not compatible with Linux. You need another Mac running the same or newer macOS release.

crwdns2934271:0Ndz 7, 2021crwdnd2934271:0 Dan crwdne2934271:0

crwdns2934275:05crwdne2934275:0

crwdns2934285:0crwdne2934285:0

I just did a preliminary search of my pw manager and a few of my older drives and didn't find anything in the way of recovery codes. But I'll keep looking.

One thing I'm confused about though. If I have the drive hooked up to another computer, won't I just be able to enter my login password as usual, as if I just turned on my own computer and want to reach the desktop? Why would I need to use a recovery code?

If I'm forced to use a recovery code, maybe I could brute force it. I'm not really in a hurry. I could keep a script running for weeks, months. I guess I should keep an eye on the electric bill though. I'm sick of putting money into it. — Matthew Alexander
@mattalxndr - You may not need to worry! Do you remember if you enabled FileVault? — Dan
I just realized that when you mentioned recovery codes that you may have been addressing my assertion:

> (it will take some time to remember the password, so I hope imaging is an option). Something I can mount into a Linux box hopefully.

In that case, I'll need to dig up the codes I guess. — Matthew Alexander
@mattalxndr - Linux won't help you, Apple's new file system APFS is not compatible with Linux. You need another Mac running the same or newer macOS release. — Dan

Freshlook @freshlook crwdns2934065:0crwdne2934065:0: 119 --- 5 · Answer 1 · 2021-09-07T13:07:27-07:00

Freshlook @freshlook

crwdns2934065:0crwdne2934065:0: 119

---

5

crwdns2931729:0crwdne2931729:0: Ndz 7, 2021

crwdns2933897:0crwdne2933897:0

Hello Matthew Alexander

Is the hard drive damaged? Or do you need the information stored on the desktop and partition C?What do you want to recover?Did you create the partition D on the hard drive?

crwdns2934105:0crwdne2934105:0

crwdns2853045:0crwdne2853045:0 crwdns2853046:0crwdne2853046:0

crwdns2889612:0crwdne2889612:0 -1

crwdns2944067:017crwdne2944067:0:

> Is the hard drive damaged?

I would guess not, because it was booting. But I suppose I am not 100% sure. I would need to test it.

The guy who opened it up and took a look didn’t think the drive looked damaged.

> Or do you need the information stored on the desktop and partition C?What do you want to recover?

I'm not sure what you mean by "Partition C". Is that the "user files" partition on a Mac that gets mounted to /Users?

To answer your question, yes, that's what I'd be after. It would also be nice to run a few commands like `ls /Applications > ~/installed-applications.txt` in case I ever want to refer to that later ("what was the name of that one app I used to use...").

> Did you create the partition D on the hard drive?

I didn't create new partitions.

crwdns2934271:0Ndz 7, 2021crwdnd2934271:0 Matthew Alexander crwdne2934271:0

As soon as you disconnect the hard drive from the laptop, all the data stored on the desktop will be deleted.

As you know, you can connect the hard drive to the USB port of another computer with the help of an adapter and perform the recovery operation with common software. But I personally have not seen much success in recovering data from SSDs for these applications

crwdns2934271:0Ndz 7, 2021crwdnd2934271:0 Freshlook crwdne2934271:0

SSD's are like an HDD's once written to the information is safe. So I'm not sure why you think pulling the drive out will erase the data.

crwdns2934271:0Ndz 7, 2021crwdnd2934271:0 Dan crwdne2934271:0

> As soon as you disconnect the hard drive from the laptop, all the data stored on the desktop will be deleted.

If that were true, that would be pretty evil, even for Apple. Sounds like an evil villian from the movies.

crwdns2934271:0Ndz 7, 2021crwdnd2934271:0 Matthew Alexander crwdne2934271:0

Hello Dan

Thanks for the answer.

1-Please look at this

https://www.datanumen.com/blogs/data-rec...

2-https://www.quora.com/Is-it-harder-to-re...

3-https://forums.tomshardware.com/threads/...