MAC OS Utilities at start up

Oh no. I'm sorry to hear this happened to your dad.

Did he get this iMac used, like from a school, university, or work place? With an EFI firmware password enabled he could have had this on his system for years and never realize it, and it would only surface by trying to boot off an external drive (for example).

If he didn't buy this iMac direct and new from a retail store or Apple.com but did get it from a school/employer/etc. he would have to get the EFI password from them.

If he DID buy it new/retail himself, then he would need to get a copy of that receipt (like from his credit card company or bank) and with that proof the Apple Store Genius Bar or Apple Authorized Service Provider can contact Apple and get the EFI password removed. Without that proof, Apple would not be able to help.

Lastly, is it really an EFI password? It probably is based on your description, but a picture of the password screen he is seeing would help.

Definitely this will require the receipt from the original retailer which (among other things) would show the serial number on the receipt. Even if this was many years ago he should be able to get that from his bank/credit card.

In terms of getting to his data: try booting by holding down the T key. This is to put the Mac into Target Disk Mode to act as basically a big external firewire hard drive for another Mac. If it shows him the strange looking Firewire symbol bouncing around on the screen, then this is working and the data can be pulled off with the right cable + a 2nd Mac. Finger's crossed this is the case. If it still asks for the EFI firmware password instead, then this wouldn't help.

Use target disk mode to move files to another computer - Apple Support

Before we get into anything more specific, it'd be good to know the answer to the above, and have you look up the serial number from the back/bottom of the iMac stand to find out exactly what year/model/size iMac he has by running it through http://checkcoverage.apple.com. Any conversation that goes into "data recovery" talk is best to be very specific. Also, it would be good to know if you have convenient access to a corporate/university IT department/technician or not since pulling out the drive and putting it into an enclosure is usually the next best step when talking data recovery.

That trick about popping out the RAM chips (to change the total memory temporarily) in order to wipe the EFI password sounds liked it worked for you! I didn't realize/remember that still would work on a machine as "recent" as a 2012 model, but apparently it does, so great job in finding that. It definitely won't won't on newer models, but I'm not sure when Apple improved that security hole.

It does look like his main internal partition (disk0s2) got screwed up and is no longer a functioning bootable OS X partition since it's now listed as "OS X Recovery Base System", however the data should still be there hidden in terms of recoverability. That's a label usually associated with a loaded recovery system, not a functioning partition (which would be labelled normally "Macintosh HD", or "Untitled", or in the case of your external drive OS X, "James"). And I see it's virtually empty so the data was definitely erased (but as I said, I would expect it to be recovery).

Have you tried to move forward with the data recovery step? I'd imagine that next step is to boot up with that Stella recovery USB stick I presume you have or, to boot up off your external macOS drive and run a data recovery program from within OS X there on that disk0s2 (aka the "Lost Volume 1" as Stellar shows it).

I assume the trial version of Stellar will scan the drive and show you the files it can recover, but won't let you recover until you pay the $80 or whatever for the full version? (that's normal for recovery programs, FYI). If this were me I would go ahead and try to recovery what it can in terms of pictures, documents, etc. and safe those to your external drive now.

You can also try this free program, it is legit but I don't know how well it works honestly as it is older (but so is your dad's system). You can consider trying it before buying Stellar, but you should at least see and verify that Stellar is claiming it can see the files from the internal drive that your dad cares about: http://www.macdatarecoveryfreeware.com

Once you've concluded your data recovery I would hold down OPTION key on boot to select your boot drive, and to select to boot off the recovery partition off your external drive (as opposed to the internal drive recovery partition). I suspect that if you hold down OPTION you will have two recovery systems listed. Anyway, then use Disk Utility to erase that 460gb "OS X Base System" and to see you if you can select to Reinstall OS X from the main recovery menu onto it.

All of this, after data recovery.

Most likely it does since it shows 1.3 GB used out of 500 GB.

It may or may not be able to recover some data though...

Data Rescue...

http://www.prosofteng.com/products/data_rescue.php

"Stellar Phoenix Macintosh - Mac data recovery software, recovers data from damaged, deleted, or corrupted volumes and even from initialized disks."

They have a trial version, so I guess you can see if your data can be recovered...

http://www.stellarinfo.com/mac-data-recovery.htm

FileSalvage is an extremely powerful Macintosh application for exploring and recovering deleted files from a drive or volume. FileSalvage is designed to restore files that have:

    * been accidentally deleted.

    * become unreadable due to media faults.

    * been stored on a drive before it was re-initialized/formatted.

https://www.subrosasoft.com/product-category/file-recovery/

I'm glad you were able to at least boot up off the external drive. I am a little confused because if you had an unknown EFI firmware password I don't believe you should be able to boot up onto an external drive at all without that password.

That bit aside at the moment, it doesn't look like it's seeing the internal drive. Since you raise the issue of data recovery for your dad here is what you should do next to try to determine if the physical drive is still being seen or not:

In the recovery mode on the top menu bar of the main Utilities screen is a Utilities menu item where you can select Terminal.

In the Terminal window type the command:

diskutil list

This will produce an output, if you can take a photograph of the entire output (resize the terminal window if necessary to see the whole output) that should provide some light on the subject as to whether home data recovery options are viable next step or not.

On a side note, you can also select Firmware Password Utility to see if there is a current password it asks you or offers to create one. You don't need to create one. I'm thinking whatever you saw previously was not a firmware password.

If you can also get clarification from your dad on the following points: Why was he upgrading at this time? Was it because he was experiencing specific problems and was hoping the upgrade would help? For example, was he experiencing frequent freezing-mouse-cursors and frequent beach-balling while this happened, or no? Or was everything good before the upgrade and he just wanted to upgrade for whatever normal reason?