Transferring data from a Mac with failing hard drive

tutlek wrote:

The OS from the HD does not load, and the only way I found to access data on this drive was via internet recovery, which permitted me to move some data to an external HD. However, this was not possible for some of the folders on the drive.

I am now logged into this HD from another Mac via target disk mode. I am able to view contents on this drive, but I am blocked from viewing the contents of many folders due to permission issues. Specifically, my wife's Documents and Downloads folders are not opening due to permissions.

I have her login info and have created a user account on my Mac with her login info that she used on her Mac and am accessing the failing HD from her user account on my Mac, however, this still does not let me see the contents to move them to an external HD.

How do I overcome this permission issue?

If you try to copy one of the "locked" folders such as her "Documents" folder macOS will prompt you for an admin password and then will copy them to the other drive. You will use the password for an admin account on the computer you are booting not the password for the computer with the documents you are retrieving.

Another option is to use Carbon Copy Cloner to copy the files since it will allow you to pick & choose the files within the locked folders.

On of the somewhat scary findings I made while dealing with this issue is the fact that I was able to activate internet recovery and then in disk utility copy some critical folders (mostly pictures from the pictures folder and some parts of her downloads folder) to an external HD with use of disk utility>file>new image>image from folder. Her HD is not encrypted and I accessed and copied many things not having to enter any password. Kind of scary, I think.

This is why encryption is so important. Anyone with physical access to a computer has a lot of options at accessing unencrypted data. Of course encryption is only as good as the password used to encrypt the data.

BTW, when I run internet recovery and then disk utility's first aid on this HD, I get a response that "First Aid has failed", with the following specifics minutes after I start the first aid run:

Checking the object map.

error: (did 0x28a273) om: btn: dev_read_finish(2663027, 1): Input/output error

This seems like a failing hard drive. when you encounter I/O errors. You may be able to confirm by running DriveDX as I suggested earlier.

That’s pretty standard with any drive that hasn’t been encrypted. However, it makes it a lot easier recover if there’s an issue with the drive or machine.

First are you certain the drive is failing? The hard drive cable on this specific model laptop has an extremely high failure rate. To check the health of the drive run DriveDX and post the report here using the "Additional Text" icon which looks like a piece of paper. If the drive is connected externally, then you may need to install a special USB driver to allow the necessary communication with the drive. FYI, not all external USB drive controllers allow the necessary communication even with this special driver.

If the hard drive is failing, then the severity of the failure can determine how you can retrieve the data from it. If the drive is only just starting to fail with just a few errors, then Carbon Copy Cloner (CCC) is a good app to use to copy your data since it can skip past some minor errors during the copy process and it will list the files it could not copy. If CCC starts encountering too many errors and is too slow, then stop it immediately as this is not the correct tool for the job as you may be making the drive failure even worse. It is best to copy small bits at a time starting with your most important data. You should disable Spotlight on this drive as well to keep the failure from getting worse and to improve performance of transferring data.

If the drive failure is more severe, then the best option would be to contact a professional data recovery service such as Drive Savers or Ontrack. Both vendors provide free estimates and are recommended by Apple and other OEMs.

If the data is not important enough to use a professional data recovery service, then the only other method I recommend is making a bit for bit copy of the failing drive to another drive of the same size or larger using the command line tool GNU ddrescue. This utility is the only one I know which can skip past the errors produced by a failing drive and gather the most data. Plus if the logging feature is used, then running it a second time allows you to scrape the data from the really bad sections of the drive. Plus with the logging feature enabled the clone can be resumed if it is interrupted for any reason. I've been using this method for over 10 years to successfully retrieve data from some severely damaged drives. This method is risky as the source drive is almost always destroyed in the process for the really severe failures.

You must choose the method of retrieving data very carefully since every failure may make it more difficult even for a professional service to retrieve the data. You usually only get one chance at recovering your data so choose wisely.

Now is the time to start backing up your system so you don't have to worry about retrieving data from a bad drive again. SSDs can fail without any warning signs. Plus data recovery from an SSD is nearly impossible even when you accidentally delete an item.

File system corruption perhaps?