MacBook Pro 2009 starting in Recovery mode (after stop sign) - how to back up data?

If you create and boot from a Knoppix USB stick, then you can easily check the health of the drive. Download the Knoppix Linux DVD .iso file with "EN" in the name for ENglish. Use the Knoppix .iso file as a source for Etcher (Mac/Windows/Linux) which will push the image onto a USB stick to create a bootable Knoppix USB stick. Option Boot the Mac and select the orange icon labeled "EFI" to boot from the Knoppix USB stick. While Knoppix is booting the laptop may appear frozen on the Apple boot picker menu so make sure to give Knoppix lots of time to finish booting.

Once Knoppix boots to the desktop, click the "Start" menu icon on the lower left of the Taskbar and navigate the menus to "System Tools --> GSmartControl". Within the GSmartControl app, double-click on the drive icon to access the drive's health information. Post the complete report here. You should also check the "Error" tab within GSmartControl and post any errors listed there in case the main health report doesn't indicate any issues.

Until the drive's health report is analyzed I suggest not using this laptop & drive in order to keep any potential drive failure from getting worse. If the drive is healthy, then you have several things to try to access the data.

Sorry about the delay as I wanted to ponder my response a bit to separate out what I would do versus what you should do since data recovery of a failing device also requires some intuition from noticing the tiniest things. Every failing device is handled a bit differently depending on what is seen in addition to the severity of the failure.

Like I mentioned before the safest option would be to have a professional data recovery service such as Drive Savers attempt to retrieve the data. They provide free estimates and are recommended by Apple and other OEMs.

The drive failure is just beginning, but it is also starting to get enough bad blocks that extreme care must be taken. Currently in the report there are 18 blocks pending reallocation. These 18 blocks will be ones which will cause problems with transferring the data, plus any other bad blocks which have not yet been marked for reallocation yet (the latter unknown bad blocks are the biggest concern). Already 19 blocks have been reallocated and are no longer a concern except for the fact that we know at least 37 blocks have already gone bad. And the report shows some uncorrectable errors which mean some blocks will have data loss. A lot of things go into determining whether to try using the Finder, or some other macOS app to attempt to transfer files to external media, or to first perform a low level bit for bit clone. Also a lot of careful observation needs to be done throughout the whole process as well as monitoring the drive's health to see if the failure is getting worse and how quickly the failure is increasing.

If you just need to recover a small number of extremely critical files, then it may be worth trying to use the Finder or the third party app Carbon Copy Cloner to attempt to transfer a small number of critical files. CCC allows you to select just the files you want to transfer and if it starts to have errors CCC will prompt you if it should skip files which start to produce errors (yes), however, if this transfer is taking too long, then it should be aborted immediately so as not to make the drive failure worse.

If a large amount of data (large size files) need to be transferred, then performing a low level bit for bit (block for block) clone is best. However, this requires using a special command line utility best used from a Linux boot drive since macOS interferes with the process and does not have a precompiled binary version of the utility available. Even if you are familiar with the command line, it is very easy to make a mistake in marking the source & destinations of the clone. When performing this clone you must usually make a decision on when it stop it since there will usually still be blocks that has trouble transferring. Those blocks may be empty space, or contain OS system files, but they may also contain your actual data file....there is no way to know and no one can really advise you on when to give up on the clone.

After you decide the cloning has gotten as many blocks as possible, you will need to see if you can access the clone normally. Sometimes you may need to run Disk Utility to repair the file system, while other times you may need to use a standard data recovery app to locate your files on the clone. It is important to realize, that once you attempt to access the clone, then you will not be able to resume the clone because macOS will likely have made some changes to the clone and resuming the clone will further damage the possibly already damaged file system. I can provide some instructions if you are interested. I have posted them on these forums several times many years ago, so I will likely try to find one of them to link here which may take a bit of time to locate since they were difficult to write up the first time and I haven't performed data recovery in a few years so I'm a bit rusty when trying to provide the specific details to guide you.

The cloning method requires another drive the same size or larger than the failing drive. You will also need yet another drive with sufficient space for storing the data recovered from the clone. You don't want to use the clone for more than accessing the files since you cannot be sure of the integrity of the file system or the OS on it (if it happens to bootable).

Sometimes I may employ both methods on a drive such as this if someone had a few critical files. I would try to pull just those specific files first. Then depending on the importance of the remaining files and the amount of data, and the health of the drive I may continue attempting a standard file transfer, or I may employ the cloning method. It is a very delicate balance with no guarantees on any method and no way to know which path is the correct one until after it is done.

You do have a very important decision to make because you usually only get one chance at recovering data from a failing drive. So be sure to choose wisely.

Unfortunately the Finder is not available from the macOS installer. You can use the Finder if the laptop is able to boot normally or into Safe Mode. Target Disk Mode is another option if you have access to another Mac, but this is an expensive option as you need to proper adapters & cables to connect the two Macs.

You can remove the failing hard drive from laptop and connect it to another Mac using a USB to SATA Adapter.

Another option is to use the Knoppix USB stick to attempt to transfer files from the failing drive to an external drive. As long as Filevault was not enabled, this option should be easy as you can use one of the file manager GUI apps on the Knoppix boot disk. The only difficulty is the external drive needs to be formatted with either the NTFS file system or an HFS (non-journaled) file system. While a drive can be formatted using Knoppix, it will be easier if the drive is formatted as NTFS using a Windows system or the HFS (non-journaled) file system using a Mac. Linux cannot safely write to a journaled HFS volume. HFS is called "MacOS Extended" in macOS.

This all assumes the files can be transferred which is risky.

Hi,

Target Disk Mode could be your friend.

Transfer files between two Mac computers using target disk mode - Apple Support

Or Pull out internal drive and install it in external HDD enclosure then connect it to new MacBook Pro.

If the hard drive is failing, then you have a very important decision to make. How important is this data to you? If it is really important, then contact a professional data recovery service such as Drive Savers. Drive Savers provides free estimates and is recommended by Apple and other OEMs.

Keep in mind if the hard drive is failing, then the more you have the drive powered on and the more you attempt to access the data on the failing drive, the worse the drive failure will become where even a professional data recovery service will be unable to recover any data. macOS and most apps (even data recovery apps) are not able to handle the errors produced by a failing drive. The only way to attempt recovery of data from a failing hard drive without using a professional data recovery service is by performing a low level bit for bit clone using a special Linux command line utility which is able to deal with errors produced by a failing drive. However, by the time the clone is complete, many times the failing drive will be dead. Plus it is risky using the command line as it is very easy to make a mistake and destroy the data on the drive you are trying to recover.

You can confirm a drive failure and its severity by checking the health of the hard drive by booting a Linux USB stick. I can provide instructions if you are interested. If the failure is minor & just beginning, then it may be possible to use an app such as Carbon Copy Cloner to attempt transferring the important & critical files, but this is still very risky since some drive failures can progress very quickly.

You may only get one chance at recovering data from a failing drive, so be sure to choose wisely with how you proceed.

I am not a professional data recovery expert, just an advanced one who has successfully recovered data from hundreds of failing drives. I've only ever attempted to recover data from drives where the user was unwilling to pay for a professional data recovery service and was willing to risk my amateur attempts.

Take this as a valuable lesson and don't skimp on your backups. With SSDs in general and especially with the USB-C Macs, you never want to be lax with your backups since it is at best very difficult/nearly impossible to actually impossible to recover any data from an SSD if there is any hardware issues...sometimes corrupt firmware or security enclave is all it takes to permanently lose data on a USB-C Mac. It is impossible to recover accidentally deleted data from an SSD after the Trash has been emptied, plus an SSD can fail at any time without any warning signs (even a brand new SSD). At least with older hard drives there was usually a good chance at recovering some data from a failing drive, although later hard drives this has become more difficult as well even for a professional data recovery service.

arya-md wrote:

After formatting the drive it all looked ok, with Mac OS Extended (Journaled) as format. Once I use Etcher to flash the iso, at the end of the operation the disk turns into an unreadable drive.

I tried a few times, with same outcome. What am I doing wrong?

You are doing nothing wrong if Etcher did not report any errors. macOS does not understand the drive layout of the USB stick created this way as it is using a Linux file system (sort of -- its a bit complicated to explain). If you Option Boot the USB stick, you will see the USB stick appear as a boot option on the Apple boot picker menu with an orange icon with a label of "EFI". Option Boot means holding the Option key down immediately after hearing the startup chime.

You need to post the entire report. It has been a while since I used GSmartControl, but I believe you can use the "View Output" or even the "Save As" which will gather information from all the tabs. The "Attributes" tab is really the most important tab as it contains the bulk of the health information.

The error tab reveals the last error was uncorrectable which means there is going to be data loss, but the full report will provide a better picture of the extent of the failure.

As for the picture orientation, iPhones & iPads tend to rotate pictures so it is best to "Edit" the picture on the iPhone/iPad by clicking the "Edit" option when viewing the photo on the iPhone/iPad and selecting rotate and confirm to save the changes. Definitely rotate the pictures before uploading even if you must use the Windows system to do so.