At work, I am trying to extract data from a hard-drive that has a Mac's time-machine snapshots on it. The disk has two partitions on it (2tb and 800gb).
Hoping that the data-transfer would be much faster when its hooked as an internal drive on my linux-box, I took it out of the failed enclosure and threw it in. Bizarrely, the disk shows up as a uninitialized one.
Parted says the Partition table on the disk in unknown :|?
What I am missing here?
Do you have HFS+ support installed to your Linux box? It usually doesn't come with the popular distros by default.
Seems like it. I am using centos 7 and I installed kmod-hfsplus package from the repositories. No change though.
Alright, then your partition table may just be jacked the hell up. What you might try doing here if you have the space for it is doing a dd of the drive to an image file that you can work with. Use your favorite partitioning tool to recreate the partitions the way that they looked originally (usually 1 big partition, but you never know, that's why we're working with an image of the drive), and then do a quick format to HFS+.
Now I'm not 100% certain that this will work with HFS+, but it works with NTFS, FAT, and the EXT family. If the partition is the same as it used to be, and you just quick format it back to the same file system, Linux will (9 times out of 10) just show you all the files.
So I picked up an another external enclosure to test it and mysteriously the partitions show up :|?
There is something definitely wrong with the disk though as IO is really slow. I will check if the smart stats
point to anything strange.
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *3.0 TB disk4
1: EFI EFI 314.6 MB disk4s1
2: Apple_HFS iMac Timemachine 2.0 TB disk4s2
3: Apple_HFS Mafal Timemachine 996.2 GB disk4s3