2010-05-29

Macbook OS X disk recovery

This is another story of why we should all do automated backups...

Problem:
Kelly's Macbook stopped booting.  It would show the Apple Logo and a progress bar, and then just switch itself off.

Diagnosis:
To show boot sequence details; hold down the "Command" and "V" keys when powering on.  This is called the Verbose Boot Mode, and it might show you what is going wrong.  In my case the boot sequence was failing at the filesystem check:

** The volume Macintosh HD could not be repaired.

Raw Disk Backup:
Before risking further damage and loss of data, I make a backup of the entire drive.  Many failures like this are caused by a failing hard disk with bad sectors. Normal copying programs fail when they hit a back sector, so I use the GNU ddrescue tool.  This makes a low level raw copy of the disk, and attempts to recover as much data as possible from dying disks.

The ddrescue tool is available for on most Linux distributions. I used an Ubuntu computer with the Macbook hard drive attached via a SATA cable for maximum speed.  You will need to work out which disk is the macbook drive, and then run:

mount /dev/sdb1 /mnt
ddrescue /dev/sda /mnt/macbook-ddrescue.img /mnt/macbook-ddrescue.log

If ddrescue fails to fully recover all of the data from the disk due to back sectors, you can run it again to make further attempts.  Don't worry, it uses the log file to only repeat reading the parts that it couldn't copy the first time.

File Backup:
Now that I have a full raw disk image, I am less concerned about doing something wrong and loosing data.  Putting the hard drive back into the macbook and booting into Single User mode, I was able to mount the broken filesystem in read-only mode and copy the files to another backup drive over USB.  This backup drive was previously formatted with HFS+, and could be mounted in Single User Mode.

Insert the Snow Leopard Install DVD and boot it by holding "C" down while powering on.

Eventually the Snow Leopard install screen will be displayed.  Don't follow the usual install process, but select Terminal from the Utilities menu.  From the terminal we can hopefully mount the broken drive and backup the files.

mkdir  /Volumes/internal
mount -o rdonly /dev/disk0s2 /Volumes/internal

mkdir  /Volumes/backup
mount /dev/disk9s2 /Volumes/backup

ditto  -v -V /Volumes/internal /Volumes/backup/.

First Attempted fix:
Boot into Single User mode by holding down the "Command" and "S" keys while  powering on, and run the filesystem check by hand.

fsck -fy /dev/disk0s2 

If this doesn't work, try running this command to rebuild the B-Tree catalog:

fsck_hfs -r  /dev/disk0s2

Some people reported that they had to run this up to three times to finally fix their filesystem. In my case this didn't help.

Manufacturers Disk Diagnostic Tools
Most hard drive manufactures provide free tools to check and diagnose their disks for low level hardware errors.  They do this to help minimize people RMA'ing perfectly good disks due to software problems.

The Seagate tools are available as a DOS bootable CDROM image.  Run the short test first, and then the extended tests.  These tests can take several hours, so be patient.

Re-Installing Snow Leopard
Now that I have the two separate backups, I felt more confidant about erasing the Macbook drive and re-installing Snow Leopard from scratch.

Insert the OS X installation DVD and hold down the "C" key to boot from the DVD drive.

The installation process will present you with an option to restore from a backup or migrate data from another machine. I was able to plug in the USB backup drive and restore all of the user data and applications. This was the easy part - thankyou Apple.

After all that, the Macbook is up and running with everything exactly as it was. Nice.