Linux – How to mount an OSX dd disk image

hard drive, disk, hardware

[adinserter name=”Posts”]

My 2011 Mac Mini was running so slowly, that I decided to back up it’s entire hard disk, and switch to Ubuntu. For the backup process, I opted to boot into a live Ubuntu environment, then use dd to copy the entire hard drive to a USB external hard drive. I can’t remember the exact command, but it was something to the extent of–

dd if=/dev/sda | pv -petr  > /media/ubuntu/usbhdd/apple-dapple-2016-sept-03.img

After ~5 hours, my new disk image was created on the USB HDD mounted at /media/ubuntu/usbhdd. Before deleting all the contents of the Mac Mini’s hard drive, I wanted to make sure the disk image was good, so I needed a way to mount the partitions that existed inside apple-dapple-2016-sept-03.img. I unmounted the USB HDD from the Mac Mini, and connected it to my laptop. On my laptop, as you’ll see below, the USB HDD was mounted to /media/chris/backup

Prerequisites

I’m not sure this is actually needed, but I’m putting it here just in case.

sudo apt-get -y install hfsplus

Mounting process

I started by making a mount point. This is where I mounted the filesystem to, so that I could browse to this directory and see all the files in the partition.

sudo mkdir -p /media/chris/mypartition

Next I needed to list the partitions on the dd image. fdisk won’t do, because fdisk doesn’t support GPT partition tables. Here I used parted. Setting the unit to B in parted was important, because the mount command expects offsets and sizes in bytes, not sectors.

sudo parted /media/chris/backup/grimmett-chris-mac-mini-2016-september-3-disk.img unit B print free
Model:  (file)
Disk /media/chris/backup/apple-dapple-2016-sept-03.img: 500107862016B
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number  Start          End            Size           File system     Name                  Flags
        17408B         20479B         3072B          Free Space
 1      20480B         209735679B     209715200B     fat32           EFI System Partition  boot
 2      209735680B     471500587007B  471290851328B  hfs+            Customer
 4      471500587008B  484363347967B  12862760960B   ext4
        484363347968B  484363468799B  120832B        Free Space
 5      484363468800B  490959011839B  6595543040B    ext4
 6      490959011840B  499457720319B  8498708480B    linux-swap(v1)
        499457720320B  499457839103B  118784B        Free Space
 3      499457839104B  500107841535B  650002432B     hfs+            Recovery HD
        500107841536B  500107845119B  3584B          Free Space

Using this output, I needed to find the start byte offset of the partition I wanted to mount, along with that partition’s total size. All my data was on the partition named, “Customer” and it starts at 209735680 (209735680B). Using that byte offset & byte partition size 471290851328, I was able to mount it.

sudo mount -t hfsplus -o loop,ro,offset=209735680,sizelimit=471290851328 /media/chris/backup/grimmett-chris-mac-mini-2016-september-3-disk.img /media/chris/mypartition

Now I was able to browse the files, and copy whatever I needed from the partition. It worked!

cd /media/chris/mypartition
ls
Applications  cores         dev  home     mach_kernel  Network  private  System  Users  var
bin           DamagedFiles  etc  Library  net          opt      sbin     tmp     usr    Volumes

This process took a lot of research. Lots of blogs and stackexchange answers instructed to specify a byte offset as an option for the mount command, but did not mention a sizelimit. I originally specified the byte offset, but not the sizelimit, so that resulted in an error–

mount: wrong fs type, bad option, bad superblock on /dev/loop2,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

Following the instructions in the above error message, I saw these lines in the output of dmesg

[ 9996.454670] hfsplus: invalid secondary volume header
[ 9996.454675] hfsplus: unable to find HFS+ superblock

And that’s what led me to the solution. This Superuser question about that same error.

HTH, GLHF HAGD

Looking for VOCALOID trading cards?

Check out Sakura Blossom Trading Post