0

I have an old macbook that I wish to keep all the data from the drive as it currently exists - in the state that it is presently, exactly. Why does this matter? Because the laptop, when suspended and the battery drains, will retain that state upon restoration of power ... and the account is super old - and I don't know the password. I'd like to upgrade the laptop to newer RAM and maybe an SSD, but I have to keep the old hard drive with state and everything intact (to save session, login, etc.).

I'm concerned that if I pull the hard drive, something will result in the drive getting corrupted, or the login state getting corrupted, and I'll lose everything. Ideally, I could clone the drive to an external hard drive, including power-state, and boot using target-disk mode. Copying the data will be an option eventually, but I have software on that computer that only runs on that computer. (If I were to upgrade, I'd have to re-buy licensing, etc.)

Again, this is important because I don't know the password - the laptop is from 2008 (I think), and I've lost data from old macs before (mini and iMac) when I did the 'change the password for this user' trick, which resulted in losing the keychain access (login keychain saved with different password), and loss of data access.

I'm not opposed to using John (the Ripper) to recover the password. (It's my laptop, after all, and I can let the recover run for days or even weeks without being concerned about it ... it would actually be quite nice, since then I could just change my password to something recent I'll actually remember!) But I've only ever heard of that program in passing, and I don't know how to prepare a mac for its use.

UPDATE:
After extracting the hard drive and attempting to boot with it as an externally-attached drive, I received a hardware-level error that I "must reboot the computer". This does not bode well. I'm hoping that by hard-powering-down the computer I haven't corrupted the hard drive image of the logged-in session. I'm now attempting to copy the disk info to another external disk using the Restore function in Disk Utility, as suggested by in a referred answer...

user3.1415927
  • 534
  • When the MacBook goes to sleep, it will write the data to the drive then turn it off. You can then safely remove it from the MacBook. At that point, you can attach it to a USB drive then clone it. – Allan Mar 16 '18 at 18:51
  • Thanks @Allan, can I execute this copy (dd) from recovery mode, or do I need to boot to an external device? I.e., can I boot into recovery mode, attach an external drive, dd the dev to the external drive, reboot and target the external drive using Target Disk mode, and verify the external drive boots? – user3.1415927 Mar 16 '18 at 19:34
  • Since you will be cloning a partition you could do this from recovery to a USB or even a file. It might be safer to just clone the whole disk, however because you will need to clone the EFI (boot) partition as well. – Allan Mar 16 '18 at 20:40
  • Warning: dd does not properly handle either shrinking or expanding volumes, so you should really only use it between devices (/partitions) of the exact same size. I recommend using asr or Disk Utility's Restore feature instead. As with dd, you can do this from Recovery, Target mode, booted from a USB drive, or whatever. See this question for details. – Gordon Davisson Mar 16 '18 at 21:38
  • I’m acquainted with dd not expanding or shrinking volumes. I was planning to use dd for the initial copy to a larger physical drive, then reduce the partition size later with DU’s functionality after I confirmed booting. However, that restore idea isn’t a bad one... I’m currently trying to fix multiple computers with hard drive issues, so I’ll probably try both options at some point! – user3.1415927 Mar 17 '18 at 00:06

1 Answers1

0

The real problem here is macOS isn’t designed to save run state to the hard drive in a persistent state. Hibernate mode doesn’t expect to be relocated on a different memory and does expect to power down completely and add RAM when the os is not suspended or hibernating.

What you ask is trivially possible if you were running in a hypervisor such as VMWare fusion and could suspend and change the hardware from under the os due to a layer of abstraction. You’ll need an admin password to move forward, so that’s well documented.

Make a new admin or follow the password reset procedure. Deal with lost keychain and make sure FileVault isn’t enabled before you decide to reset the password and move on is my advice. The OS isn’t designed to support what you contemplate.

bmike
  • 235,889