I'm a Windows guy. I've worked with Macs at times over the years as an IT guy, but they were always small parts of my environments and this is a new challenge for me.
A friend's Macbook is dead. Old, out of warranty for years, "loved", etc. Now dead.
I'm trying to pull the data off of the still-good HDD (150GB SATA drive) and am having trouble finding the actual user data on the drive.
The free trial of MacDrive mounted the drive quickly and easily and I've copied all the data from the drive to my working drives (so I'll still be able to access it once the trial expires). However, I cannot find any files that correspond to the data the user said was on her system.
Where do I need to look to find the user's files?
I though they might be in the \Users directory where there is a Shared folder with a few hundred KB of data, a Username folder that is empty, and a .Username folder which has 50GB of data mostly contained in \Users.Username\Username.sparsebundle\bands in progressive hexadecimal named files (files named 0 to fff) each 8192KB in size. So I'm pretty sure that's not what I'm looking for.
Best Answer
If you're seeing 50GB worth of sparse bundle bands, this suggests that the user has implemented FileVault encryption on the volume. To the very best of my knowledge, it is not possible to mount sparse bundles from Windows systems. You'll need a Mac system of equivalent OS version or newer to mount the drive and the user will need to supply the password used to encrypt the data.
This should help with mounting sparse bundles externally:
http://support.apple.com/kb/TS1974