Mount HFS Partition on Debian

Summary

I was asked to recover a photo library (~50GB) from a 2008 iMac that wouldn’t stay running long enough to complete a Time Machine backup. After liberating the 3.5 inch hard drive from the Mac, I connected it to one of my servers to image the drive. I used dd to create a bit-for-bit copy of the entire drive.

Tools Needed

I am somewhat ironically performing this recovory operation on a Debian 12 virtual machine running on my Proxmox hypervisor when my primary machine is a Mac. Looking for a challenge, I continued on my journey. To read the data from the image, I needed to install the hfsprogs package. In Debian, this is available if the following line is added into the apt sources.list file.

deb http://ftp.us.debian.org/debian sid main non-free

Then running sudo apt update && sudo apt install hfsprogs gets the package installed.

Since I ran the dd to image the drive on my hypervisor, I passed through this image to the Debian 12 VM. I ran the command:

qemu-img convert -f raw -O qcow2 vm-226-disk-1.img vm-226-disk-1.qcow2

to convert the image file to a qcow2 file. I then added the disk to the virtual machine configuration file:

# grep 'vm-226-disk-1.qcow2' /etc/pve/qemu-server/226.conf
virtio1: photon:226/vm-226-disk-1.qcow2

Recovery

Once the VM was booted, I used fdisk to identify the partition containing the data I was after and mounted that partition on a directory I created in /mnt:

# mkdir /mnt/mac-test/
# mount -t hfsplus /dev/vda2 /mnt/mac-test/

From there, I could browse the filesystem and carve out the data I needed and create a tarball of the files.