Legacy Apple HFS+ data recovery

I recovered user data from an old PowerPC-era Mac disk image by identifying the Apple partitions, repairing journaled HFS+, mounting encrypted sparse images, and copying the files to modern storage.

Context

The source was an old raw disk image with Apple partitioning, HFS+ filesystems, and encrypted sparse images that modern systems did not simply mount and browse.

My role

I identified the disk structure, repaired the mountable filesystem state, accessed the encrypted image, and moved recovered data to current storage.

Result

The legacy user data was made accessible and copied to modern storage without treating the original image as disposable.

The problem

Why the work needed more than one tool

Legacy disk formats combine old partition maps, filesystem journals, encryption containers, and tool compatibility. An aggressive repair or write to the source can destroy the only recoverable copy.

What could go wrong

Writing directly to the only source image
Repairing the wrong partition or layer
Confusing the outer disk, HFS+ volume, and encrypted sparse image
Losing metadata or files during transfer
Assuming a failed mount means the data is absent

What I did

The working sequence

Attached the raw disk image in Linux
Identified the Apple partition layout and HFS volumes
Repaired the journaled HFS+ state needed for access
Located and mounted encrypted sparse images
Copied recovered user data with rsync to modern storage
Kept the recovery sequence layered so each container and filesystem was understood separately

How I validated it

Evidence before completion

Confirmed the expected partition and filesystem structure
Verified the repaired HFS+ volume mounted readably
Confirmed the encrypted sparse image opened at the correct layer
Reviewed the recovered directory structure on the destination
Preserved the source image for repeatable recovery if another pass became necessary

What this demonstrates

The skill behind the tools

This work shows persistence with unfamiliar legacy formats and a recovery-first approach that protects the only authoritative source.

Production details are intentionally anonymized. I do not publish organization names, internal addresses, credentials, private topology, or sensitive recovery information.

Platforms and tools

Linux Raw disk images Apple partition map HFS+ Journal repair Encrypted sparse images rsync

Continue through the project inventory

All projects Experience