Data recovery from dmg file from failed ssd

[Erik9999]

Hello! My first post

- Failed crucial ssd for macbook pro
- Ssd had encryption (I have the passwords)
- I manage to do a raw recovery wich is a dmg file of the intire ssd
- I no longer have this ssd
- I am not 100% sure if the file extention was dmg when I recovered it with stellar recovery ( I might have changed to try to mount it, but I can't remember)

This is a long time ago, but due to someone proffesional was able to recover another failed ssd with same system by clone it to a new hard drive, that was accessable from my macbook. This makes me believe I can recover this if I can clone it over to a new hard drive.

- Tried restoring the dmg file to a new hard drive from disk utility: "Could not validate source - Invalid argument"

So my questions is:
1. How do I clone it over the new hard drive?
2. There probably was bad blocks on the ssd. Is this something that is relevant with the dmg file?

I appologize if my questions are kinda dumb. I'm kinda new with this stuff.
However if anyone can help me I would really apriciate it!

[data-medics]

Have you tried just renaming the file back to .dmg and double click it on a Mac computer?

[Erik9999]

Yes it says "image not regognised". The ssd was not able to mount when I cloned it.

[Erik9999]

I'm pretty sure I need to clone it to an harddrive and make it bootable somehow, so I can enter my password. Or else I would not get access to anything cos it's encrypted. Is this possible when the image is not recognised or is it just a waste of time trying?

[dick]

I think I would download an evaluation version of UFS Explorer Pro on to a Windows computer and attempt to scan your image file for any partitions. I would have thought any partitions on the ssd would show even if the partitions contain encrypted data.

[Erik9999]

Thanks for the help! This program has a mac version also, but I have windows os aswell if that is better to use.

It was not in the list, but I added it by using "open storage". Only 0,01GB partition (the dmg file is 1tb). See attached image.

Anything I can do with this?

Attachments

Screenshot

[hddguy]

Can you view the content of the file with a hex editor to check that it looks OK in that it is populated with hex data? I guess it was encrypted with File-vault and its likely that the encrypted partition is not the first partition (generally it is the second of 3 partitions) and it wont be viewable in UFS this way, but assuming the encrypted partition is OK but partition information is bad, no host system will even know the partition exists. Can you view sector 1 and 2 in hex editor and see any useful data? Usually the second sector contains data about any partitions present including whether filevault is active on any.

[Erik9999]

Then content on this partition is flash player. I remember the data recovery company said something about trying to install flash on the ssd to make something apear. I guess I must have copied it after they gave up. In hex view it is pretty much 99% zeros.

[Erik9999]

It is 99% zeros. The partition is a flash player the data recovery company tried to install btw.

Is this what you where looking for?

Attachments

[Erik9999]

It is pretty much just zeros. except a few places like this:

Attachments

2

1

[dick]

Then content on this partition is flash player. I remember the data recovery company said something about trying to install flash on the ssd to make something apear. I guess I must have copied it after they gave up. In hex view it is pretty much 99% zeros.

I have to say that's crazy!
Have you scanned through the rest of the drive looking for traces of data? You would be looking for large blocks of hex in the hex editor.

[hddguy]

It is pretty much just zeros.

the entire image file is mostly zeros? If this is the case then your data is not recoverable as it is not written here. Also, partition tables is not correct and do not reflect the structure you would expect.

There is an interesting article about what you should see here: http://forensicsfromthesausagefactory.b ... apple.html

It is never good practice to write to the patient device during any recovery attempts, so I cannot see any real reason why this would have been or any real need for it. Also, this is not the result of installing an application this is a new logical partition created - maybe its possible this data was already present on the destination medium and the attempted image never actually transferred any content?

You said you no longer have the original SSD - is there no possibility to get it back?

[Erik9999]

Then content on this partition is flash player. I remember the data recovery company said something about trying to install flash on the ssd to make something apear. I guess I must have copied it after they gave up. In hex view it is pretty much 99% zeros.

I have to say that's crazy!
Have you scanned through the rest of the drive looking for traces of data? You would be looking for large blocks of hex in the hex editor.

I have scrolled through it it is just occationally small blocks of hex.

It is pretty much just zeros.

the entire image file is mostly zeros? If this is the case then your data is not recoverable as it is not written here. Also, partition tables is not correct and do not reflect the structure you would expect.

There is an interesting article about what you should see here: http://forensicsfromthesausagefactory.b ... apple.html

It is never good practice to write to the patient device during any recovery attempts, so I cannot see any real reason why this would have been or any real need for it. Also, this is not the result of installing an application this is a new logical partition created - maybe its possible this data was already present on the destination medium and the attempted image never actually transferred any content?

You said you no longer have the original SSD - is there no possibility to get it back?

Thanks for the article!

Not sure. All I was told was that they tried to install flash player on my ssd to see if something would apear or smth. I guess they created this partition.

I could allways try. I sent it back to crucial in exchange for a new ssd long time ago. I will send them a email and ask.

[data-medics]

Sounds to me that the data was T.R.I.M.ed out. Probably when the SSD failed it went nuts wiping all the data.

That having been said, it's not uncommon for an Apple drive to have the data spread out all across the entire drive, even if it's only 5% full. So it may look vary sparse and mostly like zeros, but you'll be surprised how much you find when you actually scan for data.

that tiny partition you see is just a system one. It's unnecessary. Most likely the data partition starts at sector 409640 or possibly 35520 but you won't be able to do much with R-Explorer since it can't work with FileVault. You'll probably have to rebuild the partition table manually so that MacOS or R-Studio actually thinks there's a filevault partition there and you have option to input a password.