All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 5 posts ] 
Author Message
 Post subject: Issue with corrupted user account from ciphered MacBook SSD
PostPosted: December 4th, 2015, 10:13 
Offline

Joined: July 7th, 2014, 6:44
Posts: 192
Location: Switzerland
Hi,

I have here an SSD coming from a MacBook Air (year 2014 or so), with about 22 Kb of bad blocks.
I cloned the SSD to a mechanical drive.

I have put this drive in a 13'' MacBook Pro A1278 from 2008 as well as in a 15'' MacBook Pro A1286 from 2010.

In both cases, OS X loads itself and I can see two user accounts.
For one of these accounts, I do have the password.
After entering the password, according to the progression bar, about 25% of the user profile loads, but the laptop suddenly shuts down. The behaviour is the same with both laptops and similar to the one that has been described to me by the customer using the original SSD in the MacBook Air.

I also tried to put the original SSD in an USB 3.0 enclosure from OWC.
The disk manager detects the physical drive, as well as the partition, which appears in grey characters.
But the drive does not appear on the desktop, like it could not be mounted.

Using the clone, I tried verifying and repairing the file system by using the utilities available when booting the MacBook Pro in recovery mode. The file system was reported as being healthy.

So, what could I do now?
Should I ask the password from the other user account and then try to gain root privileges?

N.B.: Using traditional data recovery software is not a solution because the drive is ciphered.


Top
 Profile  
 
 Post subject: Re: Issue with corrupted user account from ciphered MacBook
PostPosted: December 4th, 2015, 13:53 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal
Gain root, I've solved a similar issue using Disk Warrior after many recovery softwares failed on a macbook encripted hdd.

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/


Top
 Profile  
 
 Post subject: Re: Issue with corrupted user account from ciphered MacBook
PostPosted: December 4th, 2015, 14:10 
Offline

Joined: January 8th, 2008, 5:21
Posts: 925
Location: uk
You might want to make a second clone copy to a file of the 'mechanical' drive. That way you can quickly go back to the beginning and try something else.
I think I would set up a Mac with a healthy bootable OSX.
I would connect the cloned mechanical device by usb.
First option-I would run Diskwarrior v5 from the Mac desktop and see if it can find/mount/repair the partitions.

Second option-I have seen your described behaviour before and managed to correct it by repairing the system using the correct install media on bootable usb. In my case it was Yosemite.


Top
 Profile  
 
 Post subject: Re: Issue with corrupted user account from ciphered MacBook
PostPosted: December 19th, 2015, 9:50 
Offline

Joined: July 7th, 2014, 6:44
Posts: 192
Location: Switzerland
Thank you for the useful replies.

I did several clones of the drive to mechanical hard drives.

Then, I tried a network reinstall of OS X, as it seem possible to repair/replace the system files while keeping the user data.

Despite the defective sectors, I hoped the system could reinstall itself by writing to remaining healthy memory cells, but unfortunately the drive has about 240 Mb of defective sectors and the reinstall failed.

So, I cloned the SSD again to a healthy 500GB mechanical drive, removed the SSD from the MacBook air, and booted on the external mechanical drive. The reinstall failed too.

In the disk utility, I can see three discs and volumes :
1) "Macintosh HD > Macintosh HD"
2) "disk2 > OS X Install ESD"
3) disk3 > OS X Base system

I tried verifying the "Macintosh HD" disk, as well as its permissions.
(I verified also other volumes, which are healthy.)

Verifying permissions of "Macintosh HD" showed several errors:
- Different permissions for several subfolders of /usr/libexec/cups
expected drwxr-xr-x, currently dr-xr-xr-x
- Opening error 22 : "Invalid argument" on usr/libexec/efiupdater
- Opening error 22 : "Invalid argument" on usr/libexec/smcupdater
- Different permissions for several folders:
-- Applications/Safari.app/Con...index.html
-- Library/Printers/(and subfolders)
expected lrwxr-xr-x or drwxr-xr-x, currently -rw-r--r-- or dr-xr-xr-x
- Different groups for several folders : Library/Printers/..., Library/Java, Library/Preferences...
expected 80, currently 0
The "Repair disk permissions" button remains disabled.

When veryfing the disk, the strings (here translated in English) are:
Quote:
(...)
The volume (here the GUID) appears to be OK.
The exit code from checking the storage system is 0.
Checking the file system.
Checking the HFS Plus journaled file system.
Checking the excess block system.
Checking catalogue file.
Invalid node structure.
The volume Macintosh HD could not be fully verified.

The exit code from checking the file system is 8.
Error: This disk must be repaired. Click on "Repair disk".

Unfortunately the "Repair disk" button remains disabled.

Maybe I cannot repair because the drive is mounted and I'll try again repairing by connecting it to another MacBook.

If this doesn't work, I hope I can change permissions or ownership with commands like chmod and chown.

Concerning DiskWarrior, I did not try it but seems nice from what I read.
Does anyone knows if it uses file system and permission verification algorithms from Mac OS (for instance through libraries) or does it brings different independent algorithms?

Thanks.


Top
 Profile  
 
 Post subject: Re: Issue with corrupted user account from ciphered MacBook
PostPosted: December 19th, 2015, 10:01 
Offline

Joined: July 7th, 2014, 6:44
Posts: 192
Location: Switzerland
Just connected the mechanical clone as external drive to a Mac running OS X El Capitan.

I could enter the password and see the files! :D

It is important that the Mac uses the same or a or newer OS X version that the drive from which you're trying to access the data.

Mac OS mentionned that the file system could not be repaired, but this is of secondary importance.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 5 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 16 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group