All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 15 posts ] 
Author Message
 Post subject: FileVault Question
PostPosted: November 29th, 2017, 13:22 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
I have a MacBook Air SSD drive in that has some corruption. I did make a clone of the drive, but the 'customer' partition is not showing up on the Mac so we can't decrypt the data. I have tried to mount the partition in many of the usual software such as R-Studio, DataRescue, UFS etc but nothing sees it.

Good news is I have been able to access the drive back in the original MacBook Air via the recovery partition and Disk Utility to make .dmg images of most of his data which open up fine, but the client really wants one of the apps which I cannot make an image of in the recovery partition.

So.... and ideas on how I might be able to mount and decrypt the full FileVault partition?

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: November 29th, 2017, 13:33 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI
If you have a .dmg image of the user partition, just double click to mount it in MacOS.

Or am I missing something? Perhaps this is a case where the partition table was overwritten??? I know I've had to manually rebuild a few partition tables as of late for filevault encrypted drives with lost partition tables, since no software I've found can correctly detect the beginning/ending of an encrypted volume.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Last edited by data-medics on November 29th, 2017, 13:36, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: November 29th, 2017, 13:34 
Offline

Joined: January 8th, 2008, 5:21
Posts: 925
Location: uk
Have you tried Diskwarrior?
https://www.alsoft.com/DiskWarrior/index.html


Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: November 29th, 2017, 13:42 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
data-medics wrote:
If you have a .dmg image of the user partition, just double click to mount it in MacOS.

Or am I missing something? Perhaps this is a case where the partition table was overwritten??? I know I've had to manually rebuild a few partition tables as of late for filevault encrypted drives with lost partition tables, since no software I've found can correctly detect the beginning/ending of an encrypted volume.

Good question. I couldn't get a good image of the use partition as its keeps saying its corrupt when trying to mount it, but I did get smaller images of docs, pics, downloads etc.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: November 29th, 2017, 13:43 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
dick wrote:

Must admit I have never tries it. I will give it a go and report back.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: November 29th, 2017, 14:02 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI
If the partition table is correctly pointing to the encrypted partition, then R-Studio should be able to see it and decrypt it.

Unless of course, it's APFS formatted instead of HFS+, in which case you're probably in trouble. R-Explorer can work with APFS, but can't handle Filevault. R-Studio can handle Filevault, but not APFS. If only the two companies would agree to share notes and work together.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: November 29th, 2017, 14:05 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
data-medics wrote:
If the partition table is correctly pointing to the encrypted partition, then R-Studio should be able to see it and decrypt it.

Unless of course, it's APFS formatted instead of HFS+, in which case you're probably in trouble. R-Explorer can work with APFS, but can't handle Filevault. R-Studio can handle Filevault, but not APFS. If only the two companies would agree to share notes and work together.

Sorry I did forget to mention that. Its is APFS.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: November 29th, 2017, 14:43 
Offline

Joined: January 8th, 2008, 5:21
Posts: 925
Location: uk
Quote:
Sorry I did forget to mention that. Its is APFS.
You are out of luck with Diskwarrior....for the moment anyway.
They don't support APFS yet.


Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: November 29th, 2017, 14:45 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
Thanks for the advice guys.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: November 30th, 2017, 4:56 
Offline

Joined: March 7th, 2009, 12:43
Posts: 1080
Location: Angel Data Recovery
Couple of options:
1)Open image under R-studio , make FileVault decryption ( you wont get access to APFS)
Use that decrypted image under Recovery Explorer (R-explorer) to access APFS, scan it for lost files and folders.
2) Download R-eplorer for Mac and use it under original MacBook air, scan it.

_________________
Angel Data Recovery


Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: November 30th, 2017, 15:33 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
DR-Kiev wrote:
Couple of options:
1)Open image under R-studio , make FileVault decryption ( you wont get access to APFS)
Use that decrypted image under Recovery Explorer (R-explorer) to access APFS, scan it for lost files and folders.

Unfortunately R-Studio does not see the image as encrypted so the first option does not work.

Quote:
2) Download R-eplorer for Mac and use it under original MacBook air, scan it.

R-Explorer for Mac sees the APFS file system and splits that down into the 3 folders (right side of screen). The main folder (Macintosh HD) is not accessible due to the encryption. I thought about making an image of that partition and go back into R-Studio, but as far as I can tell R-Explorer does not allow you to make an image from folders in the right side screen.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: December 2nd, 2017, 17:40 
Offline

Joined: December 5th, 2011, 5:38
Posts: 1626
Location: Italy
Read my post, maybe it will help you:
https://forum.hddguru.com/viewtopic.php ... 89#p249089

I solved a case where data was encrypted by FileVault, by reading this:
https://derflounder.wordpress.com/2011/ ... oot-drive/

P.S.
i don't remember if partition was HFS+ or APFS

_________________
My firmware database:
https://mega.nz/folder/O01DkBRI#MxP2J6ZNqXDcrX40I8MoQQ


Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: December 2nd, 2017, 18:26 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
michael chiklis wrote:
Read my post, maybe it will help you:
https://forum.hddguru.com/viewtopic.php ... 89#p249089

I solved a case where data was encrypted by FileVault, by reading this:
https://derflounder.wordpress.com/2011/ ... oot-drive/

P.S.
i don't remember if partition was HFS+ or APFS

Thanks, but this did not work. I think because its APFS we are getting the same errors as above.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: December 2nd, 2017, 20:26 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3561
Location: Chicago
APFS does not use the FileVault-2, it is completely new, built-in to the APFS core encryption.

If that partition is not showing up on Mac OS High Sierra(currently the only OS that supports encrypted APFS volumes) then you kinda screwed, because I think there are no tools to work with encrypted APFS yet.

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.


Top
 Profile  
 
 Post subject: Re: FileVault Question
PostPosted: February 2nd, 2018, 20:32 
Offline

Joined: February 2nd, 2018, 20:26
Posts: 2
Location: United States
Hi guys,

Have had similar issues and did not have a decent way to access user data due to APFS. However, we have found iBoySoft to give support where the typical solutions have failed. It gave us full APFS support on a logically damaged SSD from a High Sierra update.

`Regards


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 15 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 73 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group