Mac drive appears as "Virtual Whole Disk" in Disk Utility...

[bcometa]

Backstory: Drive arrived not spinning. Opened drive in clean room, carefully moved heads off the platters. Next problem was firmware corruption, it spun, but no sectors were readable. I was able to get around this using DE's "solve glist corruption" feature. The drive still had some platter damage but in total we imaged about 99.9% of all the sectors.


Current/main problem: After connecting clone to a Mac, it appears in Disk Utility with red text as "Virtual Whole Disk." The drive cannot mount and no data can be recovered from it.


Further Details:
* A raw scan for data in the drive indicates that it's encrypted (as no raw files can be recovered and the drive is pretty full). Client doesn't remember turning on FileVault, but seems to be the case and admits he's not computer savvy.

* The drive doesn't appear in DiskWarrior 4, but does appear in DiskWarrior 5. DW5 has an option to "unlock" the drive (further indication it's encrypted with FileVault) however none of the 6 potential passwords customer supplied are working to unlock it (error code 2).

* I don't believe customer had a Fusion Drive setup because he said Apple replaced this bad drive with a single 1TB drive (at first I thought problem may have been related to a missing Fusion drive).

This is the result from trying "Repair Disk" in DU

Code:

Verifying and repairing partition map for “ST1000DM 003-1CH162 Media”

Checking prerequisites
   
Checking the partition list

Adjusting partition map to fit whole disk as required

Checking for an EFI system partition

Checking the EFI system partition’s size

Checking the EFI system partition’s file system

Checking the EFI system partition’s folder content

Checking all HFS data partition loader spaces

Checking booter partitions

Checking booter partition disk1s3

Updating boot support partitions for the volume as required.

Reviewing boot support loaders

Checking Core Storage Physical Volume partitions

Verifying storage system

Checking volumedisk1s2: Scan for Volume Headers

Invalid Volume Header @ 749296614912: invalid field value

disk1s2: Scan for Disk Labels

Invalid Disk Label @ 749279834112: invalid field value

Invalid Disk Label @ 749284028416: invalid field value

Invalid Disk Label @ 749288222720: invalid field value

Invalid Disk Label @ 749292417024: invalid field value

disk1s2 is not a CoreStorage volume

Storage system check exit code is 1.

Repairing storage system

Checking volumedisk1s2: Scan for Volume Headers

Invalid Volume Header @ 749296614912: invalid field value

disk1s2: Scan for Disk Labels

Invalid Disk Label @ 749279834112: invalid field value

Invalid Disk Label @ 749284028416: invalid field value

Invalid Disk Label @ 749288222720: invalid field value

Invalid Disk Label @ 749292417024: invalid field value

disk1s2 is not a CoreStorage volumeStorage system check exit code is 1.

Repairing storage system

Checking volumedisk1s2: Scan for Volume Headers

Invalid Volume Header @ 749296614912: invalid field value

disk1s2: Scan for Disk Labels

Invalid Disk Label @ 749279834112: invalid field value

Invalid Disk Label @ 749284028416: invalid field value

Invalid Disk Label @ 749288222720: invalid field value

Invalid Disk Label @ 749292417024: invalid field value

disk1s2 is not a CoreStorage volume

Storage system check exit code is 1.

Problems were encountered during repair of the partition map

Error: This disk needs to be repaired. Click Repair Disk.

--

Here are results from "diskutil list" in Terminal:

Code:

  /dev/disk1
 
     #:                       TYPE NAME                    SIZE       IDENTIFIER
 
     0:      GUID_partition_scheme                        *750.2 GB   disk1
 
     1:                        EFI                         209.7 MB   disk1s1
   
     2:          Apple_CoreStorage                         749.3 GB   disk1s2
   
     3:                 Apple_Boot                         650.0 MB   disk1s3


Results from "diskutil cs list" in Terminal:

Code:

   CoreStorage logical volume groups (1 found)
   
     |
   
     +-- Logical Volume Group C256C4F4-D16B-441C-B595-FA047A1AA3CF
       
     =========================================================
       
     Name:         -none-
       
     Status:       Initializing
       
     Size:         0 B (0 B)
       
     Free Space:   -none-
       
     |
       
      +-< Physical Volume C9FE8139-8416-4EF1-A158-E9B27C4D5138
           
     ----------------------------------------------------
           
      Index:    18446744073709551615
           
      Disk:     disk1s2
           
      Status:   Failed
           
      Size:     -none-


---------

All of this is quite a bit over my head and is not a problem I'm at all familiar with. Anyone out there have any ideas how to get this drive repaired enough to enter the password and get the drive mounted?

Much appreciated,
Brian

[labtech]

What hardware product does the original drive come from? And what is the original drive?

Were any of the bad sectors located in the beginning of the drive?

How did you enter the password?

[CK]

Sounds like a lot of hassle for $300!

It does sounds like FileVault though. Did you get the original Mac from the customer or can you get it? I had a fusion-drive recently where the customer had re-installed O/S and as a result, our recovery of the drive they submitted was a complete waste of time.

If you have a Mac, run diskutil cs list

If encrypted, you'll see something like:

Logical Volume Family UUID1.2
| ----------------------------------------------------------
| Sequence: 8
| Encryption Status: Unlocked
| Encryption Type: AES-XTS
| Encryption Context: Present
| Conversion Status: Complete
| Has Encrypted Extents: Yes
| Conversion Direction: -none-
| |
| +-> Logical Volume UUID1.2.1
| ---------------------------------------------------
| Disk: disk1
| Status: Online
| Sequence: 4
| Size (Total): 498929332224 B (498.9 GB)
| Size (Converted): -none-
| Revertible: Yes (unlock and decryption required)
| LV Name: OSX
| Volume Name: OSX
| Content Hint: Apple_HFS

[bcometa]

Hi CK -- I'm mainly hoping to learn from this one, the time it's taken this far is already too long You can see results from diskutil cs list above (it's not very informative). We don't have original computer, but it's a laptop drive and I'm not sure any Apple laptops have fusion drives.

Hi labtech -- it's a MK7559GSXF from a macbook or macbook pro. Yes, it had bad sectors, but not in the beginning of the drive. They were all at least 5% in. The only option I found to enter password was by using DiskWarrior 5's "unlock" command (so at least DW recognized it as locked/encrypted).

Thanks for your help fellas!
Brian

[dick]

Hi! I am a bit confused.........
In the first post we have

Verifying and repairing partition map for “ST1000DM 003-1CH162 Media”

Of course now we know it is a 750gb Toshiba laptop drive.

however none of the 6 potential passwords customer supplied are working to unlock it

Only 6! I think you have probably done everything right and the customer is wasting your time.
Customers are often liars or idiots or both.

[bcometa]

It was original Toshiba, but we cloned the original drive to a Seagate.

Customers are often liars or idiots or both.

Certainly can't argue with that