Encrypted HFS+ Partial Clone Recovery Options?

[kpeddie]

Mac drive in a bad way, significant problems reading the first third of one of the surfaces, most of the rest is readable and the other surfaces are fine. Have cloned it onto another drive, all ready to get data back but nowt found. Nothing in RAW other than the usual rubbish it misidentifies.

Looking at the clone in hex, it looks like its encrypted. I dont think there are many options to be honest but thought it worth an ask. Anyone have any options for recovering data. Its not identified by a mac as a drive, there are sizeable bits missing from the clone bear in mind.

[Amarbir[CDR-Labs]]

Mac drive in a bad way, significant problems reading the first third of one of the surfaces, most of the rest is readable and the other surfaces are fine. Have cloned it onto another drive, all ready to get data back but nowt found. Nothing in RAW other than the usual rubbish it misidentifies.

Looking at the clone in hex, it looks like its encrypted. I dont think there are many options to be honest but thought it worth an ask. Anyone have any options for recovering data. Its not identified by a mac as a drive, there are sizeable bits missing from the clone bear in mind.

Well,
PCImage Would Do a Damn Good Job ,Contact Him On The Forums

[MindMergepk]

+1 for Pcimage, highly recommeded.

BTW, what was the problem with original disk ?
what tools you use to clone the disk ?
what type of encryption is there, did you figure it out ?
have you enable Filevault ?

[H13]

Hi ,
you have to clone the Hdd first to healthy drive ... then you can see the files only when you connect the cloned drive to the original mac device ..

[DR-Kiev]

Mac drive in a bad way, significant problems reading the first third of one of the surfaces, most of the rest is readable and the other surfaces are fine. Have cloned it onto another drive, all ready to get data back but nowt found. Nothing in RAW other than the usual rubbish it misidentifies.

Looking at the clone in hex, it looks like its encrypted. I dont think there are many options to be honest but thought it worth an ask. Anyone have any options for recovering data. Its not identified by a mac as a drive, there are sizeable bits missing from the clone bear in mind.

Nothing really complicated. Use same version of Mac OS , use FileVault encryption settings and encrypt dummy drive with exactly same passphrase . Combine 1st part of dummy drive with your 2nd part patient image.
Decrypt this combined image under your Mac with same passphrase , make clone of fully decrypted drive, than use data recovery software like R-studio to restore files stored on 2nd part and been already decrypted.

[kpeddie]

Thought about that but wasnt sure how macos would react to decrypting a buggered partition, worth a go i suppose!

[jermy]

as long as you use a clone drive what can you lose ?

[kpeddie]

More of my time? Sanity? Will to live? But as long as the customers happy...

[kpeddie]

Well I have to admit I didn't think that would work, but it did! Happy days! Even had lots of fun in VMWare trying it. Thank you for getting me to give it a go!