I have a MacBook Air SSD drive in that has some corruption. I did make a clone of the drive, but the 'customer' partition is not showing up on the Mac so we can't decrypt the data. I have tried to mount the partition in many of the usual software such as R-Studio, DataRescue, UFS etc but nothing sees it.

Good news is I have been able to access the drive back in the original MacBook Air via the recovery partition and Disk Utility to make .dmg images of most of his data which open up fine, but the client really wants one of the apps which I cannot make an image of in the recovery partition.

So.... and ideas on how I might be able to mount and decrypt the full FileVault partition?

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

If you have a .dmg image of the user partition, just double click to mount it in MacOS.

Or am I missing something? Perhaps this is a case where the partition table was overwritten??? I know I've had to manually rebuild a few partition tables as of late for filevault encrypted drives with lost partition tables, since no software I've found can correctly detect the beginning/ending of an encrypted volume.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company

Have you tried Diskwarrior?
https://www.alsoft.com/DiskWarrior/index.html

Good question. I couldn't get a good image of the use partition as its keeps saying its corrupt when trying to mount it, but I did get smaller images of docs, pics, downloads etc.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

Must admit I have never tries it. I will give it a go and report back.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

If the partition table is correctly pointing to the encrypted partition, then R-Studio should be able to see it and decrypt it.

Unless of course, it's APFS formatted instead of HFS+, in which case you're probably in trouble. R-Explorer can work with APFS, but can't handle Filevault. R-Studio can handle Filevault, but not APFS. If only the two companies would agree to share notes and work together.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company

Sorry I did forget to mention that. Its is APFS.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

You are out of luck with Diskwarrior....for the moment anyway.
They don't support APFS yet.

Thanks for the advice guys.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

Couple of options:
1)Open image under R-studio , make FileVault decryption ( you wont get access to APFS)
Use that decrypted image under Recovery Explorer (R-explorer) to access APFS, scan it for lost files and folders.
2) Download R-eplorer for Mac and use it under original MacBook air, scan it.

_________________
Angel Data Recovery

Unfortunately R-Studio does not see the image as encrypted so the first option does not work.


R-Explorer for Mac sees the APFS file system and splits that down into the 3 folders (right side of screen). The main folder (Macintosh HD) is not accessible due to the encryption. I thought about making an image of that partition and go back into R-Studio, but as far as I can tell R-Explorer does not allow you to make an image from folders in the right side screen.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

Read my post, maybe it will help you:
https://forum.hddguru.com/viewtopic.php ... 89#p249089

I solved a case where data was encrypted by FileVault, by reading this:
https://derflounder.wordpress.com/2011/ ... oot-drive/

P.S.
i don't remember if partition was HFS+ or APFS

_________________
My firmware database:
https://mega.nz/folder/O01DkBRI

Thanks, but this did not work. I think because its APFS we are getting the same errors as above.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

APFS does not use the FileVault-2, it is completely new, built-in to the APFS core encryption.

If that partition is not showing up on Mac OS High Sierra(currently the only OS that supports encrypted APFS volumes) then you kinda screwed, because I think there are no tools to work with encrypted APFS yet.

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.

Hi guys,

Have had similar issues and did not have a decent way to access user data due to APFS. However, we have found iBoySoft to give support where the typical solutions have failed. It gave us full APFS support on a logically damaged SSD from a High Sierra update.

`Regards