data recovery encrypted hfs+ files system mac

[pcpete]

We had a drive from a failing mac computer come in. When we plugged the failing drive into our Mac workstation to see how it would respond, it prompted us to enter the password, but it said the password was invalid. We assumed this was because of the corruption. We then made a clone on our DDI machine, it took about a week to make an image of the drive with lots of bad sectors, over a million. When we plugged a clone of the cloned drive into our mac it let us unlock it with the password, but then it said we need to initialize the drive.

At this point I am not sure how to best handle encrypted drives like this. Our normal procedure is to run rstudio on the drive, but with the encryption I am not sure if it would work. I don't thing rstudio could do anything with this drive since i suspect it needs to access it directly. What methods do you guys recommend?

I ended up getting access to the files, which all that i have opened so far have not been corrupted. I ended up just running Disk Warrior on the clone of the clone.(after unlocking it) It repaired the drive, then it mounts normally.

On a side note, when you plug in a drive and apple prompts you to put in a password to unlock it, does the mean it is encrypted or just mean it is locked in some other way? I assumed encryption, but I am not totally sure that is correct

 

[DataMedics]

Glad you worked it out. Yes, if it prompts for a password then it's using filevault encryption. Once you put in the password, even if it fails to mount fully you can typically run data recovery software against the logical volume (not the physical) and it'll be analyzing decrypted data. DiskWarrior works well too as you already determined.

Your course of action was the right one.

R-Studio now also supports decrypting filevault in some cases, but not all.

 

[Markverhyden]

Did you make a copy of the clone before proceeding? Just to point out the obvious. To me a failing drive is not a valid image as it might keel over any moment. If, for some unfortunate reason, the DW repair trashed the drive you'd be faced with trying another clone without the backup clone.

Personally I consider DW to be a valid tool for repairing filesystem problems in OS X. So you're procedure was valid in my book as well. But I might have considered another intermediate step. Decrypting the drive first then running DW or some other tool. Doing any kind of recovery on an encrypted drive can be a problem so decryption is an important step.

At any rate congratulations! Hopefully you'll be able to up sell a backup system, emphasizing how close they came to disaster.

 

[pcpete]

Glad you worked it out. Yes, if it prompts for a password then it's using filevault encryption. Once you put in the password, even if it fails to mount fully you can typically run data recovery software against the logical volume (not the physical) and it'll be analyzing decrypted data. DiskWarrior works well too as you already determined.

Your course of action was the right one.

R-Studio now also supports decrypting filevault in some cases, but not all.

Thanks

 

[pcpete]

Did you make a copy of the clone before proceeding? Just to point out the obvious. To me a failing drive is not a valid image as it might keel over any moment. If, for some unfortunate reason, the DW repair trashed the drive you'd be faced with trying another clone without the backup clone.

I made a clone of the original clone after spending a week getting the bits, I would not risk them

 

[lcoughey]

Considering most techs these days would just hammer away at direct recovery from the client drive without a clone, you did a good job.

...it would have been better to send it to me, but this will do.

 

[pcpete]

But I might have considered another intermediate step. Decrypting the drive first then running DW or some other tool. Doing any kind of recovery on an encrypted drive can be a problem so decryption is an important step.

that is a good idea. I did look at disk util and r-clicked on drive and I did not see an option to decrypt. It must have been there somewhere

 

[Markverhyden]

that is a good idea. I did look at disk util and r-clicked on drive and I did not see an option to decrypt. It must have been there somewhere

It's not in Disk Utilities. If you boot from the drive go to System Preferences>Security and Privacy>File Vault>click on lock on lower right to unlock then turn off File Vault. If it's not the boot drive open a Finder window, making sure it shows up under Devices on the side bar. Then right click and you should see decrypt as an option.