iMac not booting

[Big Jim]

2019 iMac with a 500GB WD Blue SA510 SSD in it.
customer had an issue with crashing/freezing then "something" happened and the customer followed instructions online and now it is booting to a flashing folder icon.
Before carrying out any work we have cloned both the internal drive and the time machine drive using macrium (although macrium can't see the partitions it does appear to clone mac drives just fine in our experience)

however in this case both clones are not mountable/readable in another mac or linux machine.

the original time machine drive is a 2TB WD Elements portable, relatively new and not making any weird noises, I was able to browse it on another mac and although it showed 400GB used space the user folder was empty.
I then booted the customers machine from it and rather than going to a recovery menu like I have seen in the past it booted to mac setup (as if it were a new machine) once the setup was done (no data transfer option selected) it booted to mac OS but only finder would load all icons along the bottom bar were "?"

I rebooted the machine as it was not usable and now the mac shows the circle with a line through it when I attempt to boot from the time machine drive again.
Also the drive will not show up on another mac at all now (even in disk utility), when I attempted to reboot our mac with the time machine drive attached it stuck on black screen until I unplugged it.

As this is an iMac i haven't opened it up yet to remove the internal drive to check it, wanting to see what other options we have before we do that.

 

[Markverhyden]

You can't boot from a TM volume. You have to boot into recovery mode then select restore from TM backup. Or you can browse the TM volume if hooked up to another functioning Mac. If you have a functioning Mac with. an OS version similar to the patient I'd create a bootable live OS on a USB stick, boot from that to snoop around. I'd also boot from Apple Diag to check things out as well. And I wouldn't count on the Macrium images to be usable.

Use Apple Diagnostics to test your Mac - Apple Support

Apple Diagnostics, formerly known as Apple Hardware Test, can check your Mac for hardware issues.

support.apple.com

 

[Big Jim]

You can't boot from a TM volume. You have to boot into recovery mode then select restore from TM backup. Or you can browse the TM volume if hooked up to another functioning Mac. If you have a functioning Mac with. an OS version similar to the patient I'd create a bootable live OS on a USB stick, boot from that to snoop around. I'd also boot from Apple Diag to check things out as well. And I wouldn't count on the Macrium images to be usable.

Use Apple Diagnostics to test your Mac - Apple Support

Apple Diagnostics, formerly known as Apple Hardware Test, can check your Mac for hardware issues.

support.apple.com

Currently the TM drive is showing as unreadable in pretty much every machine I've tested it in.
The clone of it is being scanned with data recovery software as the software can at least see the TM partition.

I already created a bootable OS on a USB with Catalina (the shipped OS) as I didn't know until speaking to the customer later on that he had recently upgraded to Sonoma and as the TM drive can't be read any more it we can't poke around it anyway, however, when it was "browsable" it was showing no data in the user folder. The internal drive doesn't show the normal Apple OS/Data partition either.

I'll Give Sonoma a try on a USB tomorrow and see if that yields any different results.

 

[Markverhyden]

Remember that this may have File Vault in the mix. What are you using for data recovery? R-Studio does have the ability to mount a FV enabled drive.

 

[overburnz]

@Big Jim If the internal drive is a Fusion Drive it could be that one of the disks is damaged or for some reason the FD has been corrupted, if that is the case forget about recovering anything, regarding the time machine disk, have you tried on a macOS Sonoma liveOS? Does it show?

 

[Big Jim]

@Markverhyden does file vault encypt the entire drive like bitlocker ? how would you know if file vault was active ?
We were able to browse the contents of the drive but the user folder was empty.

I am using R-Studio but its currently frozen up, I'll leave it for a little while and see if anything changes.

It's not a fusion drive, its a WD Blue SSD (was upgraded by an AARC around 12 - 18 months ago)

I'm going to try Sonoma on a USB stick today and see what happens.

FYI, since I started this we have logged into the customers icloud account and it appears everything is in there so at this stage its more curiosity than requirement.

 

[Markverhyden]

@Big Jim, yes FV operates like BL and other FDE options. In macOS it typically gets activated a couple of different ways. First it's offered as an options during the OS's first run. It can also be turned on after first run by going into Settings>Security (varies based on OS version). When used in a mac OS environment it'll show up as a unmounted drive/partition in Disk Utility. When you mount it you'll be prompted to input the password. Which brings me to the next question. When attached to a macOS device what does Disk Utility show? But it's good they're using iCloud since it sounds like the drive is most toast.

 

[Big Jim]

In that case FV was not active as R Studio has recovered the RAW files. (it can't seem to recover from the active partition)

Both Sonoma and Ventura will not load from USB stick, the apple logo shows with loading bar underneath, it gets part way across then reboots .

I think its time to call it a day with this one.