PC-3000 Forum

I cloned the drive, but not perfect, it was encrypted by Mac FileVault, how do I decrypt it.
Thanks.
Phil
ps: I only have user password, not the recovery key.

connect clone over usb/firewire to the mac and it should mount and attempts to access it will prompt you for the password - once entered you will have access to the data

AJ,
thanks for your reply, it does not mount as the clone is not perfect.
What info I have to clone for mounting it?
Phil

Hello oldman,

In DE you can clone used space only on destination drive then connect it to Mac.

Hello Dmitriy,
Thanks for your reply.
I have made full clone, but there are bad sectors.
Nothing happen if I connect the cloned drive to Mac, as no partition info.
Where is the password for FileVault saved?

Thanks for your help.

Phil

Hello oldman,

We don't know where is FileVault password located.
Did you connect destination drive to Mac (where this file system was created)?

Hi Dmitriy,
Yes, I connect the cloned drive to original Mac.

Are there any better, stronger ways to make clone/read?
I can not read front sectors start from 0 to 409640, but the heads are good as reverse clone is perfect.

Thank.
Phil

What drive is it you have cloned? Maybe there are improved reading algorithms you can try to re-read bad blocks?

Yes, sotimes bad blocks can be caused by pending issue.

AJ and Dmitriy,
It is a Hitach apple drive,
5K750-500, HTS547550A9E384.
I can not read the first few sectors 0,1,2,
I seem to get the 409640, but not before, and after.

Thanks
Phil

Try Diskwarrior after connecting clone to Mac. See if it can see/repair the partition. If so, just move the data from the "preview" --> do not REPLACE the catalog file.

Hi 300ddr,
Thanks for your reply.
The drive was encrypted by filevault, do you think that diskwarrior can build it?
Best Regards.
Phil

It can repair FileVault (but depends on how damaged it is). Once you open DW, if it can see the volume it was ask for password.

Sorry to say, the vol can not been seen as I do not get the first 3 sectors.
If I get from other drive, but the password does not work out.

Thanks a lot.

Phil

Here's a thought for you. UFSExplorer Professional Recovery has the option to decrypt a partition using password. If I'm not mistaken original FileVault uses AES-CBC encryption, and FileVault 2 uses AES-XTS. Both of which are supported by the program. Might take a bit of playing with settings to get it right, but should work in theory.