FileVault WipeKey not found

Data recovery from Hard Disk Drives with logical problems

Moderator: Nick_TS


recovery
Newbie
Posts: 19
Joined: 14.01.16
Reputation: 2 / (15)

FileVault WipeKey not found

Postby recovery » 24.10.17, 10:50

Hello,

I made a copy of a SSD from an APPLE Mac with 650 bad sectors. Some of them at the start of the encrypted partition with FileVault. DataExtractor didn't understand it's a FileVault kernel. I tried to fix the partition with APPLE tools. Now, the first sectors of FileVault partition seems OK and DataExtractor know it's a FileVault kernel.

I don't find the EncryptedRoot.plist.wipekey in the recovery partition. I tried to Scan the Catalog, I tried to scan the partition, and I show the deleted files in DataExtractor. I didn't find the file. Is it possible to find it with raw recovery? Do you know the header or footer of the file?


lcoughey
User
Posts: 231
Joined: 12.01.12
Reputation: 10 / (97)

Re: FileVault WipeKey not found

Postby lcoughey » 25.10.17, 16:51

Go back and try to clean up the 650 unread sectors. You may find you have better luck with file vault when connecting the clone to a mac or using R-Studio.


Return to “Data Extractor”

Who is online

Users browsing this forum: No registered users and 19 guests