PC-3000 Forum

Hello,

I made a copy of a SSD from an APPLE Mac with 650 bad sectors. Some of them at the start of the encrypted partition with FileVault. DataExtractor didn't understand it's a FileVault kernel. I tried to fix the partition with APPLE tools. Now, the first sectors of FileVault partition seems OK and DataExtractor know it's a FileVault kernel.

I don't find the EncryptedRoot.plist.wipekey in the recovery partition. I tried to Scan the Catalog, I tried to scan the partition, and I show the deleted files in DataExtractor. I didn't find the file. Is it possible to find it with raw recovery? Do you know the header or footer of the file?

Go back and try to clean up the 650 unread sectors. You may find you have better luck with file vault when connecting the clone to a mac or using R-Studio.