how to recover mac filevault encryption

[oldman]

I cloned the drive, but not perfect, it was encrypted by Mac FileVault, how do I decrypt it.
Thanks.
Phil
ps: I only have user password, not the recovery key.

[AJ2008]

connect clone over usb/firewire to the mac and it should mount and attempts to access it will prompt you for the password - once entered you will have access to the data

[oldman]

AJ,
thanks for your reply, it does not mount as the clone is not perfect.
What info I have to clone for mounting it?
Phil

[Nick_TS]

Hello oldman,

In DE you can clone used space only on destination drive then connect it to Mac.

[oldman]

Hello Dmitriy,
Thanks for your reply.
I have made full clone, but there are bad sectors.
Nothing happen if I connect the cloned drive to Mac, as no partition info.
Where is the password for FileVault saved?

Thanks for your help.

Phil

[Nick_TS]

Hello oldman,

We don't know where is FileVault password located.
Did you connect destination drive to Mac (where this file system was created)?

[oldman]

Hi Dmitriy,
Yes, I connect the cloned drive to original Mac.

Are there any better, stronger ways to make clone/read?
I can not read front sectors start from 0 to 409640, but the heads are good as reverse clone is perfect.

Thank.
Phil

[AJ2008]

What drive is it you have cloned? Maybe there are improved reading algorithms you can try to re-read bad blocks?

[Nick_TS]

Yes, sotimes bad blocks can be caused by pending issue.

[oldman]

AJ and Dmitriy,
It is a Hitach apple drive,
5K750-500, HTS547550A9E384.
I can not read the first few sectors 0,1,2,
I seem to get the 409640, but not before, and after.

Thanks
Phil

[300ddr]

Try Diskwarrior after connecting clone to Mac. See if it can see/repair the partition. If so, just move the data from the "preview" --> do not REPLACE the catalog file.

[oldman]

Hi 300ddr,
Thanks for your reply.
The drive was encrypted by filevault, do you think that diskwarrior can build it?
Best Regards.
Phil

[300ddr]

It can repair FileVault (but depends on how damaged it is). Once you open DW, if it can see the volume it was ask for password.

[oldman]

Sorry to say, the vol can not been seen as I do not get the first 3 sectors.
If I get from other drive, but the password does not work out.

Thanks a lot.

Phil

[DataMedics]

Here's a thought for you. UFSExplorer Professional Recovery has the option to decrypt a partition using password. If I'm not mistaken original FileVault uses AES-CBC encryption, and FileVault 2 uses AES-XTS. Both of which are supported by the program. Might take a bit of playing with settings to get it right, but should work in theory.