Mac File Vault 2 Corrupted partition

[odedshankar]

Hi Folks,

I've got a drive with Mac File Vault 2 Corrupted partition, it sees the physical partition but wouldn't mount as File Vault 2 partition.
Is there a way to decrypt these type of partitions or through an external tool or the DE?
I tried the function of DE Map to decrypt a File vault partition and i have the right password, but DE doesn't recognise it for some reason as File Vault and not accepting my password as correct.

Any advise would be great,

Thanks

[odedshankar]

Just to add some more info, the drive didn't had any bad sectors. The Problem happened as a result of the user restarting in a middle of OS update and i am quite confident it was File Vault 2 Encryption.
I have th user password and the "EncryptedRoot.plist.wipekey" from the recovery partition.

[AJ2008]

Are you sure this is not running APFS following its update?

[odedshankar]

didn't think about that thanks. Its possible although i can see the "EncryptedRoot.plist.wipekey" file in the recovery partition, so i assumed it is encrypted.
Do you know of any tools that work with this new APFS file system?
And if the partition was encrypted with File Vault 2 an at update was upgraded to APFS, but since interrupted not completed?
Any tools that can deal with that? I am assuming DE does not support it yet?

Thanks

[AJ2008]

If you are using a Mac yourself, you can update it to sierra 10.13.2 it will update your OS to APFS and subsequently will add support. If the partition is damaged then it will not mount, you will need to mount it without verification from command prompt.

I have decrypted filevault from HFS+ and also from APFS, but I do not think I have ever had a filevault case which had been updated from HFS+ to APFS - I imagine it would be fine, but if the update did not complete I have no idea what this could do to the volume. (Any updates to 10.13.2 will automatically convert filesystem to APFS)

If you post here a screenshot of sector 409640 and 409642 I can tell you if it is APFS by the presence of a checksum there

[odedshankar]

thanks mate, will have a look tomorrow when I'm back to the office.
Sectors 409640 and 409642 - offset from start of disk or start of partition?

[AJ2008]

Ill send you a message at Skype now