how to recover mac filevault encryption

[Nick_TS]

Hello,

Developers are researching FileVault now. I hope it will be supported in near future.

[DataMedics]

Yes, would definitely be nice to be able to decrypt and target needed data on the fly as we can with WD encrypted drives. Keep up the good work!

[300ddr]

Noooiiccee!

[ThomasH]

Dumb question: Any extra features including filevault decryption will require the user knowing the password, right?

[DataMedics]

Source of the post Dumb question: Any extra features including filevault decryption will require the user knowing the password, right?

I think that goes without saying. At least until Ace gets into the business of selling us quantum computers.

[ThomasH]

DE Filevault decryption feature works pretty well. I'm not sure if it's noted elsewhere, but you MUST be sure to not start the DE project with 4k sectors allowed, or decryption won't initiate properly. All must be set to 512b sectors. Also, it doesn't seem possible to select a list of files and clone that selection linearly like would normally be possible, so I guess it's best just to 'save' directly, which has its limits. I wonder if this is something that might be enabled in the future, or if it's not really possible using this technique.

[300ddr]

Also, it doesn't seem possible to select a list of files and clone that selection linearly like would normally be possible, so I guess it's best just to 'save' directly, which has its limits

After selecting files, did you try making a submap based on drive info (or legend)? Sometimes after doing this several times, you can image by files. Seems like a bug.

[Nick_TS]

Source of the post After selecting files, did you try making a submap based on drive info (or legend)? Sometimes after doing this several times, you can image by files. Seems like a bug.

Hello Brian,

It's not bug, but it's feature

When you decrypt FV partition, Data Extractor builds virtual partition and files 'located' in this virtual partition, to read map of these files you have to create submap using drive info to get 'real sectors' of 'virtual' files.
This feature deals with additional virtulization level, when we work with FileVault and BitLocker.

[300ddr]

Got it! Thanks!

[markrocketrepairs]

Hi guys
This is my first post and apologise if this has been answered somewhere.

I have recently upgraded to the PC3000 Express v6.3.18 with the Data Extractor v5.6.8

I would like to know step by step how to get data from a Apple FileVault encrypted drive if we have the password to unlock it.

I have looked through the menus in the Data Extractor software and the context menus when you right click on the encrpypted drive/partition but I can't seem to find anywhere to type in the password to unlock/mount the drive to get at the data.

Please help!

Thanks in advance
Mark

[AJ2008]

right click on encrypted partition in file explorer
Select 'Map'
Once map is opened, select from the actions drop down menu at the toolbar 'Add Virtual Drive' -> 'Add virtual Drive Encrypted'.
Assuming you mapped the correct encrypted partition, it should identify as FileVault and you can enter any credentials needed.

On a second note, I am not sure if the DE can decrypt fileVault from APFS volumes, so it may only work if you have HFS+ volume.

[markrocketrepairs]

Excellent AJ2008
I have tried it and it works with HFS/HFS+, my current version of DE does not read APFS at all encrypted or otherwise

Thanks

[Amarbir[CDR-Labs]]

Source of the post Hi guys
This is my first post and apologise if this has been answered somewhere.

I have recently upgraded to the PC3000 Express v6.3.18 with the Data Extractor v5.6.8

I would like to know step by step how to get data from a Apple FileVault encrypted drive if we have the password to unlock it.

I have looked through the menus in the Data Extractor software and the context menus when you right click on the encrpypted drive/partition but I can't seem to find anywhere to type in the password to unlock/mount the drive to get at the data.

Please help!

Thanks in advance
Mark

Mark,
i never knew they had 6.3.18 i have 6.3.16 can you recheck

[Amarbir[CDR-Labs]]

Source of the post Excellent AJ2008
I have tried it and it works with HFS/HFS+, my current version of DE does not read APFS at all encrypted or otherwise

Thanks

Well,
This i how i solved non encrypting APFS .I had a guy give me a apple macbook air for data recovery .I inserted the ssd i took out from it into another apple macbook air and used a linux based tool to clone internal drive to a external hdd .Then i connected external hdd to a high sierra os laptop and voila i was lucky it was not encrypted but if it was this method will still work

[Nick_TS]

Source of the post i never knew they had 6.3.18 i have 6.3.16 can you recheck

6.4.16 version is actual version now. Please use it for FileVault.

Source of the post This i how i solved non encrypting APFS .I had a guy give me a apple macbook air for data recovery .I inserted the sad i took out from it into another apple macbook air and used a linux based tool to clone internal drive to a external hdd .Then i connected external hdd to a high sierra os laptop and voila i was lucks it was not encrypted but if it was this mother will still work

Our developers are working with APFS and maybe it will be supported in near future.