Client has core storage and Lion File vault

Data recovery from Hard Disk Drives with logical problems

Moderator: Dmitriy_TS


osity
User
Posts: 358
Joined: 06.12.15
Reputation: 4 / (38)

Client has core storage and Lion File vault

Postby osity » 19.12.18, 04:36

What is the proper sequence here:

1.image the whole drive
2.clone data to drive and read it with any mac
3.input the password for File vault to get the files

Is this the correct order?


northwind
New user
Posts: 69
Joined: 14.06.11
Reputation: 3 / (25)

Re: Client has core storage and Lion File vault

Postby northwind » 19.12.18, 09:21

No.
PC3000 supports FileVault decryption on the fly.
You can find blog post from Ace and follow instructions.
It works pretty good.
Sandforce SSD Recovery
WD Preferred Lab


osity
User
Posts: 358
Joined: 06.12.15
Reputation: 4 / (38)

Re: Client has core storage and Lion File vault

Postby osity » 19.12.18, 19:20

what's the point of decrypting on the fly if you still have to image the entire drive due to corestorage?
You would have to image the entire volume because of that, correct?

User avatar
digitalsupport
New user
Posts: 121
Joined: 30.12.11
Reputation: 4 / (38)

Re: Client has core storage and Lion File vault

Postby digitalsupport » 21.12.18, 10:14

Decrypting on the fly lets you image only needed data, so less stress to a weak drive.


osity
User
Posts: 358
Joined: 06.12.15
Reputation: 4 / (38)

Re: Client has core storage and Lion File vault

Postby osity » 22.12.18, 00:18

digitalsupport, yes i know that, but with core storage, my understanding is that you have to image the entire drive first to see anything at all, regardless of decrypting filevault on the fly or not. Is that not your experience ?

My point is that file vault (and how/when you deal with it) is not the real problem here. Core storage is the real dilemma here.


Dmitriy_TS
Site Admin
Posts: 298
Joined: 01.04.13
Reputation: 8 / (78)

Re: Client has core storage and Lion File vault

Postby Dmitriy_TS » 26.12.18, 12:52

You can follow these steps:

1. Read MBR, GPT and HFS+ Volume header sectors to get FileVault partition map
2. Decrypt this partition using password or encryption key.
3. Read data you need based on Catalog file.

Please keep in mind that Fusion systems have the same signature. Don't mess them with FileVault.
With best regards
ACELab technical support
ts.acelaboratory.com
blog.acelaboratory.com


Return to “Data Extractor”

Who is online

Users browsing this forum: No registered users and 2 guests