Unable to decrypt drive

Data recovery from Hard Disk Drives with logical problems

Moderator: Dmitriy_TS


jimpan
Newbie
Posts: 4
Joined: 21.07.18
Reputation: 0 / (0)

Unable to decrypt drive

Postby jimpan » 29.07.19, 16:59

Hi there. Hoping someone can help. I have an SSD drive that is from a MacBook Pro Retina early 2013. I was advised there is no support for the controller which is 88SS9174-BLD2.
However I was able to load it up in DE and can see the APFS volume. It also lists me the Macintosh HD and whenI go to it, it asks for a password. I input the FileVault password that the user has given me and get an error message
that says "There is no any KEK!" and "There is no any VEK!". I do not understand what these error messages are.
I can also see two other options when I right click the APFS volume which Decrypt partition but is greyed out.
Has anyone had any experience with APFS volume that is file vaulted?
Any steps or suggestions would be greatly appreciated.
Thanks
Jim

User avatar
d_d_recovery
Newbie
Posts: 17
Joined: 20.03.19
Reputation: 0 / (2)

Re: Unable to decrypt drive

Postby d_d_recovery » 29.07.19, 17:07

What happened to the SSD? Did it fail during a Mac OS update?


ThomasH
New user
Posts: 75
Joined: 11.01.12
Reputation: 2 / (21)

Re: Unable to decrypt drive

Postby ThomasH » 30.07.19, 05:19

I'm having a similar issue now with an APFS hard drive, encrypted, that required headswap and has lots of scattered damage everywhere.
I'm using the latest version of DE released 7-29-19, and I had tried with the older version too, with the same results.

I made sure that I selected to use 512b sectors when starting DE (not physical 4k sectors) or it doesn't start to work.
I get the same KEK VEK errors.
With DE, I can choose to mount the volume to Windows, and then Rstudio can receive the password and unlock the volume. I can get some of the data recovered with Rstudio+DE, but it's far from ideal since I have much less control for mapping, sector skipping, and resets that load PSHT+RDMT from saved files (it's a HGST-ARM).

When I first click on the encrypted sub-partition, DE automatically asks for the password. When I enter it, I get:
There is no any KEK!
There is no any VEK!
Encryption key is not assigned for this volume! Add password to decrypt the data
Failed to check APFS metadata block 5 557, LBA = 454 096
Failed to get catalog object


When I use DE to try to 'Map' just the selected encrypted partition it only sees it as 0 sectors and reports in this in the log:
Failed to check APFS metadata block 5 557, LBA = 454 096
Failed to get catalog object


I can try to 'Map' partitions prior to the 'encrypted subpartition'--I don't know what to properly call this-- in DE, but it doesn't help with decrypting and doesn't take the user's password.

Any suggestions?

User avatar
d_d_recovery
Newbie
Posts: 17
Joined: 20.03.19
Reputation: 0 / (2)

Re: Unable to decrypt drive

Postby d_d_recovery » 30.07.19, 18:31

ThomasH wrote:Source of the post I'm having a similar issue now with an APFS hard drive, encrypted, that required headswap and has lots of scattered damage everywhere.
I'm using the latest version of DE released 7-29-19, and I had tried with the older version too, with the same results.

I made sure that I selected to use 512b sectors when starting DE (not physical 4k sectors) or it doesn't start to work.
I get the same KEK VEK errors.
With DE, I can choose to mount the volume to Windows, and then Rstudio can receive the password and unlock the volume. I can get some of the data recovered with Rstudio+DE, but it's far from ideal since I have much less control for mapping, sector skipping, and resets that load PSHT+RDMT from saved files (it's a HGST-ARM).

When I first click on the encrypted sub-partition, DE automatically asks for the password. When I enter it, I get:
There is no any KEK!
There is no any VEK!
Encryption key is not assigned for this volume! Add password to decrypt the data
Failed to check APFS metadata block 5 557, LBA = 454 096
Failed to get catalog object


When I use DE to try to 'Map' just the selected encrypted partition it only sees it as 0 sectors and reports in this in the log:
Failed to check APFS metadata block 5 557, LBA = 454 096
Failed to get catalog object


I can try to 'Map' partitions prior to the 'encrypted subpartition'--I don't know what to properly call this-- in DE, but it doesn't help with decrypting and doesn't take the user's password.

Any suggestions?

Have you tied the new DE version launched a few days ago?


ThomasH
New user
Posts: 75
Joined: 11.01.12
Reputation: 2 / (21)

Re: Unable to decrypt drive

Postby ThomasH » 12.08.19, 23:18

Yes, I'm using the latest version.


Return to “Data Extractor”

Who is online

Users browsing this forum: No registered users and 5 guests