This was achieve by connecting the MacBook SSD clone (HDD) to the original MacBook and using command line to fully decrypt it on The R&D team did certain changes on sector level to begin decrypting the APFS boot drive via command line.
The encryption key unlocked after successful account login was entered to decrypt the Startup volume.
The team requisitioned the password for the FileVault-enabled account from the client and entered it to unlock the encryption key that protects the startup volume.
The challenge began right with- how to access the clone of a native MacBook SSD having disk-levelĮncryption on a secondary host (non-OEM machine)? This would essentially require meeting two necessary conditions. Disk cloning was completed in a day’s time.ĭecrypting the Mac SSD clone was the most challenging aspect of this data recovery case. The clones were created on two separate HDDs to serve as backup in case of any contingency which was anticipated considering the complexity of this case. The process copied entire data of the SSD including the information to boot to the operating system on the original drive.
Stellar data care experts used proprietary cloning software to create clones of the MacBook SSD via its HDD disk image. This problem was overcome by using a USB-C to USB 2.0 adapter for connecting and imaging the MacBook SSD, which was completed in 4 days. The disk imaging step however faced an impediment- the MacBook had only one USB-C port which couldn’t be directly connected to the USB 2.0 Standard-A connector on the external HDD. SSD’s system and data while it remained inside the MacBook.
Without disk imaging, it wouldn’t be possible to operate on the native Imaging the Mac SSD was a critical step to obtain a ‘logical’ replica of the drive that could be cloned and further operated to gain access for decryption and data recovery. Techniques followed through the stages of disk cloning, decryption, and data recovery, as follows:ġ. Stellar data care experts managed to retrieve the entire data successfully by using a mix of standard and proprietary data recovery tools and OS installation which would overwrite the erased data. Unfortunately, there was no backup of this data, and further, the SSD had been secured with FileVault full-disk XTS-AES 128 encryption for the only user account configured on the MacBook.īy the time the MacBook ® was brought to a Stellar ® data recovery service center, it was in an unbootable state. The user then rebooted the MacBook ® in Recovery Mode and used Disk Utility to erase the startup (and only) volume, resulting in loss of 400 GB data stored on the 512 GB SSD. “Could not create a Preboot Volume for APFS to install.” However, while attempting to erase the volume, the user received an error message. This case outlines recovery of 400 GB data lost from a MacBook ® while it was being prepared for macOS High Sierra installation.Īs the standard procedure, the MacBook ® SSD startup volume needed to be erased and reformatted in APFS so as to prepare it for fresh installation