© 2024 R-Tools Technology Inc.
All rights reserved.
The macOS operating system has the following disk management systems:
FileVault , is a disk encrypted utility;
Fusion Drive is an Apple's hybrid drive technology;
CoreStorage is a logical volume management system.
R‑Studio for Linux supports all these technologies and can unlock their encrypted volumes (hard drives and images ) using either their passwords or recovery keys.
CoreStorage/FileVault
To unlock the volume
1. | Right-click the encrypted volume and select Unlock encrypted drive on the context menu. |
2. | Enter the password/recovery key on the Unlock encrypted drive dialog box |
> | R‑Studio for Linux will unlock the volume |
If the volume is partially encrypted, R‑Studio for Linux can recognize which part is encrypted and which isn't. It will provide a correct access to the unencrypted and encrypted parts of the volume, provided that the correct password is entered.
In addition to the password, it’s possible to enter other decryption data. Click the Advanced… button and enter available data.
This data is usually very hard to obtain and only very advanced institutions can recover it from actual hardware.
Note: this method doesn't always yields positive results.
When macos deletes an APFS volumes, it also wipes out all decryption information from its APFS container. In this case even knowing the password won’t help. Still, there’s a trick that may help to open a deleted or damaged encrypted volume.
Let’s us have a hard drive with an APFS container with 3 APFS volumes:
One of them has been deleted and R‑Studio for Linux cannot unlock (decrypt) it:
But if we have an image of the disk’s previous state, we can extract the necessary encryption information from that image.
Load the image and double-click the existing volume. Click the Advanced… button instead of entering its password.
Click the Export crypto context... button and save a file with this information. Then click the Close Image button to unload the image.
Then double-click the APFS-1 volume and click the Advanced button.
Click the Load and apply crypto context… button
and load the file generated from the image.
Select the required information type (a password for our case), enter the data, and click the Unlock button.
Note that the password will be explicitly shown.
R‑Studio for Linux will open files on the volume.
Apple Fusion Drive
R‑Studio for Linux detects components of Apple Fusion Drive and creates virtual Fusion Drives automatically. At the same time, R‑Studio for Linux gives access to the individual components of the Fusion Drives (hard drives and images ).
When an automatically created Fusion Drive is selected, R‑Studio for Linux highlights its components.
R‑Studio for Linux shows the components of the Fusion Drive on its APFS Fusion Components tab.
R‑Studio for Linux shows broken Fusion Drive s in pink.
The Fusion Drive Components tab also allows you to manually disconnect or connect the components, for example, if they are such damaged that R‑Studio for Linux cannot recognize them as parts of a broken Fusion Drive. Select the object from the drop-down box and click the Connect button. R‑Studio for Linux displays the objects it recognizes as the components of the Fusion Drive in blue.
You may immediately switch to the Fusion Drive configuration that R‑Studio for Linux believes most probable by clicking the Reassemble button.
R‑Studio for Linux shows Fusion Drive with manually added components in blue: