We are committed to providing fast, efficient, and affordable software solutions that set new standards in the software development industry.
  • R-Studio for Mac Home Page
  • R-Studio for Mac Technical Documentation

Apple CoreStorage/FileVault/Fusion Drive Volumes


The macOS operating system has the following disk management systems:

FileVault , is a disk encrypted utility;

Fusion Drive is an Apple's hybrid drive technology;

CoreStorage is a logical volume management system.

 

R-Studio supports all these technologies and can unlock their encrypted volumes (hard drives and images ) using either their passwords or recovery keys.

CoreStorage/FileVault

Click to enlarge

Locked CoreStorage Volume in R-Studio

To unlock the volume

1. Control-click the encrypted volume and select Unlock encrypted drive on the contextual menu.
2. Enter the password/recovery key on the Unlock encrypted drive dialog box
> R-Studio will unlock the volume
Click to enlarge

Unlocked CoreStorage Volume in R-Studio

If the volume is partially encrypted, R-Studio can recognize which part is encrypted and which isn't. It will  provide a correct access to the unencrypted and encrypted parts of the volume, provided that the correct password is entered.

Click to enlarge

Partially encrypted volume

R-Studio Technician/T80+

In addition to the password, it’s possible to enter other decryption data. Click the Advanced… button and enter available data.

Click to enlarge

Unlock encrypted drive: Advanced

This data is usually very hard to obtain and only very advanced institutions can recover it from actual hardware.

Data recovery from deleted or damaged APFS volumes

When macos deletes an APFS volumes, it also wipes out all decryption information from its APFS container. In this case even knowing the password won’t help. Still, there’s a trick that may help to open a deleted or damaged encrypted volume.

Let’s us have a hard drive with an APFS container with 3 APFS volumes:

Click to enlarge

APFS container and its volumes

One of them has been deleted and R‑Studio cannot unlock (decrypt) it:

Click to enlarge

APFS container with a deleted APFS volume

But if we have an image of the disk’s previous state, we can extract the necessary encryption information from that image.

Load the image and double-click the existing volume. Click the Advanced… button instead of entering its password.

Click to enlarge

Export of encryption information

 

Click the Export crypto context... button and save a file with this information. Then click the Close Image button to unload the image.

Then double-click the APFS-1 volume and click the Advanced button.

Click to enlarge

APFS container with a deleted APFS volume

 

Click the Load and apply crypto context… button

Click to enlarge

Loading the encryption information

and load the file generated from the image.

 

Select the required information type (a password for our case), enter the data, and click the Unlock button.

Click to enlarge

Unlocking the APFS volume

 

Note that the password will be explicitly shown.

 

R‑Studio will open files on the volume.

Apple Fusion Drive (with installed macOS)

R‑Studio detects components of Apple Fusion Drive and creates virtual Fusion Drives automatically. At the same time, R‑Studio gives access to the individual components of the Fusion Drives (hard drives and images).

Click to enlarge

Fusion Drive in R‑Studio

When an automatically created Fusion Drive  is selected, R‑Studio highlights its components.

R‑Studio shows the components of the Fusion Drive on its APFS Fusion Components tab.

Click to enlarge

Fusion Drive Components tab

R‑Studio shows broken Fusion Drive s in pink.

Click to enlarge

Broken Fusion Drive in R-Studio

The Fusion Drive Components tab also allows you to manually disconnect or connect the components, for example, if they are such damaged that R‑Studio cannot recognize them as parts of a broken Fusion Drive. Select the object from the drop-down box and click the Connect button. R‑Studio displays the objects it recognizes as the components of the Fusion Drive in blue.

Click to enlarge

Adding a component manually

You may immediately switch to the Fusion Drive configuration that R‑Studio believes most probable by clicking the Reassemble button.

R‑Studio shows Fusion Drive with manually added components in blue:

Click to enlarge

Fusion Drive with added members in R-Studio

Apple Fusion Drive (without installed macOS)

Click to enlarge

Fusion Drive in R‑Studio

When an automatically created Fusion Drive  is selected, R‑Studio highlights its components.