R-Studio supports all these technologies and can unlock their encrypted volumes (hard drives and images ) using either their passwords or recovery keys.

CoreStorage/FileVault

Locked CoreStorage Volume in R-Studio

To unlock the volume

1.	Control-click the encrypted volume and select Unlock encrypted drive on the contextual menu.

2.	Enter the password/recovery key on the Unlock encrypted drive dialog box

>	R-Studio will unlock the volume

Unlocked CoreStorage Volume in R-Studio

If the volume is partially encrypted, R-Studio can recognize which part is encrypted and which isn't. It will provide a correct access to the unencrypted and encrypted parts of the volume, provided that the correct password is entered.

Partially encrypted volume

R-Studio Technician/T80+

In addition to the password, it’s possible to enter other decryption data. Click the Advanced… button and enter available data.

Unlock encrypted drive: Advanced

This data is usually very hard to obtain and only very advanced institutions can recover it from actual hardware.

Data recovery from deleted or damaged APFS volumes

When macos deletes an APFS volumes, it also wipes out all decryption information from its APFS container. In this case even knowing the password won’t help. Still, there’s a trick that may help to open a deleted or damaged encrypted volume.

Let’s us have a hard drive with an APFS container with 3 APFS volumes:

APFS container and its volumes

One of them has been deleted and R‑Studio cannot unlock (decrypt) it:

APFS container with a deleted APFS volume

But if we have an image of the disk’s previous state, we can extract the necessary encryption information from that image.

Load the image and double-click the existing volume. Click the Advanced… button instead of entering its password.

Export of encryption information

Click the Export crypto context... button and save a file with this information. Then click the Close Image button to unload the image.

Then double-click the APFS-1 volume and click the Advanced button.

APFS container with a deleted APFS volume

Click the Load and apply crypto context… button

Loading the encryption information

and load the file generated from the image.

Select the required information type (a password for our case), enter the data, and click the Unlock button.

Unlocking the APFS volume

Note that the password will be explicitly shown.

R‑Studio will open files on the volume.

Apple Fusion Drive (with installed macOS)

R‑Studio detects components of Apple Fusion Drive and creates virtual Fusion Drives automatically. At the same time, R‑Studio gives access to the individual components of the Fusion Drives (hard drives and images).

Fusion Drive in R‑Studio

When an automatically created Fusion Drive is selected, R‑Studio highlights its components.

R‑Studio shows the components of the Fusion Drive on its APFS Fusion Components tab.

Fusion Drive Components tab

R‑Studio shows broken Fusion Drive s in pink.

Broken Fusion Drive in R-Studio

The Fusion Drive Components tab also allows you to manually disconnect or connect the components, for example, if they are such damaged that R‑Studio cannot recognize them as parts of a broken Fusion Drive. Select the object from the drop-down box and click the Connect button. R‑Studio displays the objects it recognizes as the components of the Fusion Drive in blue.

Adding a component manually

You may immediately switch to the Fusion Drive configuration that R‑Studio believes most probable by clicking the Reassemble button.

R‑Studio shows Fusion Drive with manually added components in blue:

Fusion Drive with added members in R-Studio

Apple Fusion Drive (without installed macOS)

Fusion Drive in R‑Studio

When an automatically created Fusion Drive is selected, R‑Studio highlights its components.

Data Recovery Articles

PC Privacy Articles

Home > Data Recovery Using R-Studio > Volume Sets and RAIDs > Various Disk and Volume Managers > Apple CoreStorage/FileVault/Fusion Drive Volumes

Apple CoreStorage/FileVault/Fusion Drive Volumes

R-Studio Technician/T80+

Data recovery from deleted or damaged APFS volumes

Home > Data Recovery Using R-Studio > Volume Sets and RAIDs > Various Disk and Volume Managers > Apple CoreStorage/FileVault/Fusion Drive Volumes