2

A client has a MacBook Pro Retina with a FileVault2 encrypted boot drive, and the Mac used to dual boot with Linux. Disk Utility apparently showed 4 partitions [Mac HD, Linux, and other 2 small partitions, likely used by Linux as it too was full disk encrypted.

He managed somehow to delete one of the small partitions, and now all disk utility shows are disk0s1, disk0s2, and so on, without even the containing physical drive above in the list.

The os was 12.12.4 [likely, definitely 12.12.x].

This is an image from Recovery > Disk Utility:

disk-utility

      start       size  index  contents
          0          1         PMBR
          1          1         Pri GPT header
          2         32         Pri GPT table
         34          6         
         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
     409640  813902408      2  GPT part - FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
  814312048    1269536      3  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  815581584       1648
  815583232   80498047      4  GPT part - 0FC63DAF-8483-4772-8E79-3D69D8477DE4
  896081279        641         
  896081920    2244608      5  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  898326528     262144         
  898588672   78516224      6  GPT part - 0FC63DAF-8483-4772-8E79-3D69D8477DE4
  977104896        131         
  977105027         32         Sec GPT table
  977105059          1         Sec GPT header

Of course he doesn't have a backup. He has the recovery key for FileVault2. Any ideas?

| improve this question | |
  • 1
    Please add the system version (e.g. macOS 10.12.5) and the output of diskutil list and sudo gpt -r show disk0 entered in menubar > Utilities > Terminal booted to Internet Recovery Mode (or another external boot drive)! Text version preferred - in Internet Recovery Mode a pic taken with some kind of digital camera is sufficient. – klanomath Feb 14 '18 at 16:29
  • @klanomath Thank you so much, please see the updated question above. – Nikksno Feb 20 '18 at 3:54
0

The partition map seems valid and no important small partition has been deleted (maybe one less important EFI or Apple_Boot partition between partition 5 and 6 - the other gaps of unallocated disk space are too small to contain a useful partition e.g. 1648 blocks = ~844 kB).

Partition 2 and 3 of disk0 got the wrong partition type though - the encrypted partition/data shouldn't be lost. Partition 3 has the typical size of a pre-APFS recovery partition (1269536 blocks) and partition 2 probably is the FV2 partition. The proper type of a recovery partition is 426F6F74-0000-11AA-AA11-00306543ECAC and the proper type of a CoreStorage partition (the base of FV2) is 53746F72-6167-11AA-AA11-00306543ECAC (instead of FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF).

Boot to Internet Recovery Mode or another external boot drive and modify the partition types with gpt.

  1. Boot to Internet Recovery Mode

  2. Get the details:

    diskutil list

    Below I assume the internal 500 GB SSD has the device identifier disk0

    gpt -r show disk0

  3. Remove partition 2 and 3:

    diskutil umountDisk disk0
gpt remove -i 3 disk0
diskutil umountDisk disk0
gpt remove -i 2 disk0

  4. Re-add partition 2 and 3 with proper types:

    diskutil umountDisk disk0
gpt add -i 3 -b 814312048 -s 1269536 -t 426F6F74-0000-11AA-AA11-00306543ECAC disk0
diskutil umountDisk disk0
gpt add -i 2 -b 409640 -s 813902408 -t 53746F72-6167-11AA-AA11-00306543ECAC disk0
  5. After adding partition 2 with gpt you will probably be asked to enter a passphrase

  6. If not unlock the FV2 volume with:

    diskutil cs list
diskutil cs unlockVolume lvUUID #lvUUID: the UUID of the Logical Volume

  7. Verify disk and volume

    diskutil verifyDisk disk0
diskutil list #get the device identifier of the mounted FV volume (probably in the upper tens: disk17 or disk18)
diskutil verifyVolume diskX #with diskX: the device identifier of the mounted FV volume
| improve this answer | |
  • I can't believe it, it worked, thank you so much. The only thing is that the gpt remove -i N commannd didn't work, maybe it needs a disk0 at the end? Don't remember how I got it to work, but it did, and the rest went flawlessly. Can I donate to your work in any way? Thank you very very much once again. – Nikksno Feb 20 '18 at 11:50
  • @Nikksno Yeah, I will edit it - I copied it from a similar answer with a different device identifier and forgot to add the proper one ;-) – klanomath Feb 20 '18 at 11:52
  • Awesome. I'd really like to give something back, you really saved the day here. Let me know how please. – Nikksno Feb 20 '18 at 11:55
  • @Nikksno Accepting the answer is sufficient ;-). You (or your client?) can also donate some money or something else to an arbitrary charity organization of your/his/her/their choice or send me an Amazon gift card via email...;-) – klanomath Feb 20 '18 at 12:25
  • Absolutely, where can I find your email address? – Nikksno Feb 22 '18 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .