1

My mid-2019 MacBook Pro has a fault on the mainboard that causes it to crash soon after (sometimes while) it boots. I’m trying to get the data off the internal SSD. When I boot it in target mode (by pressing ‘T’ during startup), I can access the SSD as an external FireWire drive on another Mac. It doesn’t immediately crash then, but when I start copying files, it eventually does. However, to my surprise, I was able to make a complete bytewise copy of the SSD using dd, which took 3 days and didn't cause it to crash. The copy seems to be intact; I can mount the unencrypted volumes on it from the image.

Unfortunately, it turns out that the internal SSD is hardware-encrypted, and the encrypted volume on it can’t be mounted from the image. Trying to unwrap the container’s keybag as if it were software-encrypted results in garbage data with an incorrect checksum. Neither diskutil nor any of the open-source APFS tools that I found are able to unlock the volume.

My question is whether there’s any way to get around this, for instance by emulating the hardware encryption in software or by dding from a different device file that mirrors a decrypted version of the disk. I’d rather not have to copy the data piecewise in between crashes :-).

3
  • One option is to completely wipe and reinstall (As just APFS and not APFS-Encrypted, but I will research on this to get an alternate solution :).
    – Rishon_JR
    Mar 28, 2023 at 12:50
  • I think you are referring to FileVault. Does this documentation help? : support.apple.com/en-in/guide/mac-help/mchlp2560/mac
    – Rishon_JR
    Mar 28, 2023 at 12:56
  • @Rishon_JR: I don't think I am. As far as I understand, FileVault and hardware encryption are two separate things. I didn't activate FileVault on this machine, as far as I remember.
    – joriki
    Mar 28, 2023 at 13:32

0

You must log in to answer this question.

Browse other questions tagged .