An old drive removed from a retina MacBook Pro some years past, kept away in a drawer and brought to light again with a hope attached. The data contained on this drive is fully encrypted and none of the remembered passwords will unlock access to the data. This is one example where the honest response will likely be a limit instead of a price quote; and it's best to provide that answer at the beginning, before someone has paid for postage. The drive itself is functional, allowing a clean image to be made, and allowing the health status of the drive to be determined within an hour. The issue lies with full-disk encryption, which is currently preventing us from accessing the data. Without either the password or recovery key, it is not a puzzle waiting for better equipment, it represents pure mathematics accomplishing exactly what it was designed to accomplish. There are two options available here. If you have a valid credential, then the volume can be opened from the image and all data will be returned. However if no valid credentials exist, then we simply state there are no valid credentials.
| Media | Drive removed from a retina MacBook Pro. Reads and images without fault; the volume on it is encrypted and no known password unlocks it. |
| Reported situation | Drive from a retina MacBook Pro · data encrypted · no password worked · set aside for some years · recovery hoped for. |
| Fault class | Encryption of disk without valid credentials. Hardware has been checked and is sound, images are good, however volume needs either password or recovery key to be unlocked. Forensic class of work where there is a known credential. Limitation is the credential (not the media). |
| Equipment used | Read through a hardware write-blocker on PC-3000 UDMA · imaged read-only on DeepSpar and the drive's health confirmed, the presence and type of encryption identified from the image · volume unlocked from the image using the owner's password or recovery key where one is available and mounted read-only, contents validated in R-Studio · position stated plainly where no credential exists, since the encryption is not bypassed. |
Two separate things are stacked here and people run them together. Underneath is a drive, which either reads or does not. On top is an encrypted volume, which either unlocks or does not. A drive can be in perfect condition and image start to finish while the volume on it stays completely inaccessible, and that is precisely the situation described.
FileVault has encrypted all data on this Mac's drive using a single encryption key, which in turn is also encrypted by the user's login password or by an existing recovery key provided at the time FileVault was switched on. The encryption does not have a maintenance door and there is no way for Apple (or anyone else) to bypass the security mechanism. Therefore, any claims made about breaking FileVault are based either on their ability to guess passwords for customers through what appears to be a legitimate technical support process or they are misleading.
So, there will be useful work done before you start packing up anything, and the work will be non-technical. Find your credentials. Your account password from the time this device was in use (including the one no one has ever thought of as being important because you only used it for a few months). The recovery key that Apple's setup process once shows on-screen and that many users have photographed, printed, stored in a password manager and then forgotten about. If this device was managed by an employer or university while it was in service, they may have access to it. If your Apple ID was configured with escrow enabled, contacting Apple directly would likely be a good course of action.
When a credential can be found, this is a simple forensic job with a quote and payment in full in advance. If no credential can be found, then no job exists and therefore cannot be charged for. The assessment has no cost and will be completed within 2 working days from receipt; the assessment may also produce an answer of "no". Therefore, saying so is less expensive for all parties involved than to pretend otherwise for a couple of weeks.
The drive was read on PC-3000 UDMA through a hardware write-blocker and imaged read-only on DeepSpar, which established two useful things: the hardware is healthy, and the encryption is present and intact across the volume. All further work happened on the image, never on the original. Where the owner produced a working password or recovery key, the volume was unlocked from the image, mounted read-only, and the contents parsed and validated in R-Studio before being written to fresh media. Where no credential existed, the honest position was stated and the drive returned, because there is no version of this work that gets past the encryption without one.
When an image of the drive was taken as read-only (and thus could not be written to), the health of the drive was confirmed and all of the locked encrypted data was unlocked and recovered wherever a viable password/credential existed. Where no such password or credential existed, no charge was made since no action could be taken. All encryption services of this nature are considered to be of a forensic nature, quoted in full prior to performing them and paid in full prior to beginning, they take a long time to perform manually and do not fall under our standard service terms, where in most cases you only pay if we recover your data, and that is stated at the outset rather than discovered later. While the actual data may never actually be recovered, the real value from an assessment like this is usually found in simply confirming that the drive is good. Once it has been determined that the drive is good, it gives the owner an indication that his/her search for the recovery key is worthwhile; once he/she finds it, the data is already waiting.
If you are going to go after a lab you need to go after the credentials first. The old password on an account, the recovery key photograph or print out made when setting up, the password stored in a password safe from back then, the IT department of your employer or university (if the computer was ever managed by them) or the Apple ID (with escrow turned on). That is the place you will find the recovery process. Be very careful about anyone that offers to crack an encrypted drive for a fee; this is generally a guess and usually incorrect and at your expense. One item we recommend be completed prior to continuing is an assessment that verifies the health of the drive and if the volume is still intact. This is at no cost to you and lets you know whether you should continue searching for the key or to stop.
Each file below comes from a genuine enquiry taken from households and firms across Aberdeen, Aberdeenshire and the wider north-east, anonymised so nobody can be identified. Each one sets out how the fault was reasoned through, what was done about it, and which equipment did the work.
A reset does not scrub a drive clean, but what it leaves depends entirely on which MacBook Air it was — and on one machine it leaves nothing at all
A light proves the drive has power and nothing else — and one firm failing to read it is a fact about that firm's equipment, not a verdict on the platters
Whether the machine ever runs again is beside the point — the only question that matters is whether the storage comes out
Free assessment and 2 working days for results at most once it arrives, with amount fixed in writing. For logical work, in most cases you only pay if we recover your data. Start online or pick up the phone.