Locked Drive

[Wander65]

I have a Mid 2010 Macbook Pro 17 running Yosemite. The hard drive recently crashed. Internet Recovery did not work. Putting the drive in Target Mode would not mount on other machines...I tried a Mac Pro and another Macbook Pro. Same result. You could "see" the drive in Disk Utility or using Terminal commands but both would tell you the drive was locked and would have to be unlocked to make any changes. Verifying in DU would eventually tell you "Invalid File Label @ 749284028416: cksum mismatch" but repairing the disk changed nothing. DU can see the parent Macintosh HD but the child Macintosh HD is greyed out. Veryfy permissions and repair permissions are greyed out for both Parent and Child. The format for the child says Locked Logical Partition.

Taking the drive itself out of the laptop and putting it in an external case to turn it into an external drive produces similar results. I don't care about the drive itself but I dod care about the 200 GB or RAW image file I was ironically backing up at the time of the crash.

I have tried the full versions of EaseUS and SoftTote Data Recovery. SoftTote was actually able to recover about 24,000 database and system files that are essentially meaningless to me. Ease US will scan for about 5 minutes and then tell me the device has been disconnected. It hasn't and it is still spinning. The drive spins up fine. No clicking or surging to indicate a stuck head. I have not opened the case yet to look at the drive itself. That's next I suppose.

So is there anyway via Terminal or other method to unlock the locked drive so I can retrieve the data?

 

[BLUEDOG314]

You have FileVault on. From the terminal window copy the UUID from the Logical Volume, the "63268D..." then type "diskutil cs unlockvolume PASTE" where paste is the copied UUID. It will ask for the volume password which is probably what you used to log in. Assuming you know the password it will unlock.

If this is an issue with the directory and ultimately core storage and decryption happening or not happening at startup, don't waste your time trying to repair anything, DU is useless almost always. Recover your data then nuke the drive.

 

[Wander65]

You have FileVault on. From the terminal window copy the UUID from the Logical Volume, the "63268D..." then type "diskutil cs unlockvolume PASTE" where paste is the copied UUID. It will ask for the volume password which is probably what you used to log in. Assuming you know the password it will unlock.

If this is an issue with the directory and ultimately core storage and decryption happening or not happening at startup, don't waste your time trying to repair anything, DU is useless almost always. Recover your data then nuke the drive.

Well, that works...sort of...after inputting that string I get a message in Terminal that the drive has been successfully unlocked and then before I can do anything else, the Mac Pro that I have the drive plugged into shuts down and restarts. The drive in question spins up and the Terminal reads:

Marks-Mac-Pro:Volumes markdierker$

[Restored]

Last login: Thu Oct 19 02:05:27 on console

Marks-Mac-Pro:Volumes markdierker$

So it looks like the shut down is restoring the lock to the disk. When I run the list command in Terminal again, it shows the drive to be locked. I've done this twice with the same result. Make that 3 times. I was thinking the Mac Pro restarting was causing the lock to be restored so I disconnected the drive right after the Terminal message said it was unlocked. No Joy. The Mac Pro still restarted and the disk still reads as locked. I'll try it again and see if I can read what the Terminal is saying after it says the disk is unlocked because it does not remain on the Terminal window after the restart.

Mark

 

[BLUEDOG314]

So the "lock" on the drive is the encryption. It is not something that is simply taken off. To remove the lock per se, you have to fully decrypt the volume, something that will likely take over night depending on the size of the drive, especially if it is a spinning disk drive.

What I think, the drive likely has severe directory or partition map damage, so bad that it is causing the Mac Pro to shut down. It would be very uncommon, but if the drive is locked and unmounted due to encryption, then the machine shuts down as soon as it is unlocked and mounted, its got to be the act of reading the volume that is causing the shutdown.

I don't know if this is possible, but I'll do some research with you. See if there is a way to decrypt and unlock the volume but prevent fsck and any other verification methods from running on the volume similar to how you can in hdiutil with things like -noautofsck and -noverify.

Finally however, if I'm going to be honest with you, you likely will not be recovering anything from the drive. The only option I would even try if you can get the volume unlocked and mounted without shutting down would be DiskWarrior.

 

[Wander65]

So the "lock" on the drive is the encryption. It is not something that is simply taken off. To remove the lock per se, you have to fully decrypt the volume, something that will likely take over night depending on the size of the drive, especially if it is a spinning disk drive.

What I think, the drive likely has severe directory or partition map damage, so bad that it is causing the Mac Pro to shut down. It would be very uncommon, but if the drive is locked and unmounted due to encryption, then the machine shuts down as soon as it is unlocked and mounted, its got to be the act of reading the volume that is causing the shutdown.

I don't know if this is possible, but I'll do some research with you. See if there is a way to decrypt and unlock the volume but prevent fsck and any other verification methods from running on the volume similar to how you can in hdiutil with things like -noautofsck and -noverify.

Finally however, if I'm going to be honest with you, you likely will not be recovering anything from the drive. The only option I would even try if you can get the volume unlocked and mounted without shutting down would be DiskWarrior.

Yeah, I'm getting less and less confident that I'll be able to recover anything too but I'd like to try everything i can before giving up on it. I also have a couple older Macbook Pros and I just bought an SSD drive for the MBP that the drive died in so I'll test your original solution on those just to make sure it's not the MP that is having issues.

Beyond that, thanks for helping me run this down. I really appreciate it. You understand a lot more about the various Terminal commands than I do. One positive note, I was able to run the recovery program on all my SD cards and get back at least part of the RAW files I lost on the hard drive.

 

[Wander65]

Yeah, I'm getting less and less confident that I'll be able to recover anything too but I'd like to try everything i can before giving up on it. I also have a couple older Macbook Pros and I just bought an SSD drive for the MBP that the drive died in so I'll test your original solution on those just to make sure it's not the MP that is having issues.

Beyond that, thanks for helping me run this down. I really appreciate it. You understand a lot more about the various Terminal commands than I do. One positive note, I was able to run the recovery program on all my SD cards and get back at least part of the RAW files I lost on the hard drive.

[doublepost=1508583872][/doublepost]When I got my MBP up and running again today with the new SSD running Yosemite I was able to plug the damaged drive in via USB and it actually mounted for about 3 hours during which time I was able to recover maybe 75-100 Gb of files. Better than nothing! Then the file folders started to show no files inside even though Get Info showed the number and overall size of of the files in the folder. Then it unmounted and would not remount. Now when I try and get a listing of the drives via Terminal I can only get this about the drive:

CoreStorage logical volume groups (1 found)

|

+-- Logical Volume Group 18521486-C789-4088-8F65-4EA1835B24D9

=========================================================

Name: Macintosh HD

Status: Initializing

Size: 749296615424 B (749.3 GB)

Free Space: 18939904 B (18.9 MB)

|

+-< Physical Volume 0D4C6D09-C44E-432D-B968-20EA23ACECC9

----------------------------------------------------

(No properties)



Disconnecting and reconnecting the drive and running the list and unlock commands I get this:
Last login: Sat Oct 21 06:12:07 on console

Marks-Macbook-Pro2010:~ markallendierker$ diskutil corestorage list

CoreStorage logical volume groups (1 found)

|

+-- Logical Volume Group 18521486-C789-4088-8F65-4EA1835B24D9

=========================================================

Name: Macintosh HD

Status: Online

Size: 749296615424 B (749.3 GB)

Free Space: 18939904 B (18.9 MB)

|

+-< Physical Volume 0D4C6D09-C44E-432D-B968-20EA23ACECC9

| ----------------------------------------------------

| Index: 0

| Disk: disk1s2

| Status: Online

| Size: 749296615424 B (749.3 GB)

|

+-> Logical Volume Family C89A370E-DDFE-4EF3-BFF1-342422634C4E

----------------------------------------------------------

Encryption Status: Unlocked

Encryption Type: AES-XTS

Conversion Status: Converting

Conversion Direction: backward

Has Encrypted Extents: Yes

Fully Secure: No

Passphrase Required: No

|

+-> Logical Volume 63268D59-D7B1-4D7D-B243-950CD134E98D

---------------------------------------------------

Disk: disk2

Status: Online

Size (Total): 748925353984 B (748.9 GB)

Conversion Progress: 0%

Revertible: Yes (unlock and decryption required)

LV Name: Macintosh HD

Volume Name: Macintosh HD

Content Hint: Apple_HFS

Marks-Macbook-Pro2010:~ markallendierker$ diskutil cs unlockvolume 63268D59-D7B1-4D7D-B243-950CD134E98D

63268D59-D7B1-4D7D-B243-950CD134E98D is already unlocked and is attached as disk2

Marks-Macbook-Pro2010:~ markallendierker$

But the disk still isn't mounting.

Is there a way to get a file list of the drive through terminal and transfer the files that way?

 

[Fishrrman]

I could be wrong, but I sense that having filevault on has "munged up" much of the drive, making recovery all-but impossible for many files.

You're probably lucky to have gotten what you did from it...

 

[Wander65]

It started back up one more time and I was able to get my email and a couple more folders of photos and then it died completely. Won't even spin up. So thanks so much for all the help!

 

[BLUEDOG314]

It started back up one more time and I was able to get my email and a couple more folders of photos and then it died completely. Won't even spin up. So thanks so much for all the help!

No problem. When you say spin up I assume at this point it physically failed as well? DiskWarrior may still be of some help.