Macbok Pro 2010, A1286 EFI bypass request.

[Hakuri]

A client's wife lost her iphone(in the house) and stupidly did an icloud lock on the account, locking out all 6 apple devices they had.

Upon finding her phone, they used the 4 digit pin to unlock 5 of the devices, the macbook pro was left alone and continued to not be touched for a week.

When the macbook pro was started up after a week and the 4 digit pin was entered, it failed to unlock and stated the pin was invalid.

Instead of calling me, they removed the macbook pro from the icloud account and the "apple store techs"(if that's what you call them) could not unlock the efi nor 4 digit icloud lock still present. The apple store pretenders told the client to go someplace else because the macbook pro is older than 5 years. There is data on the drive that needs to be recovered, the drive is not readable when attached to another mac. removing ram and holding down command + option + p+ r results in efi lock screen.

The data is the most important, I have access to knoppix if I have to perform some forced mounting to force the disk to be writable.

The efi lock needs to go, this is a 2010 macbook pro, not an air. Data needs to be pulled, and probably a fresh OS install, if the EFI can be removed.

 

[Hakuri]

Some updates using gdisk from UBCD shows a single partition, loading the backup partition table from the disk shows the proper 3 partition structure - HOWEVER - there are 31 partitions total, with the normal 3 being 29, 30, and recovery on 31. The data sits on partition 30, efi on 29. Partitions 1-28 are unintelligible cypher salad mishmash of digital *****. Any attempt to write the backup partition table to the disk results in aborted write as partitions 1-28 overlap everything. For $200 I can grab a tool to reset the efi chip on the logicboard to defaults, no worries there.

I just need to pull this clients data, and it's looking like that will be impossible as it sounds like this drive is encrypted.
[doublepost=1502513018][/doublepost]Or not? Running stellar mac data recovery on it and it's pulling files and showing some images while it's scanning the raw data.

This is all wack.

 

[Audit13]

Have you tried booting the machine after removing a stick or ram?

Maybe this will work:

Power on the Mac and immediately press and hold command-option-P-R.

The system will restart with the ‘bong' noise; allow it to do this 3 times. On the third ‘bong’ you can let go of the keys.

The machine will now boot with a cleared password and reset PRAM/NVRAM.

You can then shut down the machine and reconfigure the RAM configuration as you want it.

 

[Hakuri]

removing ram and holding down command + option + p+ r results in efi lock screen.

Pretty sure I made that clear that it does nothing.

 

[Audit13]

Pretty sure I made that clear that it does nothing.

My apologies. I was half asleep when reading.

Good luck in your search for a solution. If you are successful, please share the solution.

Thanks.

 

[Hakuri]

No solution to this disastrous problem, all of the files recovered from the hard drive are unusable as they are all encrypted.

The entire hard drive is encrypted, there is no attachment to icloud, and the 4 digit pincode the client's wife had doesn't work. It'll cost him 200+ to reset the EFI chip to defaults, hopefully he takes that route as it may open access to file recovery, though I doubt the original profile home folder will be decrypted upon removing the EFI firmware lock. I'll write back whether he takes the option or not.