Ir para o conteúdo principal

The March 2015 update of Apple's 13" MacBook Pro Retina Display, model A1502, features fifth-generation Intel Core i5 and i7 processors and introduces the Force Touch trackpad.

1185 Perguntas Visualizar todos

Safest way to get data off of SSD from dead MacBook

I have an MBP (Macbook Pro 13" Retina, A1502 EMC 2835, from 2015) which suddenly died (no longer turns on even though the battery was full) and the charger does not light up.

I have some data that has not been backed up on the password-encrypted 256GB 12+16pin Samsung s4ln058a01-8030 SSUBX SSD which I want to recover.

So what is the safest way to recover the data on my SSD?

---------------------------------------------

Details

I do not remember my software setup, I guess it is:

  • encryption via Filevault 2 (I have a regular password and a backup key ***-****-****-****-****-**** with each * being a digit or a capital letter)
  • Mac OS El Capitan.

I do plan to fix/replace (some parts of) my MBP, but first I want to recover all data with the lowest risk of data loss. After some research, I think of the following approach:

  1. buy an SSD USB-enclosure specifically for MBP and put my SSD in
  2. read data from SSD via dd (disk dump) and try to decrypt the image on a mac with my password or backup key. Or is the SSD combining my password with an internal ID, rendering 2) impossible?
  3. If 2) does not work, mount SSD on a different OSX and backup the data that OSX decrypts on the fly after I provided my password or backup key
  4. If 2) and 3) do not work, buy another MBP A1502 EMC2835 and plug in my SSD there, and then start and backup data on that MBP (I heard FileVault does not lock encryption to any other system component).

Are these 4 steps the best approach? Which of these steps changes the SSD's state (write access, change in operation mode, decryption on SSD, ...)?

Alternatively, I am also willing to pay for a professional (but not 1000€) to recover my data. However, I have heard bad stories about GRAVIS stores (and also our local Apple-partnered repair shop ImplementIT). Would you recover the data yourself or rather go to a professional? To whom?

Imagem de External SSD Enclosure for Select Mid 2013 to Mid 2015 Macs

Produto

External SSD Enclosure for Select Mid 2013 to Mid 2015 Macs

$99.99

Responder a esta pergunta Também tenho esse problema

Esta é uma boa pergunta?

Pontuação 0
Adicionar um comentário

1 resposta

Pergunta mais útil

Well, you've got Step 1 correct! But you'll need a different path from then on.

You would need a Mac system running the same macOS release which is also using your same user account. Then when you connect the drive to your system it will first ask you to access the drive using your user account and then you will need to supply the FileVault backup key done! The next step is to copy-off what you need.

References:

Esta resposta foi útil?

Pontuação 1

4 comentários:

Thanks a lot for pointing out my approach will not work. "Running the same macOS release which is also using your same user account" does sound like a lot of work (I am not even sure it is Mac OS El Capitan :-0).

Can I do step 1) and 2) to at least have a disk dump image of my encrypted data, then experiment with other solutions (fixing my MBP or buying another A1502) to get to my data, and in case this corrupts the data on the SSD write back my disk dump image to the SSD to put the SSD into the same state it is in right now?

por

@Dave Far - How about just giving it ago with what you have not for a system. Unless you have access to a support computer and a few years of time I don't see you decrypting your encrypted data! AES -128 two key encryption is top shelf security!

Transferring the encrypted data to another disk doesn't alter things and is not needed the drive is not writing back as long as you have the correct user account and recovery key. All you're doing is making the task more complex.

por

You are right, decrypting the data myself is out of the question. That's why I suggested to make a disk dump image of my encrypted data so that I can write back that image to the original/another SSD in case something happens to the original SSD (similar to an encrypted time machine backup, I guess).

Since I have little experience with SSD enclosures and external filevault, I would feel safer if such encrypted backup images via dd worked...

@danj thanks a lot for your references, too.

I also found an extended PDF version Apple FileVault 2: Tips for IT pros with section THREE WAYS TO RECOVER DATA ENCRYPTED WITH APPLE’S FILEVAULT 2 added.

Are you sure that "You would need a Mac system running the same macOS release which is also using your same user account." is a strict necessity?

From the PDF version I found the following:

The only people who can access the data are those who have the account credentials that enabled FileVault on the disk OR who have the master recovery key. (page 3)

Once FileVault 2 is enabled, only the user with administrative privileges that enabled FileVault 2 with their account can decrypt the drive’s contents. In addition, a master recovery key is created during the initial process; users with EITHER of those keys are the only ones who can decrypt the volume and read the contents of the drive. (page 4)

The service is turned off by default to allow end users to perform the initial setup process, which allows them to create a master recovery key. in the event that they become locked out of their account and must recover data via an alternate path. (page 8)

2: RECOVERY KEY METHOD on page 10

por

@Dave Far - First, if you're so worried about using the case and you have a compatible MacBook Pro that you could swap out the blade SSD just do that! Then you would have direct access to the files as if it was the original system!

Now you could then just copy off the drives data to an external drive sitting in the case (making sure you don't encrypt it in the process.

As far as what you discovered in the PDF version (which I hadn't seen) I can't speak for their testing, all I know is what has worked for me and I did encounter issues using a different user ID.

por

Adicionar um comentário

Adicionar a sua resposta

Dave Far será eternamente grato(a).
Exibir estatísticas:

Últimas 24 horas: 0

Últimos 7 dias: 19

Últimos 30 dias: 67

Duração total: 1,293